ruby-nokey[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ruby-nokey.exe
Size 6.0MB
Sample261107-1anqsafv4x
SHA256 b2fb1a13a9c1cf78c419aacf5edebeb7a49901da64a0a9a739093e1919a78dc5
MD5 c12a56694bacdea28199d979177d56c3
SHA1 393d31d91f9029d57444e774909240b04bb10aec
SHA512 f638c6ee65e10bd20cfc3c4c8b45710ab584a28d1c6086a50c47a6099ee9268518b09d6d11c09cfa0d7fc48c5fd0da9d5726ec890564c432074a8bc4c4721c34
SSDEEP 98304:1hTwdwumUS9j35X5QtZNaDE55X9NQHxUHl7fJNy0LHn+7gfbF5+:uWU1ZNZ5X9NQHxUNby07Kgfj+
TLSH
T11A56AF03F26181E8C46EC578C35AA233EB72788E093472EB1BD45B252F66F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ruby-nokey.exe

File Explorer

ruby-nokey.exe

.exe 6.0MB

ruby-nokey.exe

IMPHASH 92dcd96b4ce3fe85c53d20d72df935be
SHA256 b2fb1a13a9c1cf78c419aacf5edebeb7a49901da64a0a9a739093e1919a78dc5
MD5 c12a56694bacdea28199d979177d56c3
SHA1 393d31d91f9029d57444e774909240b04bb10aec
SHA512 f638c6ee65e10bd20cfc3c4c8b45710ab584a28d1c6086a50c47a6099ee9268518b09d6d11c09cfa0d7fc48c5fd0da9d5726ec890564c432074a8bc4c4721c34
SSDEEP 98304:1hTwdwumUS9j35X5QtZNaDE55X9NQHxUHl7fJNy0LHn+7gfbF5+:uWU1ZNZ5X9NQHxUNby07Kgfj+
TLSH
T11A56AF03F26181E8C46EC578C35AA233EB72788E093472EB1BD45B252F66F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3400880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ruby.pdb

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtOpenFile NtWriteFile NtCreateNamedPipeFile NtReadFile RtlGetVersion NtCancelIoFileEx

kernel32

ReleaseMutex FormatMessageW MultiByteToWideChar FlsAlloc GetModuleHandleExW FlsFree FlsSetValue HeapAlloc IsThreadAFiber GetUserDefaultUILanguage SleepEx SetHandleInformation ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle SetWaitableTimer HeapFree HeapReAlloc GetCurrentProcess lstrlenW SetLastError WaitForSingleObjectEx RtlLookupFunctionEntry LCIDToLocaleName GetProcessHeap GetCurrentThread SetThreadStackGuarantee ReleaseSRWLockExclusive AcquireSRWLockExclusive SwitchToThread WakeAllConditionVariable SleepConditionVariableSRW GetCurrentProcessId GetSystemTimePreciseAsFileTime GetSystemTimeAsFileTime LoadLibraryW RtlPcToFileHeader FindNextFileW CreateWaitableTimerExW MoveFileExW CopyFileExW GetTempPathW GetFileAttributesW CreateProcessW CancelIo CreateEventW CreateDirectoryW GetFileInformationByHandle FindFirstFileExW SetFileTime GetFullPathNameW CreateThread WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle RaiseException CreateMutexA GetFileInformationByHandleEx SetFileInformationByHandle DeleteFileW FindClose FlsGetValue GetCurrentThreadId SetNamedPipeHandleState CreateFileW CancelIoEx WriteFile SetFileCompletionNotificationModes CreateIoCompletionPort GetSystemInfo EncodePointer GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetModuleHandleA GetFinalPathNameByHandleW Sleep GetExitCodeProcess WideCharToMultiByte WaitForSingleObject WaitForMultipleObjects GetProcAddress GetLastError LoadLibraryExA CloseHandle GetModuleHandleW LoadLibraryA FreeLibrary OutputDebugStringA OutputDebugStringW LoadLibraryExW RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW DeleteCriticalSection InitializeCriticalSectionEx RtlVirtualUnwind QueryPerformanceCounter AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW RtlCaptureContext

shell32

SHAppBarMessage DragFinish ShellExecuteW SHGetStockIconInfo DragQueryFileW SHGetKnownFolderPath

combase

CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

user32

CloseTouchInputHandle DestroyWindow GetSystemMetrics LoadImageW GetIconInfo PostThreadMessageW PeekMessageW GetTouchInputInfo SetCapture ScreenToClient GetMessageW DispatchMessageW MsgWaitForMultipleObjectsEx GetKeyState GetAsyncKeyState TrackMouseEvent CreateIcon DefWindowProcW RegisterTouchWindow UpdateWindow InvalidateRect TranslateMessage FindWindowExW SetCursor LoadCursorW GetForegroundWindow GetRawInputData SetWindowLongPtrW FlashWindowEx IsWindowEnabled EnableWindow IsIconic IsWindowVisible GetParent SetPropW DispatchMessageA SystemParametersInfoW SetWindowRgn ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetWindowLongPtrW ClipCursor ValidateRect SetCursorPos GetClipCursor GetUpdateRect MapVirtualKeyW TranslateAcceleratorW GetMessageA RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint ShowCursor SetWindowTextW GetWindowTextW IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos GetWindowTextLengthW SetMenu EnableMenuItem CreatePopupMenu CreateMenu SetWindowDisplayAffinity GetWindow DrawIconEx ReleaseCapture RegisterRawInputDevices GetDC SetFocus MonitorFromRect AppendMenuW InsertMenuW VkKeyScanW DestroyIcon SendInput CheckMenuItem SetParent GetMonitorInfoW RegisterClassExW DrawTextW GetWindowPlacement SetWindowPlacement ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetMenuItemInfoW SystemParametersInfoA ShowWindow SendMessageW PostQuitMessage CreateAcceleratorTableW PostMessageW GetActiveWindow ChangeDisplaySettingsExW DestroyAcceleratorTable CreateWindowExW DestroyMenu RemoveMenu AdjustWindowRectEx DrawMenuBar SetMenuItemInfoW GetMenu GetWindowLongW GetKeyboardState SetWindowLongW GetSystemMenu SetWindowPos InvalidateRgn RegisterWindowMessageA EnumChildWindows

gdi32

CreateRectRgn BitBlt GetDeviceCaps DeleteObject GetDIBits SelectObject CreateDIBSection CreateCompatibleDC DeleteDC CreateSolidBrush SetTextColor SetBkMode CombineRgn

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

ole32

RegisterDragDrop CoUninitialize CoInitializeEx RevokeDragDrop CoCreateInstance OleInitialize

shlwapi

SHCreateMemStream

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegGetValueW EventUnregister EventWriteTransfer EventRegister SystemFunction036 EventSetInformation

imm32

ImmGetContext ImmReleaseContext ImmGetCompositionStringW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

ws2_32

shutdown freeaddrinfo getaddrinfo WSACleanup WSAStartup bind send select setsockopt WSASend connect ioctlsocket WSASocketW closesocket recv WSAIoctl getsockname WSAGetLastError getpeername getsockopt

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

roundf round __setusermatherr floor trunc pow

api-ms-win-crt-string-l1-1-0

strcpy_s wcslen wcscmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argv __p___argc _seh_filter_exe _register_thread_local_exe_atexit_callback _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit terminate _configure_narrow_argv _initialize_narrow_environment _initterm abort _initterm_e exit _c_exit _exit _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc _callnewh free malloc