ruby[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ruby.exe
Size 6.0MB
Sample261107-ya2ljaex3x
SHA256 3d4ffc3cf393e3733b58a8dcf4a1325c3f4b8a50c3a4dcc7319460eb5a8a0a04
MD5 a0f6def0af49d167b6b53301a4b1d1b5
SHA1 27b1132b87c780df473b19ca07d55b178e2646a6
SHA512 26ffb3895a199db37b71ceb545833b26e46ac7621d10691e1b15bd1a725976ddc097fca1c105716568d82109ec2717a34bbd4cc391d5619b9dd8232dfde782ab
SSDEEP 98304:1hTwdwumUS9j35X5QtZNasoYuHPdNQHxUHl7fJNy0L1n+7gfbF5+:uWU1ZNPoBdNQHxUNby0hKgfj+
TLSH
T11C56AE03F66181E8C46EC178C35AA233EB72788E093471EB1BE45B252F66F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ruby.exe

File Explorer

ruby.exe

.exe 6.0MB

ruby.exe

IMPHASH 92dcd96b4ce3fe85c53d20d72df935be
SHA256 3d4ffc3cf393e3733b58a8dcf4a1325c3f4b8a50c3a4dcc7319460eb5a8a0a04
MD5 a0f6def0af49d167b6b53301a4b1d1b5
SHA1 27b1132b87c780df473b19ca07d55b178e2646a6
SHA512 26ffb3895a199db37b71ceb545833b26e46ac7621d10691e1b15bd1a725976ddc097fca1c105716568d82109ec2717a34bbd4cc391d5619b9dd8232dfde782ab
SSDEEP 98304:1hTwdwumUS9j35X5QtZNasoYuHPdNQHxUHl7fJNy0L1n+7gfbF5+:uWU1ZNPoBdNQHxUNby0hKgfj+
TLSH
T11C56AE03F66181E8C46EC178C35AA233EB72788E093471EB1BE45B252F66F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3400880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ruby.pdb

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCreateFile NtOpenFile NtWriteFile NtCreateNamedPipeFile NtReadFile RtlGetVersion NtCancelIoFileEx

kernel32

ReleaseMutex FormatMessageW MultiByteToWideChar FlsAlloc GetModuleHandleExW FlsFree FlsSetValue HeapAlloc IsThreadAFiber GetUserDefaultUILanguage SleepEx SetHandleInformation ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle SetWaitableTimer HeapFree HeapReAlloc GetCurrentProcess lstrlenW SetLastError WaitForSingleObjectEx RtlLookupFunctionEntry LCIDToLocaleName GetProcessHeap GetCurrentThread SetThreadStackGuarantee ReleaseSRWLockExclusive AcquireSRWLockExclusive SwitchToThread WakeAllConditionVariable SleepConditionVariableSRW GetCurrentProcessId GetSystemTimePreciseAsFileTime GetSystemTimeAsFileTime LoadLibraryW RtlPcToFileHeader FindNextFileW CreateWaitableTimerExW MoveFileExW CopyFileExW GetTempPathW GetFileAttributesW CreateProcessW CancelIo CreateEventW CreateDirectoryW GetFileInformationByHandle FindFirstFileExW SetFileTime GetFullPathNameW CreateThread WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle RaiseException CreateMutexA GetFileInformationByHandleEx SetFileInformationByHandle DeleteFileW FindClose FlsGetValue GetCurrentThreadId SetNamedPipeHandleState CreateFileW CancelIoEx WriteFile SetFileCompletionNotificationModes CreateIoCompletionPort GetSystemInfo EncodePointer GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetModuleHandleA GetFinalPathNameByHandleW Sleep GetExitCodeProcess WideCharToMultiByte WaitForSingleObject WaitForMultipleObjects GetProcAddress GetLastError LoadLibraryExA CloseHandle GetModuleHandleW LoadLibraryA FreeLibrary OutputDebugStringA OutputDebugStringW LoadLibraryExW RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW DeleteCriticalSection InitializeCriticalSectionEx RtlVirtualUnwind QueryPerformanceCounter AddVectoredExceptionHandler SetEnvironmentVariableW GetCommandLineW RtlCaptureContext

shell32

SHAppBarMessage DragFinish ShellExecuteW SHGetStockIconInfo DragQueryFileW SHGetKnownFolderPath

combase

CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

user32

CloseTouchInputHandle DestroyWindow GetSystemMetrics LoadImageW GetIconInfo PostThreadMessageW PeekMessageW GetTouchInputInfo SetCapture ScreenToClient GetMessageW DispatchMessageW MsgWaitForMultipleObjectsEx GetKeyState GetAsyncKeyState TrackMouseEvent CreateIcon DefWindowProcW RegisterTouchWindow UpdateWindow InvalidateRect TranslateMessage FindWindowExW SetCursor LoadCursorW GetForegroundWindow GetRawInputData SetWindowLongPtrW FlashWindowEx IsWindowEnabled EnableWindow IsIconic IsWindowVisible GetParent SetPropW DispatchMessageA SystemParametersInfoW SetWindowRgn ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetWindowLongPtrW ClipCursor ValidateRect SetCursorPos GetClipCursor GetUpdateRect MapVirtualKeyW TranslateAcceleratorW GetMessageA RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint ShowCursor SetWindowTextW GetWindowTextW IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos GetWindowTextLengthW SetMenu EnableMenuItem CreatePopupMenu CreateMenu SetWindowDisplayAffinity GetWindow DrawIconEx ReleaseCapture RegisterRawInputDevices GetDC SetFocus MonitorFromRect AppendMenuW InsertMenuW VkKeyScanW DestroyIcon SendInput CheckMenuItem SetParent GetMonitorInfoW RegisterClassExW DrawTextW GetWindowPlacement SetWindowPlacement ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetMenuItemInfoW SystemParametersInfoA ShowWindow SendMessageW PostQuitMessage CreateAcceleratorTableW PostMessageW GetActiveWindow ChangeDisplaySettingsExW DestroyAcceleratorTable CreateWindowExW DestroyMenu RemoveMenu AdjustWindowRectEx DrawMenuBar SetMenuItemInfoW GetMenu GetWindowLongW GetKeyboardState SetWindowLongW GetSystemMenu SetWindowPos InvalidateRgn RegisterWindowMessageA EnumChildWindows

gdi32

CreateRectRgn BitBlt GetDeviceCaps DeleteObject GetDIBits SelectObject CreateDIBSection CreateCompatibleDC DeleteDC CreateSolidBrush SetTextColor SetBkMode CombineRgn

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

ole32

RegisterDragDrop CoUninitialize CoInitializeEx RevokeDragDrop CoCreateInstance OleInitialize

shlwapi

SHCreateMemStream

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegGetValueW EventUnregister EventWriteTransfer EventRegister SystemFunction036 EventSetInformation

imm32

ImmGetContext ImmReleaseContext ImmGetCompositionStringW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

ws2_32

shutdown freeaddrinfo getaddrinfo WSACleanup WSAStartup bind send select setsockopt WSASend connect ioctlsocket WSASocketW closesocket recv WSAIoctl getsockname WSAGetLastError getpeername getsockopt

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

roundf round __setusermatherr floor trunc pow

api-ms-win-crt-string-l1-1-0

strcpy_s wcslen wcscmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argv __p___argc _seh_filter_exe _register_thread_local_exe_atexit_callback _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit terminate _configure_narrow_argv _initialize_narrow_environment _initterm abort _initterm_e exit _c_exit _exit _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc _callnewh free malloc