2024-01-10_7a5a803a6d170359f98ea64434cb0dfb_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-10_7a5a803a6d170359f98ea64434cb0dfb_ryuk
Size

240KB
MD5

7a5a803a6d170359f98ea64434cb0dfb
SHA1

d3d387834b2c284aeb76ce9b098f238979aa34f4
SHA256

2ed4e7d9cb67bca44b52952f1f0e487552832d9bfb92c27b8e1124e8e74eb40a
SHA512

f78ea1ec381fb175a064b2cdc30dbbd7f4773dbee93a3816e55ebb57bf6fcffd18b37be404a97aa71f1a256e93d4cf156fbe70bc873c5869000c7bc85bb1fd05
SSDEEP

6144:MJw9YAOLbZDekattx9H2seOOT8WLurmcCOm:POPZyZP2pD9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-10_7a5a803a6d170359f98ea64434cb0dfb_ryuk

Files

2024-01-10_7a5a803a6d170359f98ea64434cb0dfb_ryuk
.exe windows:6 windows x64 arch:x64

fa3e9c3fae233b4b06aa769ca1171109

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

SystemFunction036

kernel32

WideCharToMultiByte
CloseHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetNativeSystemInfo
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcessId
InitializeSListHead
GetLastError
GetThreadTimes
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
HeapAlloc
GetModuleHandleExW
HeapFree
HeapReAlloc
ExitProcess
GetStdHandle
WriteFile
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
FindClose
FindFirstFileExA
FindNextFileA
SetStdHandle
WriteConsoleW
ReadConsoleW
HeapSize
CreateFileW

Sections

.text
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa3e9c3fae233b4b06aa769ca1171109

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

Sections

.text Size: 141KB - Virtual size: 141KB

.rdata Size: 75KB - Virtual size: 75KB

.data Size: 5KB - Virtual size: 12KB

.pdata Size: 9KB - Virtual size: 8KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 141KB - Virtual size: 141KB

.rdata
Size: 75KB - Virtual size: 75KB

.data
Size: 5KB - Virtual size: 12KB

.pdata
Size: 9KB - Virtual size: 8KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 3KB - Virtual size: 3KB