Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_da9aeed98e4b824431fafb62b14336a9_ryuk.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-25_da9aeed98e4b824431fafb62b14336a9_ryuk.exe
Resource
win10v2004-20231222-en
Target
2024-01-25_da9aeed98e4b824431fafb62b14336a9_ryuk
Size
1.5MB
MD5
da9aeed98e4b824431fafb62b14336a9
SHA1
7e9767bffae7f11f12959f3ff117ef8369bab19e
SHA256
9a0d7fc8691cb6ce3ce0c6dfc06492decc69dfdeab1240f6374eac98eaa0fd09
SHA512
3dfc0cfbd649a8da7ff5da4a792a6ba3c54498dd61b7fa622fadde0c28940e247ddd9401d0dcb6550dd17c4e72ea7ee9ff9c94215d1ce854f60a4a2a0ee3ddef
SSDEEP
49152:VO93+xxnqmcblKaTefLFAKh/1jZFUCtKi:0uXqv57yfh5RZ7
resource | yara_rule |
---|---|
sample | INDICATOR_EXE_Packed_VMProtect |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
CloseHandle
GetProcAddress
ExitProcess
GetCurrentProcessId
GetConsoleWindow
Process32Next
GetComputerNameA
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
DeleteFileA
SetConsoleScreenBufferInfoEx
GetConsoleMode
CreateToolhelp32Snapshot
GetModuleHandleA
GetVolumeInformationA
GetConsoleScreenBufferInfoEx
SetConsoleMode
GetStdHandle
lstrcmpiA
Process32First
QueryPerformanceCounter
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
RtlCaptureContext
GetAsyncKeyState
ShowWindow
CryptAcquireContextA
GetCurrentHwProfileA
CloseServiceHandle
OpenSCManagerA
GetUserNameA
StartServiceA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
OpenServiceA
CryptReleaseContext
CreateServiceA
CoUninitialize
CoCreateInstance
CoInitialize
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_BADOFF@std@@3_JB
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Cnd_destroy
_Thrd_sleep
_Cnd_wait
_Mtx_init
_Thrd_start
_Thrd_id
_Thrd_detach
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_destroy
_Cnd_init
_Thrd_join
_Mtx_unlock
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
_Cnd_signal
_Xtime_get_ticks
D3DXVec3Project
URLDownloadToFileA
DeleteUrlCacheEntryA
_purecall
__std_terminate
__CxxFrameHandler3
__C_specific_handler
_CxxThrowException
__std_exception_copy
memmove
memcpy
memcmp
__std_exception_destroy
memset
_invalid_parameter_noinfo_noreturn
exit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
terminate
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_register_thread_local_exe_atexit_callback
__p___argc
__p___argv
_c_exit
_crt_atexit
__p__commode
_set_fmode
rand
toupper
free
_callnewh
_set_new_mode
malloc
sqrtf
atan2f
__setusermatherr
_configthreadlocale
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ