Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_964bdeae08550256c8e482dcb2ba3c7b_ryuk.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-25_964bdeae08550256c8e482dcb2ba3c7b_ryuk.exe
Resource
win10v2004-20231215-en
Target
2024-01-25_964bdeae08550256c8e482dcb2ba3c7b_ryuk
Size
1.0MB
MD5
964bdeae08550256c8e482dcb2ba3c7b
SHA1
125c31e9103a64025f3218be0568c5e92771dde1
SHA256
469c1d0343d893cbaa268e86d10496d001a77a2b5b0bce93dd20bdb70e283f91
SHA512
3d521db16ed8da5e55c634b8498d9b7515e3b885fa0a7700128695db277e048ba934ad46af8eb0207e61ee7eb47cb9dc8581cab8ef6f8255e8bdf759511d4d4a
SSDEEP
24576:zPqrfoHnuIVhvbzKRr1ihC0V7Cxk8v5LWovO93l0fZWwh:zPWC/jzc1iI0V7Cxfv5LWwO93+x/h
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
GetStdHandle
CheckTokenMembershipEx
SetConsoleMode
TerminateProcess
LoadLibraryExA
GetConsoleScreenBufferInfoEx
GetVolumeInformationA
OpenProcess
GetExitCodeThread
Sleep
GetConsoleMode
SetConsoleScreenBufferInfoEx
GetCurrentThread
DeleteFileA
DeleteFileW
FreeConsole
CreateThread
VirtualProtectEx
GetWindowsDirectoryW
ExitProcess
GetModuleHandleW
GetConsoleWindow
CreateRemoteThread
IsDebuggerPresent
GetComputerNameA
GetExitCodeProcess
RemoveVectoredExceptionHandler
WriteProcessMemory
GetSystemInfo
AddVectoredExceptionHandler
GetCurrentProcess
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetLastError
FormatMessageA
FreeLibrary
GetTickCount64
InitializeCriticalSectionEx
SleepEx
CreateRemoteThreadEx
GetCurrentProcessId
CloseHandle
Process32Next
CreateFileA
CreateToolhelp32Snapshot
GetSystemDirectoryA
VerifyVersionInfoA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
SetConsoleTitleA
VirtualFree
CheckRemoteDebuggerPresent
VirtualProtect
DeviceIoControl
QueryPerformanceCounter
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
VirtualAlloc
MultiByteToWideChar
EmptyClipboard
DispatchMessageA
FindWindowExW
GetWindowRect
DestroyWindow
SetWindowPos
ShowWindow
GetAsyncKeyState
FindWindowExA
SetWindowsHookExA
SetWindowsHookW
DefWindowProcA
CloseClipboard
OpenClipboard
GetClipboardData
SetCursorPos
ReleaseCapture
CreateWindowExA
TranslateMessage
FindWindowW
SetWindowsHookA
SetWindowsHookExW
PeekMessageA
UnregisterClassA
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
IsChild
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
UpdateWindow
RegisterClassExA
SetClipboardData
GetCursorPos
FindWindowA
PostQuitMessage
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptReleaseContext
CryptGetHashParam
CheckTokenMembership
CryptDestroyHash
CryptHashData
CryptCreateHash
GetUserNameA
GetCurrentHwProfileA
CryptAcquireContextA
CryptGenRandom
ShellExecuteExW
ShellExecuteA
ShellExecuteExA
ShellExecuteW
CoUninitialize
CoInitialize
CoCreateInstance
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_signal
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_BADOFF@std@@3_JB
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Cnd_destroy
_Thrd_sleep
_Cnd_wait
_Mtx_init
_Thrd_start
_Thrd_id
_Thrd_detach
_Xtime_get_ticks
_Mtx_destroy
_Cnd_init
_Thrd_join
_Mtx_unlock
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
D3DXVec2Transform
D3DXVec3Project
D3DXVec2TransformCoord
Direct3DCreate9
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
ntohl
htonl
gethostname
ioctlsocket
WSAStartup
sendto
recvfrom
listen
accept
freeaddrinfo
getaddrinfo
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
socket
WSAGetLastError
WSACleanup
CertFreeCertificateContext
ord32
ord33
ord27
ord79
ord30
ord200
ord301
ord22
ord41
ord50
ord60
ord211
ord46
ord143
ord26
ord35
IdnToAscii
__CxxFrameHandler3
memset
_purecall
__C_specific_handler
__vcrt_InitializeCriticalSectionEx
__std_exception_copy
memcpy
__std_exception_destroy
strstr
memcmp
strchr
strrchr
memmove
memchr
_CxxThrowException
__std_terminate
_get_stream_buffer_pointers
_fseeki64
__acrt_iob_func
fflush
fclose
fseek
ftell
_lseeki64
fsetpos
_close
ungetc
feof
ferror
fwrite
_wfopen
__stdio_common_vsprintf
fread
__stdio_common_vsscanf
_write
__stdio_common_vfprintf
setvbuf
fgetpos
fputs
fopen
fgets
_read
__p__commode
_set_fmode
_open
fgetc
fputc
_strdup
tolower
isalpha
isxdigit
isgraph
isprint
islower
isupper
strpbrk
strncpy
strncmp
isalnum
toupper
isspace
isdigit
rand
qsort
srand
_set_new_mode
calloc
malloc
free
realloc
_callnewh
strtoll
strtol
atoi
strtoul
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_register_onexit_function
_exit
system
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
terminate
_initterm_e
_initialize_onexit_table
strerror
__sys_nerr
abort
_errno
exit
_invalid_parameter_noinfo_noreturn
_getpid
_invalid_parameter_noinfo
_beginthreadex
_stat64
_lock_file
_unlock_file
_fstat64
_time64
_gmtime64
acosf
sqrtf
atan2f
ceilf
cosf
fmodf
sinf
__setusermatherr
_configthreadlocale
getenv
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ