2024-01-28_cb3ab50698b851ea1285f0e0c2ba0054_ryuk | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-28_cb3ab50698b851ea1285f0e0c2ba0054_ryuk
Size

2.2MB
MD5

cb3ab50698b851ea1285f0e0c2ba0054
SHA1

96885aa349b9fa0e3f2a90e808daee383eda1ce3
SHA256

ea95be2a4b111880b1483cf186a9240b256f1ac2e62ea63c287ab103a84f4baf
SHA512

d32b47c6b74f7b899d7993bddf34da24c64e10696d5bbc7808d928af33936095b29ea84a28348404ae46a4da4945acafdc186e4a9420aead59bf922788c5e4d9
SSDEEP

24576:cTKnp3J+RWjsqjnhMgeiCl7G0nehbGZpbD:kGoWDmg27RnWGj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-28_cb3ab50698b851ea1285f0e0c2ba0054_ryuk

Files

2024-01-28_cb3ab50698b851ea1285f0e0c2ba0054_ryuk
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE