C:\projects\libusb\build\v140\x64\Release\dpfp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-11_06cab5993aa7de0dc7369b384a4ed7b4_ryuk.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-11_06cab5993aa7de0dc7369b384a4ed7b4_ryuk.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-11_06cab5993aa7de0dc7369b384a4ed7b4_ryuk
-
Size
272KB
-
MD5
06cab5993aa7de0dc7369b384a4ed7b4
-
SHA1
b518ee8da82f0b3fa5551638d8a5dbb98d6a7e8c
-
SHA256
d05b618fdee0f4c146398a88bc5885c0625774858eb261bab0cc28250ac45d34
-
SHA512
0399f65b67c7fe6d220e56f224aa8be4988b59fbbf4810685d9d31d4b8e87857eb5f53dcce7f74a805914286f71dc570715f9ac3e799ec51527fe1ea109ba0e8
-
SSDEEP
6144:mAXY+ECqYRtNCoNKbGWiPOIDIzNo01qNUXN:mAXY+ECqFniWiPOjI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-11_06cab5993aa7de0dc7369b384a4ed7b4_ryuk
Files
-
2024-02-11_06cab5993aa7de0dc7369b384a4ed7b4_ryuk.exe windows:6 windows x64 arch:x64
c35d35c2a9bff237f22a43bdafdf87be
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThreadId
DeleteCriticalSection
SleepEx
TlsGetValue
SleepConditionVariableCS
TryEnterCriticalSection
TlsSetValue
WakeAllConditionVariable
InitializeConditionVariable
TlsAlloc
TlsFree
SetWaitableTimer
CreateWaitableTimerW
WaitForMultipleObjects
WaitForSingleObject
CancelWaitableTimer
CreateEventW
SetEvent
CloseHandle
ResetEvent
GetSystemTimeAsFileTime
VerifyVersionInfoA
GetCurrentProcess
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetLastError
GetSystemDirectoryA
LoadLibraryA
GetVersionExA
QueryPerformanceFrequency
CancelIoEx
GetOverlappedResult
VerSetConditionMask
FormatMessageA
QueryPerformanceCounter
CreateIoCompletionPort
ReadFile
WriteFile
DeviceIoControl
CreateFileA
GetProcAddress
FreeLibrary
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
ExitProcess
GetModuleHandleExW
SetConsoleCtrlHandler
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetFileType
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetProcessHeap
CreateFileW
FlushFileBuffers
SetFilePointerEx
WriteConsoleW
HeapSize
SetEndOfFile
ReadConsoleW
RaiseException
Sections
.text Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ