E:\b\build\slave\Windows_Engine\build\src\out\host_debug\flutter_tester.exe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-20_75ebfeae0fa51bc404de414e956892c5_ryuk.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-20_75ebfeae0fa51bc404de414e956892c5_ryuk.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-20_75ebfeae0fa51bc404de414e956892c5_ryuk
-
Size
14.1MB
-
MD5
75ebfeae0fa51bc404de414e956892c5
-
SHA1
9f9b021f91651b117d37d6409713d4bce0fb88bd
-
SHA256
831dcb34aee508d50df9a96aa37fd403fca30f3ec8004dc3704654572745cdfe
-
SHA512
dea093e8f9100a2bafa19c3c4567af6c00e911c2093581ec15123df71a9d7cad8cddc44747275ae892e96f3c4683400f46a1bd310a9b6c0a0edda850fcade5c6
-
SSDEEP
393216:pIu82HJl3WXpwWGKhR1rF+phdINOi2aMhrvbVxwu:AWku
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-20_75ebfeae0fa51bc404de414e956892c5_ryuk
Files
-
2024-02-20_75ebfeae0fa51bc404de414e956892c5_ryuk.exe windows:5 windows x64 arch:x64
b3fd6cba3a4b28bdbca10e5947e204c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
SystemFunction036
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegGetValueW
iphlpapi
GetAdaptersAddresses
kernel32
CloseHandle
CreateFileW
GetFileInformationByHandle
GetFinalPathNameByHandleW
DuplicateHandle
GetCurrentProcess
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetModuleFileNameA
GetStdHandle
SetStdHandle
MultiByteToWideChar
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleCP
SetConsoleOutputCP
GetFileType
ReadFile
WriteFile
GetLastError
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CancelIoEx
OpenThread
ReadDirectoryChangesW
SetCurrentDirectoryW
GetCurrentThreadId
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetUnhandledExceptionFilter
ExitProcess
GetSystemInfo
GetModuleFileNameW
GetUserDefaultLocaleName
CreateNamedPipeW
CreateEventW
WaitForMultipleObjects
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessW
OpenProcess
RegisterWaitForSingleObject
UnregisterWait
GetConsoleScreenBufferInfo
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
MoveFileExW
WideCharToMultiByte
LockFileEx
UnlockFileEx
DeviceIoControl
VirtualAlloc
VirtualProtect
VirtualFree
CopyFileExW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentDirectoryW
SetEvent
ResetEvent
ReleaseSemaphore
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCommandLineW
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetSystemTimeAsFileTime
FormatMessageW
OutputDebugStringA
GetFileSizeEx
CreateThread
CreateFileA
GetFinalPathNameByHandleA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
FindNextFileA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
TryEnterCriticalSection
VirtualQuery
SuspendThread
ResumeThread
GetThreadContext
SwitchToThread
LoadLibraryExA
HeapSize
SetEnvironmentVariableA
FindFirstFileExA
GetProcessHeap
WriteConsoleW
GetOEMCP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetCommandLineA
HeapReAlloc
HeapFree
HeapAlloc
ReadConsoleW
GetACP
GetFullPathNameA
GetFullPathNameW
GetModuleHandleExW
ExitThread
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
SetFileTime
PeekNamedPipe
GetDriveTypeW
SetFilePointerEx
FlushFileBuffers
SetEndOfFile
RtlUnwindEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
GetVersionExW
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
CreateSemaphoreW
DeleteCriticalSection
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTickCount
GetStringTypeW
RtlPcToFileHeader
EncodePointer
DecodePointer
WaitForSingleObjectEx
GetCurrentThread
psapi
GetProcessMemoryInfo
shlwapi
PathIsRelativeW
rpcrt4
UuidToStringW
UuidCreateSequential
RpcStringFreeW
user32
SystemParametersInfoW
ws2_32
setsockopt
send
socket
WSASetLastError
WSAGetLastError
recv
WSAIoctl
WSARecv
WSARecvFrom
WSASend
WSASendTo
gethostname
htons
ntohs
getpeername
getsockname
getsockopt
WSAStartup
WSAAddressToStringA
getaddrinfo
freeaddrinfo
getnameinfo
InetPtonW
bind
listen
connect
ioctlsocket
closesocket
WSASocketW
shutdown
Exports
Exports
Dart_Allocate
Dart_AllocateWithNativeFields
Dart_BooleanValue
Dart_Cleanup
Dart_CloseNativePort
Dart_CompileAll
Dart_CompileSourcesToKernel
Dart_CompileToKernel
Dart_CreateAppAOTSnapshotAsAssembly
Dart_CreateAppAOTSnapshotAsBlobs
Dart_CreateAppJITSnapshotAsBlobs
Dart_CreateCoreJITSnapshotAsBlobs
Dart_CreateIsolate
Dart_CreateIsolateFromKernel
Dart_CreateNativeWrapperClass
Dart_CreateScriptSnapshot
Dart_CreateSnapshot
Dart_CreateVMAOTSnapshotAsAssembly
Dart_CurrentIsolate
Dart_CurrentIsolateData
Dart_DebugName
Dart_DefaultCanonicalizeUrl
Dart_DeletePersistentHandle
Dart_DeleteWeakPersistentHandle
Dart_DoubleValue
Dart_DumpNativeStackTrace
Dart_EmptyString
Dart_EnterIsolate
Dart_EnterScope
Dart_ErrorGetException
Dart_ErrorGetStackTrace
Dart_ErrorHasException
Dart_ExitIsolate
Dart_ExitScope
Dart_False
Dart_FinalizeLoading
Dart_GetClass
Dart_GetClosure
Dart_GetDataFromByteBuffer
Dart_GetError
Dart_GetField
Dart_GetImportsOfScheme
Dart_GetLoadedLibraries
Dart_GetMainPortId
Dart_GetMessageNotifyCallback
Dart_GetNativeArgument
Dart_GetNativeArgumentCount
Dart_GetNativeArguments
Dart_GetNativeBooleanArgument
Dart_GetNativeDoubleArgument
Dart_GetNativeFieldsOfArgument
Dart_GetNativeInstanceField
Dart_GetNativeInstanceFieldCount
Dart_GetNativeIntegerArgument
Dart_GetNativeIsolateData
Dart_GetNativeReceiver
Dart_GetNativeResolver
Dart_GetNativeStringArgument
Dart_GetNativeSymbol
Dart_GetObfuscationMap
Dart_GetPeer
Dart_GetStickyError
Dart_GetType
Dart_GetTypeOfExternalTypedData
Dart_GetTypeOfTypedData
Dart_GlobalTimelineGetTrace
Dart_GlobalTimelineSetRecordedStreams
Dart_HandleFromPersistent
Dart_HandleFromWeakPersistent
Dart_HandleMessage
Dart_HandleServiceMessages
Dart_HasLivePorts
Dart_HasServiceMessages
Dart_HasStickyError
Dart_IdentityEquals
Dart_Initialize
Dart_InstanceGetType
Dart_IntegerFitsIntoInt64
Dart_IntegerFitsIntoUint64
Dart_IntegerToHexCString
Dart_IntegerToInt64
Dart_IntegerToUint64
Dart_Invoke
Dart_InvokeClosure
Dart_InvokeConstructor
Dart_IsApiError
Dart_IsBoolean
Dart_IsByteBuffer
Dart_IsClosure
Dart_IsCompilationError
Dart_IsDart2Snapshot
Dart_IsDouble
Dart_IsError
Dart_IsExternalString
Dart_IsFatalError
Dart_IsFunction
Dart_IsFuture
Dart_IsInstance
Dart_IsInteger
Dart_IsKernel
Dart_IsKernelIsolate
Dart_IsLibrary
Dart_IsList
Dart_IsMap
Dart_IsNull
Dart_IsNumber
Dart_IsPausedOnExit
Dart_IsPausedOnStart
Dart_IsPrecompiledRuntime
Dart_IsReloading
Dart_IsServiceIsolate
Dart_IsSnapshot
Dart_IsString
Dart_IsStringLatin1
Dart_IsType
Dart_IsTypeVariable
Dart_IsTypedData
Dart_IsUnhandledExceptionError
Dart_IsVMFlagSet
Dart_IsVariable
Dart_IsolateData
Dart_IsolateFlagsInitialize
Dart_IsolateMakeRunnable
Dart_KernelIsolateIsRunning
Dart_KernelPort
Dart_LibraryHandleError
Dart_LibraryImportLibrary
Dart_LibraryLoadPatch
Dart_LibraryUrl
Dart_ListGetAsBytes
Dart_ListGetAt
Dart_ListGetRange
Dart_ListLength
Dart_ListSetAsBytes
Dart_ListSetAt
Dart_LoadCompilationTrace
Dart_LoadLibrary
Dart_LoadLibraryFromKernel
Dart_LoadScript
Dart_LoadScriptFromKernel
Dart_LoadScriptFromSnapshot
Dart_LoadSource
Dart_LookupLibrary
Dart_MapContainsKey
Dart_MapGetAt
Dart_MapKeys
Dart_New
Dart_NewApiError
Dart_NewBoolean
Dart_NewByteBuffer
Dart_NewDouble
Dart_NewExternalLatin1String
Dart_NewExternalTypedData
Dart_NewExternalTypedDataWithFinalizer
Dart_NewExternalUTF16String
Dart_NewInteger
Dart_NewIntegerFromHexCString
Dart_NewIntegerFromUint64
Dart_NewList
Dart_NewListOf
Dart_NewListOfType
Dart_NewNativePort
Dart_NewPersistentHandle
Dart_NewSendPort
Dart_NewStringFromCString
Dart_NewStringFromUTF16
Dart_NewStringFromUTF32
Dart_NewStringFromUTF8
Dart_NewTypedData
Dart_NewUnhandledExceptionError
Dart_NewWeakPersistentHandle
Dart_NotifyIdle
Dart_NotifyLowMemory
Dart_Null
Dart_ObjectEquals
Dart_ObjectIsType
Dart_ParseAll
Dart_Post
Dart_PostCObject
Dart_PostInteger
Dart_Precompile
Dart_PropagateError
Dart_ReThrowException
Dart_ReadKernelBinary
Dart_RegisterIsolateServiceRequestCallback
Dart_RegisterRootServiceRequestCallback
Dart_RootLibrary
Dart_RunLoop
Dart_SaveCompilationTrace
Dart_ScopeAllocate
Dart_SendPortGetId
Dart_ServiceSendDataEvent
Dart_ServiceWaitForLoadPort
Dart_SetBooleanReturnValue
Dart_SetDoubleReturnValue
Dart_SetEmbedderInformationCallback
Dart_SetEmbedderTimelineCallbacks
Dart_SetEnvironmentCallback
Dart_SetField
Dart_SetFileModifiedCallback
Dart_SetIntegerReturnValue
Dart_SetLibraryTagHandler
Dart_SetMessageNotifyCallback
Dart_SetNativeInstanceField
Dart_SetNativeResolver
Dart_SetPausedOnExit
Dart_SetPausedOnStart
Dart_SetPeer
Dart_SetPersistentHandle
Dart_SetReturnValue
Dart_SetRootLibrary
Dart_SetServiceStreamCallbacks
Dart_SetShouldPauseOnExit
Dart_SetShouldPauseOnStart
Dart_SetStickyError
Dart_SetThreadName
Dart_SetVMFlags
Dart_SetWeakHandleReturnValue
Dart_ShouldPauseOnExit
Dart_ShouldPauseOnStart
Dart_ShutdownIsolate
Dart_SortClasses
Dart_StringGetProperties
Dart_StringLength
Dart_StringStorageSize
Dart_StringToCString
Dart_StringToLatin1
Dart_StringToUTF16
Dart_StringToUTF8
Dart_ThreadDisableProfiling
Dart_ThreadEnableProfiling
Dart_ThrowException
Dart_TimelineEvent
Dart_TimelineGetMicros
Dart_ToString
Dart_True
Dart_TypedDataAcquireData
Dart_TypedDataReleaseData
Dart_VersionString
Dart_WaitForEvent
_Dart_ReportErrorHandle
Sections
.text Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 270KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 300KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 385B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ