2024-02-21_e04b49238c3652b2c2c4f19f09b916e6_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-21_e04b49238c3652b2c2c4f19f09b916e6_ryuk
Size

470KB
MD5

e04b49238c3652b2c2c4f19f09b916e6
SHA1

f1ca6955ea07a14fcf4702e16da3e61cb949dd48
SHA256

eb3a0ac6fc83b041deb57f689310940419b19d81fd7c6e97d9deab399dd93c36
SHA512

96d061625ffdbfd8fe577fe89da51e744ef2ec9469cb4aaa77deafe3ccce2df54d964af8bd9d00f4ac34c650a31183d79e23466197c935a6f0aee884f0035d11
SSDEEP

6144:V2xc++MO5LB64GWCbOvcbgYgTyULuxQixNkTa97B52jv0s1x8dDDTSd:/+3OhB32bOUk6QaEHcS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-21_e04b49238c3652b2c2c4f19f09b916e6_ryuk

Files

2024-02-21_e04b49238c3652b2c2c4f19f09b916e6_ryuk
.exe windows:6 windows x64 arch:x64

8ae79a8909921ea67fb9a5be4f583ca5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\atg\github\PresentMon\build\release\bin\PresentMon64-1.2.1.pdb

Imports

advapi32

OpenTraceA
EnableTraceEx2
ControlTraceW
StartTraceA
CloseTrace
ControlTraceA
ProcessTrace

shell32

ShellExecuteA

shlwapi

PathFindFileNameA

user32

GetMessageW
DefWindowProcW
PostMessageW
DestroyWindow
SetWindowLongPtrW
GetWindowLongPtrW
RegisterClassExW
DispatchMessageW
RegisterHotKey
TranslateMessage
GetKeyState
GetMessageExtraInfo
SendInput
CreateWindowExW

kernel32

LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
GetModuleHandleA
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetModuleFileNameA
SetConsoleTitleA
SetConsoleCtrlHandler
GetCurrentProcess
LoadLibraryA
CloseHandle
GetProcAddress
FreeLibrary
GetConsoleScreenBufferInfo
GetStdHandle
WriteConsoleOutputCharacterA
SetThreadPriority
OpenProcess
Sleep
GetTickCount64
QueryFullProcessImageNameA
GetCurrentThread
SetConsoleCursorPosition
QueryPerformanceCounter
GetExitCodeProcess
GetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
DuplicateHandle
WaitForSingleObjectEx
GetExitCodeThread
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
WideCharToMultiByte
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ExitProcess
MultiByteToWideChar
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
HeapAlloc
HeapFree
CreateThread
ExitThread
FreeLibraryAndExitThread
CompareStringW
LCMapStringW
GetStringTypeW
OutputDebugStringW
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
CreateFileW
HeapSize
HeapReAlloc
SetFilePointerEx
SetEndOfFile
ReadFile
ReadConsoleW
CreateTimerQueue
SetEvent
SignalObjectAndWait
SwitchToThread
GetThreadPriority
GetLogicalProcessorInformation
DecodePointer

tdh

TdhGetPropertySize
TdhGetEventInformation
TdhGetProperty

Sections

.text
Size: 323KB - Virtual size: 323KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ae79a8909921ea67fb9a5be4f583ca5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

shell32

shlwapi

user32

kernel32

tdh

Sections

.text Size: 323KB - Virtual size: 323KB

.rdata Size: 109KB - Virtual size: 109KB

.data Size: 9KB - Virtual size: 16KB

.pdata Size: 20KB - Virtual size: 20KB

.gfids Size: 2KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 323KB - Virtual size: 323KB

.rdata
Size: 109KB - Virtual size: 109KB

.data
Size: 9KB - Virtual size: 16KB

.pdata
Size: 20KB - Virtual size: 20KB

.gfids
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 3KB