P:\camerabits\pm\build\x64\VideoRender\Release_PM\VideoRender.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_df1625a41eca1a90d8fb6170636cd7ab_ryuk.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-21_df1625a41eca1a90d8fb6170636cd7ab_ryuk.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-21_df1625a41eca1a90d8fb6170636cd7ab_ryuk
-
Size
164KB
-
MD5
df1625a41eca1a90d8fb6170636cd7ab
-
SHA1
baabc1673e010dea6ac552da512c6de9e28208d2
-
SHA256
95b7127b69c33814f768bfce0fc0e70f8fa68d2f41636b5f45bc89a2cbbb3fc7
-
SHA512
6b2cbd1b7d734f30669a179621b60f82ded28c35c1ce419dd9bc98ac2d45005cdb143f612e8906b1a73510322e6dd1a35f45cde3118389ed225c7a4f2dc64ff3
-
SSDEEP
3072:i9ZebmPmR3hSs05ZQcESImEetazbcH6/xL2nEGa8XCA+:i3eYmR3hSs05ZQcQdeEcH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-21_df1625a41eca1a90d8fb6170636cd7ab_ryuk
Files
-
2024-02-21_df1625a41eca1a90d8fb6170636cd7ab_ryuk.exe windows:6 windows x64 arch:x64
341ef72e10682ff1e0a7dee4c5ab7f6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mfplat
MFCreateMediaType
MFStartup
MFShutdown
MFCreateAttributes
mfreadwrite
MFCreateSourceReaderFromURL
propsys
PropVariantToUInt32
kernel32
TlsFree
WriteConsoleW
HeapReAlloc
HeapSize
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
MulDiv
MultiByteToWideChar
CreateFileW
CloseHandle
GetProcessHeap
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetFileType
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
user32
SetRect
SetRectEmpty
ole32
CoInitializeEx
CoUninitialize
Sections
.text Size: 107KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ