P:\camerabits\pm\build\x64\VideoRender\Release_PM\VideoRender.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-12_f61f924fc8d24e59ae485e89a595e5f0_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-12_f61f924fc8d24e59ae485e89a595e5f0_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_f61f924fc8d24e59ae485e89a595e5f0_ryuk
-
Size
164KB
-
MD5
f61f924fc8d24e59ae485e89a595e5f0
-
SHA1
af07f60d91670098a7bf1b96f55ceeac037043a2
-
SHA256
3662d6e2299f7259237ed1ac4a3f24588b50fa70d563c7660adce461809690fa
-
SHA512
e1f5e068a7de0e54d57637f2b8e0a9950ee4fbe96e81551d3e6d454d01c33bf941900c78693b17e7079297ab90bfaafb885267bcf0425db1ced565b694da8d38
-
SSDEEP
3072:C9ZebmPmR3hSs05ZQcESImEetazbcH6/xL2nfGa8XCA+:C3eYmR3hSs05ZQcQdeEce
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-12_f61f924fc8d24e59ae485e89a595e5f0_ryuk
Files
-
2024-03-12_f61f924fc8d24e59ae485e89a595e5f0_ryuk.exe windows:6 windows x64 arch:x64
341ef72e10682ff1e0a7dee4c5ab7f6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mfplat
MFCreateMediaType
MFStartup
MFShutdown
MFCreateAttributes
mfreadwrite
MFCreateSourceReaderFromURL
propsys
PropVariantToUInt32
kernel32
TlsFree
WriteConsoleW
HeapReAlloc
HeapSize
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
MulDiv
MultiByteToWideChar
CreateFileW
CloseHandle
GetProcessHeap
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetFileType
GetStringTypeW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
user32
SetRect
SetRectEmpty
ole32
CoInitializeEx
CoUninitialize
Sections
.text Size: 107KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ