Static task
static1
Behavioral task
behavioral1
Sample
2024-03-26_4e194a164bd76df3c9c5543fa18f341b_ryuk.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-03-26_4e194a164bd76df3c9c5543fa18f341b_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-26_4e194a164bd76df3c9c5543fa18f341b_ryuk
-
Size
4.0MB
-
MD5
4e194a164bd76df3c9c5543fa18f341b
-
SHA1
b6a5c1b82a2e0a4ed55a362d8149ef166be52382
-
SHA256
a2fe503f03cb311f954dfa3b6067920d678d01207194f062e6606ae8aac91d07
-
SHA512
94009f6e7b05e7c38597afb087da08dbcb54db33fa1a38d0df18c65962075ce38c484e2503e2ccdd3102fd5a8677b28efcaab44fe51658ae1502d80f28cf6c20
-
SSDEEP
49152:56xt7epvKbqZDMX1ABvAao5h+GjsY3ttr4JzRIq4RBTkV2XNuBDGuMrkOwbFE1dB:O5sY3n4JzR8Nf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-26_4e194a164bd76df3c9c5543fa18f341b_ryuk
Files
-
2024-03-26_4e194a164bd76df3c9c5543fa18f341b_ryuk.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 569KB - Virtual size: 569KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.retplne Size: 512B - Virtual size: 172B
.tls Size: 1024B - Virtual size: 585B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CPADinfo Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
LZMADEC Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 431KB - Virtual size: 430KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ