2024-03-26_65d51b5448d2280372938b5081c413ba_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-26_65d51b5448d2280372938b5081c413ba_ryuk
Size

407KB
MD5

65d51b5448d2280372938b5081c413ba
SHA1

e21947ed40e559296c919dc6072397a33de9ff85
SHA256

05d832ff6e170421769b84258f43d238861a74d57cd65d08a9cec0b41d921546
SHA512

0607af405b19fc97e125c792cc4e8829607fcffba4bb223f91785aa5ab72515a67a4393ee9e8bb4de6512a88a5cd5bec39c8b0506c5debe3f545e302f13d9494
SSDEEP

12288:G8fQv7er41PSBcrXjb8ojed7+U+x4nc9mO:GXaYaBcn8ojYajx4nc9m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-26_65d51b5448d2280372938b5081c413ba_ryuk

Files

2024-03-26_65d51b5448d2280372938b5081c413ba_ryuk
.exe windows:6 windows x64 arch:x64

4ab1eea3acb09ac01f6f14a703d5aa3a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

GetClientRect
DispatchMessageW
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
ClientToScreen
SetCursor
SetCursorPos
TranslateMessage
GetKeyState
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassW
PostQuitMessage
DefWindowProcW
PeekMessageW

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

imm32

ImmGetContext
ImmSetCompositionWindow

kernel32

GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
SetStdHandle
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetStringTypeW
CreateFileW
HeapSize
HeapReAlloc
GetOEMCP
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalAlloc
GlobalLock
GlobalUnlock
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
GetLastError
SetEndOfFile
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
SetLastError
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ReadFile
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
WriteFile
GetACP
HeapFree
HeapAlloc
OutputDebugStringW
CreateThread
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx

Sections

.text
Size: 291KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ab1eea3acb09ac01f6f14a703d5aa3a

Headers

DLL Characteristics

File Characteristics

Imports

user32

d3d11

d3dcompiler_47

imm32

kernel32

Sections

.text Size: 291KB - Virtual size: 290KB

.rdata Size: 91KB - Virtual size: 90KB

.data Size: 3KB - Virtual size: 22KB

.pdata Size: 14KB - Virtual size: 14KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 200B

_RDATA Size: 3KB - Virtual size: 3KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 291KB - Virtual size: 290KB

.rdata
Size: 91KB - Virtual size: 90KB

.data
Size: 3KB - Virtual size: 22KB

.pdata
Size: 14KB - Virtual size: 14KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 200B

_RDATA
Size: 3KB - Virtual size: 3KB

.reloc
Size: 2KB - Virtual size: 1KB