2024-03-31_100c9800e2965ea2362c8d9cf6ba33eb_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-03-31_100c9800e2965ea2362c8d9cf6ba33eb_ryuk
Size 4.9MB
Sample240331-f2rarsfa57
SHA256 978b11eb0242d5d22561d050efd5e7d092437290b1df02874191813a45ab90a1
MD5 100c9800e2965ea2362c8d9cf6ba33eb
SHA1 37affc8a4b3718bcf65a34548a1e4d37f75eaa84
SHA512 90eb7442bbfa913744a5ef92017e891bf556e47626063981cd634e5554880ace2787257e01027c68e98d6bc81c44fab7a2dfb67e4e1810c1ae054865ab12c601
SSDEEP 98304:r96A0OLbuAxpn8BX5ZoZQZKC+Lqd/6nQ5BEUHTT0:Z6A0JqpnaX5m9C+LwaQPH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-31_100c9800e2965ea2362c8d9cf6ba33eb_ryuk

File Explorer

2024-03-31_100c9800e2965ea2362c8d9cf6ba33eb_ryuk

.exe 4.9MB

2024-03-31_100c9800e2965ea2362c8d9cf6ba33eb_ryuk

IMPHASH 2a37d3828eb7ba7a8684d9f6d6404c72
SHA256 978b11eb0242d5d22561d050efd5e7d092437290b1df02874191813a45ab90a1
MD5 100c9800e2965ea2362c8d9cf6ba33eb
SHA1 37affc8a4b3718bcf65a34548a1e4d37f75eaa84
SHA512 90eb7442bbfa913744a5ef92017e891bf556e47626063981cd634e5554880ace2787257e01027c68e98d6bc81c44fab7a2dfb67e4e1810c1ae054865ab12c601
SSDEEP 98304:r96A0OLbuAxpn8BX5ZoZQZKC+Lqd/6nQ5BEUHTT0:Z6A0JqpnaX5m9C+LwaQPH
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4457566

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringEx CompareStringW CreateEventW CreateFileW CreateThread DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileSize GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemFirmwareTable GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile

user32

CloseClipboard CreateWindowExW DefWindowProcW DispatchMessageW EmptyClipboard GetCaretBlinkTime GetClientRect GetClipboardData GetDesktopWindow GetKeyState GetMessageW GetSystemMetrics GetWindowInfo GetWindowLongPtrW GetWindowRect IsZoomed LoadCursorW LoadIconW MessageBoxW OpenClipboard PostMessageA PostQuitMessage RegisterClassW ScreenToClient SetClassLongPtrW SetClipboardData SetWindowLongPtrW SetWindowPos ShowWindow TranslateMessage

advapi32

RegCloseKey RegOpenKeyW RegSetValueExW

ole32

CoTaskMemFree

shell32

CommandLineToArgvW

gdi32

CreateSolidBrush

ntdll

RtlNtStatusToDosError

ws2_32

ioctlsocket

dwrite

DWriteCreateFactory

d2d1

ord1 ord2

Name

.tFBZ

Size

725KB

Virtual Size

724KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.wDjVGH

Size

129KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.YcHoN

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

wHreeax0

Size

512B

Virtual Size

204B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.FsYVrx1

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PFoBP

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.VfJaCh

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.KwKF

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2024-03-31_100c9800e2965ea2362c8d9cf6ba33eb_ryuk

kernel32

user32

advapi32

ole32

shell32

gdi32

ntdll

ws2_32

dwrite

d2d1

generic