/tmp/job2450584790358996645/build/dmengine.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-10_7b07ee5098b1f09e8ce5a875bd5d9575_gazer_ryuk.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-10_7b07ee5098b1f09e8ce5a875bd5d9575_gazer_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-10_7b07ee5098b1f09e8ce5a875bd5d9575_gazer_ryuk
-
Size
5.2MB
-
MD5
7b07ee5098b1f09e8ce5a875bd5d9575
-
SHA1
e41083d7a6d1e504f541dd570ebefbe33687c1a9
-
SHA256
75d83320ddd8e9d3183e3241e948b8f33e6dc01d55ebc4879cdf425d8e38130b
-
SHA512
17156d7061eeb595bf99736c9d4ce8a5a5d54449be527a97d74d6697f0020d4ce69ccbe60ea1a5bda63ab5542545a1913e756b3722c891b4b569f21f84150202
-
SSDEEP
98304:ZSYbv2BgMS0oG4ZIZ6P8WURSuvMmmPy3leVInlGuC2aErVd+:nv2O0oG446PEUQCJEpd+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-10_7b07ee5098b1f09e8ce5a875bd5d9575_gazer_ryuk
Files
-
2024-04-10_7b07ee5098b1f09e8ce5a875bd5d9575_gazer_ryuk.exe windows:6 windows x64 arch:x64
ae01df0e91117f28511bd97121fccdeb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
openal32
alBufferData
alDeleteBuffers
alDeleteSources
alGenBuffers
alGenSources
alGetError
alGetSourcei
alGetString
alSourcePlay
alSourceQueueBuffers
alSourceStop
alSourceUnqueueBuffers
alcCloseDevice
alcCreateContext
alcDestroyContext
alcGetCurrentContext
alcMakeContextCurrent
alcOpenDevice
alcProcessContext
opengl32
glBindTexture
glBlendFunc
glClear
glClearColor
glClearDepth
glClearStencil
glColorMask
glCullFace
glDeleteTextures
glDepthFunc
glDepthMask
glDisable
glDrawArrays
glDrawBuffer
glDrawElements
glEnable
glFlush
glFrontFace
glGenTextures
glGetError
glGetFloatv
glGetIntegerv
glGetString
glPixelStorei
glPolygonOffset
glReadBuffer
glReadPixels
glScissor
glStencilFunc
glStencilMask
glStencilOp
glTexImage2D
glTexParameterf
glTexParameteri
glTexSubImage2D
glViewport
wglCreateContext
wglDeleteContext
wglGetProcAddress
wglMakeCurrent
wglShareLists
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
steam_api64
SteamAPI_GetHSteamUser
SteamAPI_IsSteamRunning
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_RestartAppIfNecessary
SteamAPI_RunCallbacks
SteamAPI_Shutdown
SteamAPI_UnregisterCallResult
SteamAPI_UnregisterCallback
SteamInternal_ContextInit
SteamInternal_FindOrCreateUserInterface
SteamInternal_SteamAPI_Init
dbghelp
MiniDumpWriteDump
StackWalk64
SymCleanup
SymFromAddr
SymFunctionTableAccess64
SymGetLineFromAddr64
SymGetModuleBase64
SymInitialize
SymSetOptions
glu32
gluErrorString
shell32
CommandLineToArgvW
SHGetFolderPathA
ShellExecuteA
user32
AdjustWindowRect
AdjustWindowRectEx
BringWindowToTop
CallNextHookEx
CallWindowProcA
ChangeDisplaySettingsW
CharUpperA
CharUpperW
ClientToScreen
ClipCursor
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EnumDisplayDevicesA
EnumDisplayMonitors
EnumDisplaySettingsA
EnumDisplaySettingsExA
EnumDisplaySettingsW
GetAsyncKeyState
GetClientRect
GetClipCursor
GetCursorPos
GetDC
GetForegroundWindow
GetKeyState
GetMessageTime
GetMonitorInfoA
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetWindowLongPtrA
GetWindowPlacement
GetWindowRect
IsWindowVisible
IsZoomed
LoadCursorA
LoadCursorFromFileA
LoadCursorW
LoadIconW
LoadImageA
MapVirtualKeyW
MonitorFromWindow
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassW
RegisterDeviceNotificationA
ReleaseCapture
ReleaseDC
ScreenToClient
SendMessageA
SetCapture
SetClassLongPtrW
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetWindowLongPtrA
SetWindowPlacement
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowCursor
ShowWindow
SystemParametersInfoW
TrackMouseEvent
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UnregisterClassW
UnregisterDeviceNotification
WaitMessage
psapi
EnumProcessModules
GetModuleFileNameExA
GetModuleInformation
gdi32
CreateSolidBrush
kernel32
AcquireSRWLockExclusive
CloseHandle
CompareStringW
CreateDirectoryW
CreateFileA
CreateFileW
CreateProcessW
CreateThread
DecodePointer
DeleteCriticalSection
DeleteFileW
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetConsoleWindow
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetVersionExW
HeapAlloc
HeapFree
HeapQueryInformation
HeapReAlloc
HeapSize
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MoveFileExA
MoveFileExW
MultiByteToWideChar
OutputDebugStringW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RemoveDirectoryW
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
iphlpapi
GetAdaptersAddresses
xinput9_1_0
XInputGetState
dinput8
DirectInput8Create
advapi32
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
Exports
Exports
?dmHashClone32@@YAXPEAUHashState32@@PEBU1@_N@Z
?dmHashClone64@@YAXPEAUHashState64@@PEBU1@_N@Z
?dmHashFinal32@@YAIPEAUHashState32@@@Z
?dmHashFinal64@@YA_KPEAUHashState64@@@Z
?dmHashInit32@@YAXPEAUHashState32@@_N@Z
?dmHashInit64@@YAXPEAUHashState64@@_N@Z
?dmHashRelease32@@YAXPEAUHashState32@@@Z
?dmHashRelease64@@YAXPEAUHashState64@@@Z
?dmHashUpdateBuffer32@@YAXPEAUHashState32@@PEBXI@Z
?dmHashUpdateBuffer64@@YAXPEAUHashState64@@PEBXI@Z
AmdPowerXpressRequestHighPerformance
DecryptXTeaCTR
EncryptXTeaCTR
LZ4CompressBuffer
LZ4DecompressBuffer
LZ4MaxCompressedSize
NvOptimusEnablement
Particle_CreateContext
Particle_CreateInstance
Particle_DeletePrototype
Particle_DestroyContext
Particle_DestroyInstance
Particle_GenerateVertexData
Particle_GetContextMaxParticleCount
Particle_GetEmitterCount
Particle_GetInstanceStats
Particle_GetMaterial
Particle_GetMaterialPath
Particle_GetStats
Particle_GetTileSource
Particle_GetTileSourcePath
Particle_GetVertexBufferSize
Particle_Hash
Particle_IsSleeping
Particle_NewPrototype
Particle_NewPrototypeFromDDF
Particle_ReloadInstance
Particle_ReloadPrototype
Particle_RenderEmitter
Particle_ResetAttributeScratchBuffer
Particle_ResetInstance
Particle_ResetRenderConstant
Particle_SetContextMaxParticleCount
Particle_SetMaterial
Particle_SetPosition
Particle_SetRenderConstant
Particle_SetRotation
Particle_SetScale
Particle_SetScaleAlongZ
Particle_SetTileSource
Particle_StartInstance
Particle_StopInstance
Particle_Update
Particle_WriteAttributeToScratchBuffer
dmHashBuffer32
dmHashBuffer64
dmHashBufferNoReverse32
dmHashBufferNoReverse64
dmHashEnableReverseHash
dmHashReverse32
dmHashReverse64
dmHashReverseErase32
dmHashReverseErase64
dmHashReverseSafe32
dmHashReverseSafe64
dmHashString32
dmHashString64
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 785KB - Virtual size: 784KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 106KB - Virtual size: 789KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 195KB - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 401KB - Virtual size: 401KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ