/tmp/job13926970931908013524/build/dmengine.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-10_9297c78a7d0561f2af51d7475e828268_gazer_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-10_9297c78a7d0561f2af51d7475e828268_gazer_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-10_9297c78a7d0561f2af51d7475e828268_gazer_ryuk
-
Size
5.6MB
-
MD5
9297c78a7d0561f2af51d7475e828268
-
SHA1
0f3ef2f9796f8e8738323c0a847f398d9462ef89
-
SHA256
6b00fa913aaf78b1368775d16f9edb5270b85ae9be377790a251dd10ef4a54e0
-
SHA512
10363bd6b51c8e700c6fa2465050aa626a6909774a25601c927d04c317750f3bfe345bde0f7101e03ba6c9bfbb6ba8829e6121171c912afe45c73e2528cc8614
-
SSDEEP
98304:bSYWZuOPBd8U4sX8sGycY2FEsKPELpqsJ1Sz3J/v+IV5RDmY:oZZd8U4EGyclj8z3J/tVbD3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-10_9297c78a7d0561f2af51d7475e828268_gazer_ryuk
Files
-
2024-04-10_9297c78a7d0561f2af51d7475e828268_gazer_ryuk.exe windows:6 windows x64 arch:x64
c3a290b4371373bee24e18060ae8b518
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
openal32
alBufferData
alDeleteBuffers
alDeleteSources
alGenBuffers
alGenSources
alGetError
alGetSourcei
alGetString
alSourcePlay
alSourceQueueBuffers
alSourceStop
alSourceUnqueueBuffers
alcCloseDevice
alcCreateContext
alcDestroyContext
alcGetCurrentContext
alcMakeContextCurrent
alcOpenDevice
alcProcessContext
opengl32
glBindTexture
glBlendFunc
glClear
glClearColor
glClearDepth
glClearStencil
glColorMask
glCullFace
glDeleteTextures
glDepthFunc
glDepthMask
glDisable
glDrawArrays
glDrawBuffer
glDrawElements
glEnable
glFlush
glFrontFace
glGenTextures
glGetError
glGetFloatv
glGetIntegerv
glGetString
glPixelStorei
glPolygonOffset
glReadBuffer
glReadPixels
glScissor
glStencilFunc
glStencilMask
glStencilOp
glTexImage2D
glTexParameterf
glTexParameteri
glTexSubImage2D
glViewport
wglCreateContext
wglDeleteContext
wglGetProcAddress
wglMakeCurrent
wglShareLists
ws2_32
WSACleanup
WSAGetLastError
WSAPoll
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyaddr
gethostbyname
gethostname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
inet_ntoa
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
steam_api64
SteamAPI_GetHSteamUser
SteamAPI_IsSteamRunning
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_RestartAppIfNecessary
SteamAPI_RunCallbacks
SteamAPI_Shutdown
SteamAPI_UnregisterCallResult
SteamAPI_UnregisterCallback
SteamInternal_ContextInit
SteamInternal_FindOrCreateUserInterface
SteamInternal_SteamAPI_Init
dbghelp
MiniDumpWriteDump
StackWalk64
SymCleanup
SymFromAddr
SymFunctionTableAccess64
SymGetLineFromAddr64
SymGetModuleBase64
SymInitialize
SymSetOptions
glu32
gluErrorString
shell32
CommandLineToArgvW
SHGetFolderPathA
ShellExecuteA
user32
AdjustWindowRect
AdjustWindowRectEx
BringWindowToTop
CallNextHookEx
CallWindowProcA
ChangeDisplaySettingsW
CharUpperA
CharUpperW
ClientToScreen
ClipCursor
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EnumDisplayDevicesA
EnumDisplayMonitors
EnumDisplaySettingsA
EnumDisplaySettingsExA
EnumDisplaySettingsW
GetAsyncKeyState
GetClientRect
GetClipCursor
GetCursorPos
GetDC
GetForegroundWindow
GetKeyState
GetMessageTime
GetMonitorInfoA
GetRawInputDeviceInfoA
GetRawInputDeviceList
GetWindowLongPtrA
GetWindowPlacement
GetWindowRect
IsWindowVisible
IsZoomed
LoadCursorA
LoadCursorFromFileA
LoadCursorW
LoadIconW
LoadImageA
MapVirtualKeyW
MonitorFromWindow
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassW
RegisterDeviceNotificationA
ReleaseCapture
ReleaseDC
ScreenToClient
SendMessageA
SetCapture
SetClassLongPtrW
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetWindowLongPtrA
SetWindowPlacement
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowCursor
ShowWindow
SystemParametersInfoW
TrackMouseEvent
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UnregisterClassW
UnregisterDeviceNotification
WaitMessage
psapi
EnumProcessModules
GetModuleFileNameExA
GetModuleInformation
gdi32
CreateSolidBrush
kernel32
AcquireSRWLockExclusive
CloseHandle
CompareStringW
CreateDirectoryW
CreateFileA
CreateFileW
CreatePipe
CreateProcessW
CreateThread
DecodePointer
DeleteCriticalSection
DeleteFileW
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetConsoleWindow
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetVersionExW
HeapAlloc
HeapFree
HeapQueryInformation
HeapReAlloc
HeapSize
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MoveFileExA
MoveFileExW
MultiByteToWideChar
OutputDebugStringW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RemoveDirectoryW
RtlCaptureContext
RtlCaptureStackBackTrace
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlRestoreContext
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
iphlpapi
GetAdaptersAddresses
xinput9_1_0
XInputGetState
dinput8
DirectInput8Create
advapi32
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
Exports
Exports
?dmHashClone32@@YAXPEAUHashState32@@PEBU1@_N@Z
?dmHashClone64@@YAXPEAUHashState64@@PEBU1@_N@Z
?dmHashFinal32@@YAIPEAUHashState32@@@Z
?dmHashFinal64@@YA_KPEAUHashState64@@@Z
?dmHashInit32@@YAXPEAUHashState32@@_N@Z
?dmHashInit64@@YAXPEAUHashState64@@_N@Z
?dmHashRelease32@@YAXPEAUHashState32@@@Z
?dmHashRelease64@@YAXPEAUHashState64@@@Z
?dmHashUpdateBuffer32@@YAXPEAUHashState32@@PEBXI@Z
?dmHashUpdateBuffer64@@YAXPEAUHashState64@@PEBXI@Z
AmdPowerXpressRequestHighPerformance
DecryptXTeaCTR
EncryptXTeaCTR
LZ4CompressBuffer
LZ4DecompressBuffer
LZ4MaxCompressedSize
NvOptimusEnablement
Particle_CreateContext
Particle_CreateInstance
Particle_DeletePrototype
Particle_DestroyContext
Particle_DestroyInstance
Particle_GenerateVertexData
Particle_GetContextMaxParticleCount
Particle_GetEmitterCount
Particle_GetInstanceStats
Particle_GetMaterial
Particle_GetMaterialPath
Particle_GetStats
Particle_GetTileSource
Particle_GetTileSourcePath
Particle_GetVertexBufferSize
Particle_Hash
Particle_IsSleeping
Particle_NewPrototype
Particle_NewPrototypeFromDDF
Particle_ReloadInstance
Particle_ReloadPrototype
Particle_RenderEmitter
Particle_ResetAttributeScratchBuffer
Particle_ResetInstance
Particle_ResetRenderConstant
Particle_SetContextMaxParticleCount
Particle_SetMaterial
Particle_SetPosition
Particle_SetRenderConstant
Particle_SetRotation
Particle_SetScale
Particle_SetScaleAlongZ
Particle_SetTileSource
Particle_StartInstance
Particle_StopInstance
Particle_Update
Particle_WriteAttributeToScratchBuffer
__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
dmHashBuffer32
dmHashBuffer64
dmHashBufferNoReverse32
dmHashBufferNoReverse64
dmHashEnableReverseHash
dmHashReverse32
dmHashReverse64
dmHashReverseErase32
dmHashReverseErase64
dmHashReverseSafe32
dmHashReverseSafe64
dmHashString32
dmHashString64
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s
Sections
.text Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 828KB - Virtual size: 828KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 107KB - Virtual size: 790KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 214KB - Virtual size: 213KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gxfg Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 401KB - Virtual size: 401KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ