2024-04-17_2c928e2bba7d8f38442387fdad14e576_ryuk | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-17_2c928e2bba7d8f38442387fdad14e576_ryuk
Size

501KB
MD5

2c928e2bba7d8f38442387fdad14e576
SHA1

886d15a03aba04bac408f3235fb35f2e4a95b0aa
SHA256

d024caf7d75a633f4ace2750602f856ebdc0eb6bd53bc5ce225a7ecb32837eff
SHA512

743926548d4980d776320a167145672fe3a3a24db7b46c85e9f0e2f8c45ccc5b292e7a849a4619b556974b226141e488bfb4db88357bfd192018b4437cb19f2d
SSDEEP

6144:EYRAysqU3ZXvoFTCVwUixSCYlp+O1mqqWCZIhUwWGRaLq9hE1V/fhC2xFd:/RgfoewU8mlwyUwXRam9hE1V/vFd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-17_2c928e2bba7d8f38442387fdad14e576_ryuk

Files

2024-04-17_2c928e2bba7d8f38442387fdad14e576_ryuk
.exe windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 327KB - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ