Static task
static1
Behavioral task
behavioral1
Sample
2024-04-19_e48f6cca29dae6298b19ee1c8d58f7c0_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-19_e48f6cca29dae6298b19ee1c8d58f7c0_ryuk.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-19_e48f6cca29dae6298b19ee1c8d58f7c0_ryuk
-
Size
200KB
-
MD5
e48f6cca29dae6298b19ee1c8d58f7c0
-
SHA1
13d971966720f93b51e4c243a3a242c8379d10c8
-
SHA256
2b1bc29f9c32cafd7f11fb7e2ac3c3376e0df7dc7a15df76ab0062a0587048db
-
SHA512
180df740df26d0b1f31ce15380eb0d8d2b7f392adfd3bb89250e3324005ab2e39ab6ec05c97142380e43a1407fcfe7cc93ab285b385062d51a1f5f00e5285b94
-
SSDEEP
3072:D12RyN+/Sjj8oqsy5LDrG04z+F5jgZV+glkGlPtRVyVvUf3dlc22:h2A+E8oqsyLDy04zkW3l1Pkg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-19_e48f6cca29dae6298b19ee1c8d58f7c0_ryuk
Files
-
2024-04-19_e48f6cca29dae6298b19ee1c8d58f7c0_ryuk.exe windows:5 windows x64 arch:x64
5d48329722394c34866bd4d787a132c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
turbojpeg
tj3GetErrorCode
tj3GetErrorStr
tj3Free
tj3SaveImage16
tj3SaveImage12
tj3SaveImage8
tj3LoadImage16
tj3LoadImage12
tj3LoadImage8
tj3Alloc
tj3Destroy
tj3Transform
tj3DecodeYUV8
tj3DecompressToYUV8
tj3Decompress16
tj3Decompress12
tj3Decompress8
tj3SetCroppingRegion
tj3SetScalingFactor
tj3GetScalingFactors
tj3DecompressHeader
tj3EncodeYUV8
tj3YUVBufSize
tj3JPEGBufSize
tj3CompressFromYUV8
tj3Compress16
tj3Compress12
tj3Compress8
tj3Get
tj3Set
tj3Init
kernel32
DeleteCriticalSection
SetEndOfFile
HeapReAlloc
HeapSize
RaiseException
CreateFileW
FlushFileBuffers
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileSizeEx
GetConsoleCP
SetFilePointerEx
ReadConsoleW
GetConsoleMode
CloseHandle
GetFileType
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ReadFile
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
Sections
.text Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ