2024-04-25_b84cd60b4ca4014a64b8bd77f8071e06_ryuk | Triage

Sharing

General

Target

2024-04-25_b84cd60b4ca4014a64b8bd77f8071e06_ryuk
Size

473KB
MD5

b84cd60b4ca4014a64b8bd77f8071e06
SHA1

9f10daf311e9f80617e901df0683d7b2c584c27f
SHA256

201c413056911e155592011c09d74a6de4b2e994966186d457ba0876055cb3b4
SHA512

00fe02a0d3399137f3f1301c058ec4b587cfdfe4e02308c4e7bc7726b9cb0f7f6c4cadd90001533c6541d2fe1e1f6d57d988d203cd54d23b63f830f0f398cd04
SSDEEP

6144:b3iamB0M5qgbwRsy6Sa2nmuk2syo2Ymvo9f8viA5lnzAqzaX:pMVqgbmsy/fBoRm6UviA5lsB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-25_b84cd60b4ca4014a64b8bd77f8071e06_ryuk

Files

2024-04-25_b84cd60b4ca4014a64b8bd77f8071e06_ryuk
.exe windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 293KB - Virtual size: 293KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ