2024-04-30_a201d216f260629bb0c13a797350d1ac_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-30_a201d216f260629bb0c13a797350d1ac_ryuk
Size

569KB
MD5

a201d216f260629bb0c13a797350d1ac
SHA1

f1f80c11ffde1505a396e806f7299ec31a78d938
SHA256

7cf5c605f78d174a2a619abe663d24beea9805560f9a7add7cf92e2526875ad9
SHA512

38bb6dde6120a4c9040be398c5ba0783c5d58a2771a7588981bd5e3eb34859be8f3093db458824ae50f765bb15b79e9ad76bebdf34491b70518edfc28210d45e
SSDEEP

12288:aiVTp1k0hHKmbsM/m0gKCJp/HDMPNA9F/3v4vmrYM3uTsXtIO0B9pGHNu4B2UW:jNPKmbsM/m0gKCJp/HDMPNA95gvmMM3X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-30_a201d216f260629bb0c13a797350d1ac_ryuk

Files

2024-04-30_a201d216f260629bb0c13a797350d1ac_ryuk
.exe windows:6 windows x64 arch:x64

f247d387c79004130880584b5d37d9c2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetFileSizeEx
GetFileTime
SystemTimeToTzSpecificLocalTime
GetTickCount
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileAttributesExW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
GetFileType
LCMapStringW
ExitProcess
GetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
GetCommandLineW
GetCommandLineA
RtlPcToFileHeader
RtlUnwindEx
OutputDebugStringW
GetFileAttributesW
FileTimeToLocalFileTime
SetErrorMode
FileTimeToSystemTime
GetThreadLocale
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
DeleteFileW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GlobalFlags
FormatMessageW
MulDiv
LocalFree
GlobalUnlock
GlobalFindAtomW
GetSystemDirectoryW
EncodePointer
GlobalFree
FreeResource
GetCurrentProcessId
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleW
FindResourceW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
LoadLibraryExW
FreeLibrary
GetVersionExW
GetCurrentThreadId
CreateEventW
SetEvent
CloseHandle
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
LoadLibraryW
GetModuleHandleExW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
SetLastError
OutputDebugStringA
GetACP
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetLastError
RaiseException
DecodePointer
GetProcAddress
GetModuleHandleA
VirtualProtect
GetCurrentThread
GetStringTypeW
QueueUserAPC
WriteConsoleW

user32

GetDesktopWindow
ClientToScreen
IsDialogMessageW
SetWindowTextW
MoveWindow
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
LoadIconW
UnhookWindowsHookEx
GetTopWindow
GetClassNameW
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
PtInRect
EqualRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowRect
RemovePropW
GetPropW
SetPropW
RedrawWindow
EndPaint
RealChildWindowFromPoint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
GetMenuItemCount
GetMenuItemID
GetSubMenu
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DestroyWindow
IsChild
IsMenu
UnregisterClassW
SendDlgItemMessageA
GetClientRect
SetRectEmpty
IsWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
GetWindowTextW
GetScrollPos
SetFocus
CharNextW
SetTimer
KillTimer
InvalidateRect
DrawTextW
DrawTextExW
MapDialogRect
GetWindow
GetSystemMetrics
GetDC
ReleaseDC
GetSysColorBrush
LoadCursorW
BeginPaint
OffsetRect
GetParent
SendMessageW
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExW
CallNextHookEx
PostMessageW
PostQuitMessage
SetCursor
EnableWindow
IsWindowEnabled
MessageBoxW
GetWindowLongW
GetWindowThreadProcessId
GetLastActivePopup
SetWindowPos
SetWindowContextHelpId
GrayStringW
TabbedTextOutW
GetWindowDC
CharUpperW
SetCapture
ReleaseCapture
PostThreadMessageW
RegisterClipboardFormatW
EndDialog
CreateDialogIndirectParamW
DestroyMenu
MessageBeep
GetNextDlgGroupItem
IsRectEmpty
IntersectRect
SetRect
InvalidateRgn
CopyAcceleratorTableW
GetDlgItem
GetNextDlgTabItem

gdi32

GetClipBox
GetStockObject
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
RestoreDC
SaveDC
ExtSelectClipRgn
SelectObject
SetMapMode
Escape
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
DeleteObject
GetDeviceCaps
GetObjectW
SetTextColor
SetBkColor
DeleteDC
CreateBitmap

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegEnumKeyW
RegEnumValueW
RegQueryValueW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW

ole32

CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
CoFreeUnusedLibraries
CoGetClassObject
StgCreateDocfileOnILockBytes
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
OleInitialize
OleUninitialize
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter

oleaut32

SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysAllocString
SysFreeString
VariantCopy
SysStringLen

oledlg

OleUIBusyW

oleacc

LresultFromObject
CreateStdAccessibleObject

Sections

.text
Size: 310KB - Virtual size: 309KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f247d387c79004130880584b5d37d9c2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

oleacc

Sections

.text Size: 310KB - Virtual size: 309KB

.rdata Size: 132KB - Virtual size: 132KB

.data Size: 12KB - Virtual size: 32KB

.pdata Size: 20KB - Virtual size: 19KB

.gfids Size: 6KB - Virtual size: 5KB

.giats Size: 512B - Virtual size: 4B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 80KB - Virtual size: 80KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 310KB - Virtual size: 309KB

.rdata
Size: 132KB - Virtual size: 132KB

.data
Size: 12KB - Virtual size: 32KB

.pdata
Size: 20KB - Virtual size: 19KB

.gfids
Size: 6KB - Virtual size: 5KB

.giats
Size: 512B - Virtual size: 4B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 80KB - Virtual size: 80KB

.reloc
Size: 6KB - Virtual size: 6KB