AmdPowerXpressRequestBetterBatteryLife
NvOptimusDisablement
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-01_8e2e689ff61cf9a422d2800338098a3e_ryuk.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-01_8e2e689ff61cf9a422d2800338098a3e_ryuk.exe
Resource
win10v2004-20240419-en
Target
2024-05-01_8e2e689ff61cf9a422d2800338098a3e_ryuk
Size
8.5MB
MD5
8e2e689ff61cf9a422d2800338098a3e
SHA1
c871e4ca5e20d496cb69ab6d2df07be0592b6584
SHA256
fcefde2ed490119c73ac4f89752e4c8225c66dd06e1fd3db2d7a1dd207e30613
SHA512
47f9cc182f619c23b86ef60b24da831cd5373a81e8c3016cd97c71e667d3ad02763002c091c62b74988258588aa552af4cc586592c70ba10015c5dc461dd039a
SSDEEP
98304:lj21qjo/OmhIVE0HeIOq/y6SCmtC8RHemKSPM7D/ClKlwvfW2T2ixwf:lq1q8/OmhIVBlOM5mtCgKSlKgfW8xw
Checks for missing Authenticode signature.
resource |
---|
2024-05-01_8e2e689ff61cf9a422d2800338098a3e_ryuk |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
AmdPowerXpressRequestBetterBatteryLife
NvOptimusDisablement
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE