2024-05-02_ed5e50682e829a48a925feac0b65b73a_ryuk | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-02_ed5e50682e829a48a925feac0b65b73a_ryuk
Size

346KB
MD5

ed5e50682e829a48a925feac0b65b73a
SHA1

6480d40eb224ad9467e411bb6de139700f8fb67b
SHA256

3a81031e231ff0eb8ea4bb741152e70f96475c4213a735af8c5bf1fb7ff26aa0
SHA512

2bbeba089b1b6a1c10d876d72e001f3bae8333a5f58ad0568c84a191c1542845842fe857cff6e576c54b1dbd00451ebc29fd20ad03c7db913b3cb897f8278745
SSDEEP

1536:X8uNpe/jYrjwMRXFt2VDiFO0GEdfDF9XGJH0QRP4dWsTp9dluwkTKeUUVgvhi:sgpIjOjX/2VDiFJdhDQw7MRTKefuvY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-02_ed5e50682e829a48a925feac0b65b73a_ryuk

Files

2024-05-02_ed5e50682e829a48a925feac0b65b73a_ryuk
.exe windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Elevated_MpMiniSigStub.pdb

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ