C:\Users\s.deepak\Work_Programs-APL\apitrace-master\build\Debug\apitrace.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-04_ac515410ea04936fd135e992ffea9bdb_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-04_ac515410ea04936fd135e992ffea9bdb_ryuk.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-04_ac515410ea04936fd135e992ffea9bdb_ryuk
-
Size
4.1MB
-
MD5
ac515410ea04936fd135e992ffea9bdb
-
SHA1
05eda0518ac7077fd48285b730a66acbdb3415d4
-
SHA256
5ce41af6f5b490e54121ff7f603435e8a11d45d9b8beed80ece77a5776ae33ff
-
SHA512
5706c7e01bce69383bd095ede94b83e8bd88afdc1f2d167be441348c4d71156ad0e1be40a5ba67ee1c92ced3d819fa8e6fb8163d332e932f2b733febf0d74f7f
-
SSDEEP
24576:dm3rDsdXioCGSKd4+91bfChUnj7re/TZQh+oYzrpLqvs7UbqMwMGZ9AsTATYnUP:dm3Fyd4i1bfC2nj7reoWaQUbDGZpTYY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-04_ac515410ea04936fd135e992ffea9bdb_ryuk
Files
-
2024-05-04_ac515410ea04936fd135e992ffea9bdb_ryuk.exe windows:6 windows x64 arch:x64
e2c61a807df114640a9d14326d993e50
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
SetEnvironmentVariableA
GetStdHandle
GetModuleHandleA
GetProcAddress
SetConsoleTextAttribute
GetCurrentDirectoryA
CreateDirectoryA
DeleteFileA
GetFileAttributesA
IsDebuggerPresent
OutputDebugStringA
CloseHandle
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
WaitForSingleObject
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessA
GetModuleFileNameA
CopyFileA
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetCPInfo
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
SetEvent
ResetEvent
WaitForSingleObjectEx
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
RtlPcToFileHeader
RtlUnwindEx
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
GetModuleHandleExW
GetFileType
WriteConsoleW
HeapSize
HeapValidate
GetSystemInfo
ExitProcess
CreateFileW
SetFilePointerEx
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetConsoleCP
GetConsoleMode
ReadFile
ReadConsoleW
GetCurrentThread
OutputDebugStringW
CreateThread
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
HeapReAlloc
HeapQueryInformation
SetStdHandle
SetEndOfFile
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
shell32
SHGetFolderPathA
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 143KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 283B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ