C:\src\unicode_far\Release.64.vc\Far.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-05_ae374ee12ddda31677f1bd3f500543d3_ryuk.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-05_ae374ee12ddda31677f1bd3f500543d3_ryuk.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-05_ae374ee12ddda31677f1bd3f500543d3_ryuk
-
Size
4.7MB
-
MD5
ae374ee12ddda31677f1bd3f500543d3
-
SHA1
9eddf55e5948fec34b1238ccad6ba2c4727076f6
-
SHA256
52bca01a8ab391ee04c9a1006a4b1f8f0c9e51a4d17f74c53b6a6ea81615812e
-
SHA512
798dfa1b92e4512685fac72a730b9dbed0d1b0a528c7fe70a6bc3cc8a0f5acb02f36d375bc8ce2bfbaf10e0c7e8fdb9a05e8b4beb9a2f0d85ca337a48541ea68
-
SSDEEP
98304:nj83D1y1L01TPpITrQMQWgnWB9rvodk+JjAa:81kLchIJ4WBpYJjAa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-05_ae374ee12ddda31677f1bd3f500543d3_ryuk
Files
-
2024-05-05_ae374ee12ddda31677f1bd3f500543d3_ryuk.exe windows:5 windows x64 arch:x64
7eedb2140d9422af1bd513b67e8f96e5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
VerifyVersionInfoW
VerSetConditionMask
GetDriveTypeW
GetThreadPriority
GetCurrentThread
SetThreadPriority
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CompareStringW
GetOEMCP
GetACP
GetPrivateProfileIntW
CreateEventW
SetEvent
ResetEvent
WaitForMultipleObjects
GetStdHandle
AllocConsole
FreeConsole
GetConsoleWindow
GetConsoleScreenBufferInfo
SetConsoleScreenBufferSize
SetConsoleWindowInfo
SetConsoleTitleW
GetConsoleCP
SetConsoleCP
GetConsoleOutputCP
SetConsoleOutputCP
SetConsoleCtrlHandler
GetConsoleMode
SetConsoleMode
PeekConsoleInputW
ReadConsoleInputW
WriteConsoleInputW
ReadConsoleOutputW
WriteConsoleOutputW
WriteConsoleW
SetConsoleTextAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleCursorPosition
FlushConsoleInputBuffer
GetNumberOfConsoleInputEvents
GetConsoleAliasW
GetConsoleAliasExesLengthW
GetConsoleAliasExesW
GetConsoleAliasesLengthW
GetConsoleAliasesW
AddConsoleAliasW
GetConsoleDisplayMode
GetLargestConsoleWindowSize
GetCurrentConsoleFont
GetConsoleFontSize
SetConsoleActiveScreenBuffer
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
ScrollConsoleScreenBufferW
SetThreadExecutionState
SetLastError
GetShortPathNameW
GetLongPathNameW
GetLocalTime
GetCalendarInfoW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LocalFileTimeToFileTime
GetLogicalDrives
DisconnectNamedPipe
LocalAlloc
CreateNamedPipeW
QueryInformationJobObject
CreateJobObjectW
SetInformationJobObject
AssignProcessToJobObject
GetLastError
ConnectNamedPipe
GetOverlappedResult
GetExitCodeProcess
TerminateProcess
CreateDirectoryW
CreateDirectoryExW
RemoveDirectoryW
CopyFileExW
MoveFileExW
SetFileAttributesW
CreateHardLinkW
GetDiskFreeSpaceExW
SetErrorMode
WaitNamedPipeW
OpenProcess
DuplicateHandle
GetCPInfoExW
GetCPInfo
EnumSystemCodePagesW
DebugBreak
SetUnhandledExceptionFilter
FindClose
FindVolumeClose
FindCloseChangeNotification
FindFirstVolumeW
FindNextVolumeW
SetFilePointerEx
GetFileInformationByHandle
DeviceIoControl
MoveFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleFileNameW
GetVolumeInformationW
GetFileSizeEx
GetFileType
GetLogicalDriveStringsW
SearchPathW
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetProcessHeaps
GetPrivateProfileStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
LoadLibraryExW
FileTimeToDosDateTime
FindFirstChangeNotificationW
SetVolumeMountPointW
DefineDosDeviceW
QueryPerformanceFrequency
CreateProcessW
GetComputerNameExW
GetComputerNameW
GlobalMemoryStatusEx
GetSystemPowerStatus
ExitThread
SetStdHandle
GetLocaleInfoW
GetTimeFormatW
GetCommandLineW
GetTempFileNameW
SetFileApisToOEM
SetFileApisToANSI
ReleaseMutex
GetProcessTimes
GetNumberFormatW
IsValidCodePage
FindNextFileA
FindFirstFileExA
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetCommandLineA
GetModuleFileNameA
ExitProcess
VirtualQuery
VirtualProtect
VirtualAlloc
GetTimeZoneInformation
GetModuleHandleExW
FreeLibraryAndExitThread
CreateThread
RtlUnwindEx
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
LCMapStringW
RaiseException
DecodePointer
EncodePointer
RtlPcToFileHeader
GetStringTypeW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
EnterCriticalSection
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
GetCurrentProcess
AreFileApisANSI
SetEnvironmentVariableA
user32
CharUpperA
CharLowerA
OemToCharBuffA
IsCharUpperA
IsCharAlphaW
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
RegisterClipboardFormatW
CharToOemBuffW
CharLowerW
IsCharLowerA
IsCharAlphaNumericA
CharUpperW
ShowWindow
GetWindowInfo
FlashWindowEx
DestroyWindow
PostQuitMessage
DefWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
IsClipboardFormatAvailable
CharUpperBuffW
GetSystemMetrics
IsZoomed
IsIconic
CharLowerBuffW
GetDoubleClickTime
WaitForInputIdle
GetWindowTextLengthW
GetWindowTextW
GetAsyncKeyState
IsCharAlphaNumericW
LoadImageW
ToUnicodeEx
IsCharAlphaA
CharToOemA
OemToCharA
IsCharLowerW
ShowWindowAsync
GetWindowPlacement
SetForegroundWindow
SystemParametersInfoW
EnumWindows
GetWindowThreadProcessId
GetWindowLongPtrW
IsWindowVisible
PostMessageW
MessageBeep
IsCharUpperW
VkKeyScanW
VkKeyScanExW
MapVirtualKeyW
keybd_event
GetKeyState
GetKeyboardLayoutList
SendMessageW
winspool.drv
EndDocPrinter
WritePrinter
StartDocPrinterW
OpenPrinterW
EnumPrintersW
ord203
ClosePrinter
advapi32
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
SetEntriesInAclW
SetSecurityDescriptorDacl
EncryptFileW
DecryptFileW
GetFileSecurityW
SetFileSecurityW
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
RegEnumValueW
OpenProcessToken
CheckTokenMembership
LookupAccountSidW
ConvertSidToStringSidW
GetLengthSid
CopySid
EqualSid
GetSecurityDescriptorOwner
IsValidSid
ConvertStringSidToSidW
LookupAccountNameW
SetNamedSecurityInfoW
IsTextUnicode
GetUserNameW
AdjustTokenPrivileges
GetTokenInformation
LookupPrivilegeValueW
RegCloseKey
shell32
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW
SHFileOperationW
netapi32
NetUserGetInfo
NetApiBufferFree
NetServerGetInfo
mpr
WNetAddConnection2W
WNetEnumResourceW
WNetOpenEnumW
WNetGetUniversalNameW
WNetCancelConnection2W
WNetGetConnectionW
WNetCloseEnum
ole32
CreateFileMoniker
GetRunningObjectTable
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
psapi
GetModuleFileNameExW
secur32
GetUserNameExW
setupapi
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
CM_Get_Device_ID_List_SizeW
CM_Get_Device_ID_ListW
CM_Locate_DevNodeW
CM_Get_Sibling
CM_Request_Device_EjectW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
CM_Get_Child
CM_Get_Device_IDW
CM_Get_DevNode_Status
SetupDiOpenDeviceInfoW
rpcrt4
UuidCreate
UuidHash
RpcStringFreeW
UuidToStringW
UuidFromStringW
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
Sections
.text Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 924KB - Virtual size: 923KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 102KB - Virtual size: 322KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ