2024-05-10_3f23a5bb55f63e72da6d401d2ef82431_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-10_3f23a5bb55f63e72da6d401d2ef82431_ryuk
Size

1.1MB
MD5

3f23a5bb55f63e72da6d401d2ef82431
SHA1

8360c92e3fa856a7aa51be37981924a5f1ce354b
SHA256

ff40d77e85ae0e202b1b3b41e6e2012a213c1a467970c777bf75857a00082370
SHA512

8ed05ccfae563da1eaecb2c6a143466f6816a87ffec3037b100b16845e6835642dbbde0c393c535538bde7d9d9bfc0e03a591aeff1c75fea170e5c0330b520f1
SSDEEP

24576:+mcHYKbNn/Gk7D347w/00fMe80wp06I7:+JYKbN/L7D347Ku0wqr7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-10_3f23a5bb55f63e72da6d401d2ef82431_ryuk

Files

2024-05-10_3f23a5bb55f63e72da6d401d2ef82431_ryuk
.exe windows:6 windows x64 arch:x64

f75775660c55171ec80686b072faac45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

setupapi

SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo

kernel32

EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
CreateFileA
ReadFile
WriteFile
CloseHandle
GetLastError
GetOverlappedResult
DeviceIoControl
CancelIo
ResetEvent
WaitForSingleObject
CreateEventA
FreeLibrary
GetProcAddress
LocalFree
FormatMessageW
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleHandleA
RaiseException
Sleep
GetCurrentThreadId
GetSystemTimeAsFileTime
TlsSetValue
CreateMutexW
ReleaseMutex
CreateEventW
SetEvent
TlsAlloc
SleepEx
TlsGetValue
TlsFree
EnterCriticalSection
GetCurrentProcess
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
DuplicateHandle
DeleteCriticalSection
VerifyVersionInfoA
ReleaseSemaphore
GetVersionExA
VerSetConditionMask
GetCurrentProcessId
CreateSemaphoreA
SetThreadAffinityMask
GetProcessAffinityMask
TerminateThread
FormatMessageA
CreateDirectoryW
CreateFileW
FindClose
GetFileAttributesW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
HeapSize
ReadConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetProcessHeap
GetTimeZoneInformation
GetConsoleMode
GetACP
GetConsoleCP
TryEnterCriticalSection
WaitForSingleObjectEx
GetCurrentThread
GetExitCodeThread
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
GetTickCount
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlPcToFileHeader
RtlUnwindEx
GetStdHandle
GetFileType
GetModuleFileNameA
GetModuleHandleExW
WriteConsoleW
ExitThread
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetCommandLineA
GetCommandLineW
FlushFileBuffers

user32

UnregisterClassA
TranslateMessage
GetRawInputDeviceList
GetRawInputDeviceInfoA
GetActiveWindow
DestroyWindow
CreateWindowExA
RegisterClassExA
DispatchMessageA
DefWindowProcA
UnregisterDeviceNotification
RegisterDeviceNotificationA
PeekMessageA
GetMessageA

ole32

CoUninitialize
CoInitializeEx

Exports

Exports

hid_close
hid_enumerate
hid_error
hid_exit
hid_free_enumeration
hid_get_feature_report
hid_get_indexed_string
hid_get_manufacturer_string
hid_get_product_string
hid_get_serial_number_string
hid_init
hid_open
hid_open_path
hid_read
hid_read_timeout
hid_send_feature_report
hid_set_nonblocking
hid_write

Sections

.text
Size: 750KB - Virtual size: 749KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f75775660c55171ec80686b072faac45

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 750KB - Virtual size: 749KB

.rdata Size: 267KB - Virtual size: 266KB

.data Size: 22KB - Virtual size: 58KB

.pdata Size: 40KB - Virtual size: 40KB

.gfids Size: 4KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 750KB - Virtual size: 749KB

.rdata
Size: 267KB - Virtual size: 266KB

.data
Size: 22KB - Virtual size: 58KB

.pdata
Size: 40KB - Virtual size: 40KB

.gfids
Size: 4KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 7KB - Virtual size: 7KB