2024-05-11_6638bcc6a3638e66a51784872cded845_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-11_6638bcc6a3638e66a51784872cded845_ryuk
Size

11.9MB
MD5

6638bcc6a3638e66a51784872cded845
SHA1

3e74a39db84da041237df573d33b68e3794f1832
SHA256

2c9590890655fffcc15b869c68f2edfa1b5bee42db6e2ae0fb49d92deea3222d
SHA512

ccefea65b0874edba99bdc055a70960feb63ea323c59622d0c6ea87a9d790883e37d8de78625c506b2e1a294a76e9d083477a869dad9f22daf8f9ddc9d0de0f2
SSDEEP

196608:SH6a1kbt60EC0/1qFVk8sO1BnFWHKOHFNXbG5ec/fdg:SH6OkbA0EC0/1qFVk8sO1BnFWHflZa5D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-11_6638bcc6a3638e66a51784872cded845_ryuk

Files

2024-05-11_6638bcc6a3638e66a51784872cded845_ryuk
.exe windows:6 windows x64 arch:x64

3d11df005726c140160402240294b2d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\KR4\git\kingdomrush-x.x64\proj.win32\x64\Release\krv-steam\Kingdom Rush Vengeance.pdb

Imports

steam_api64

SteamAPI_UnregisterCallback
SteamAPI_GetHSteamUser
SteamInternal_ContextInit
SteamInternal_FindOrCreateUserInterface
SteamAPI_Init
SteamAPI_RestartAppIfNecessary
SteamAPI_RegisterCallback
SteamAPI_RunCallbacks

glew32

__glewDeleteShader
__glewGetActiveAttrib
__glewGetActiveUniform
__glewGetAttribLocation
__glewGetProgramInfoLog
__glewGetProgramiv
__glewGetShaderInfoLog
__glewGetShaderSource
__glewGetShaderiv
__glewLinkProgram
__glewShaderSource
__glewUniform1f
__glewUniform1fv
__glewUniform1i
__glewUniform2f
__glewUniform2fv
__glewUniform3f
__glewUniform3fv
__glewUniform4f
__glewUniform4fv
__glewDeleteProgram
__glewUniformMatrix4fv
__glewUseProgram
__glewBufferSubData
__glewCompressedTexImage2D
__glewMapBuffer
__glewUnmapBuffer
__glewCreateShader
__glewCreateProgram
__glewCompileShader
__glewFramebufferTexture3D
__glewUniformMatrix3fv
__glewGetUniformLocation
__glewBindAttribLocation
__glewAttachShader
__glewActiveTexture
__glewGenVertexArrays
__glewDeleteVertexArrays
__glewBindVertexArray
__glewGenBuffers
__glewDeleteBuffers
__glewBufferData
__glewVertexAttribPointer
__glewEnableVertexAttribArray
__glewBindBuffer
__GLEW_ARB_vertex_shader
__GLEW_ARB_fragment_shader
__glewRenderbufferStorage
__glewIsRenderbuffer
__glewIsFramebuffer
__glewGetRenderbufferParameteriv
__glewGetFramebufferAttachmentParameteriv
__glewFramebufferTexture2D
__glewFramebufferTexture1D
__glewFramebufferRenderbuffer
__glewDeleteRenderbuffers
__glewDeleteFramebuffers
__glewCheckFramebufferStatus
__glewBindRenderbuffer
__glewBindFramebuffer
glewGetErrorString
glewIsSupported
glewInit
__glewGenerateMipmap
__glewGenRenderbuffers
__glewGenFramebuffers

winmm

timeGetDevCaps
timeEndPeriod
timeBeginPeriod

ws2_32

send
recv
closesocket

kernel32

InitializeCriticalSectionEx
InitializeConditionVariable
WideCharToMultiByte
GetModuleHandleW
SetThreadExecutionState
MultiByteToWideChar
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
QueryPerformanceCounter
QueryPerformanceFrequency
VerSetConditionMask
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
FormatMessageW
Sleep
GetModuleFileNameW
GetLocaleInfoA
GetUserDefaultUILanguage
GetUserDefaultLCID
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileSize
ReadFile
RemoveDirectoryW
SetFileAttributesW
CloseHandle
MoveFileW
OutputDebugStringW
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
GetExitCodeThread
EncodePointer
DecodePointer
GetCPInfo
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
WakeConditionVariable
GetStringTypeW
SetEvent
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
ExitProcess
GetModuleHandleExW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapAlloc
HeapReAlloc
HeapFree
ExitThread
GetStdHandle
WriteFile
GetACP
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCurrentDirectoryW
ReadConsoleW
SetFilePointerEx
GetProcessHeap
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
HeapSize
SetEndOfFile
SleepConditionVariableCS
GetLocaleInfoW

user32

CreateIconIndirect
SystemParametersInfoW
MonitorFromWindow
GetRawInputData
RegisterRawInputDevices
GetRawInputDeviceInfoA
GetRawInputDeviceList
RegisterDeviceNotificationW
GetActiveWindow
ToUnicode
DrawTextW
OffsetRect
MessageBoxW
ChangeDisplaySettingsExW
ReleaseDC
GetDC
SetFocus
LoadImageW
BringWindowToTop
SetWindowPlacement
GetWindowPlacement
SetWindowPos
SetLayeredWindowAttributes
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
DefWindowProcW
SendMessageW
DestroyIcon
LoadCursorW
GetClassLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
WindowFromPoint
SetRect
ScreenToClient
ClientToScreen
ClipCursor
GetCursorPos
SetCursor
SetCursorPos
AdjustWindowRectEx
GetClientRect
RemovePropW
GetPropW
SetPropW
RedrawWindow
SetForegroundWindow
GetSystemMetrics
ReleaseCapture
SetCapture
MapVirtualKeyW
GetKeyState
GetMessageTime
PeekMessageW
DispatchMessageW
TranslateMessage
TrackMouseEvent
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplaySettingsExW
UnregisterDeviceNotification
EnumDisplaySettingsW

gdi32

CreateBitmap
CreateRectRgn
SetDeviceGammaRamp
CreateDIBSection
ChoosePixelFormat
DeleteDC
GetDeviceCaps
DeleteObject
CreateDCW
GetObjectA
SetTextColor
SetBkMode
SelectObject
RemoveFontResourceW
GetStockObject
GetDIBits
CreateFontIndirectA
CreateCompatibleDC
AddFontResourceW
SwapBuffers
SetPixelFormat
DescribePixelFormat

advapi32

RegCloseKey
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW

shell32

SHCreateDirectoryExW
ShellExecuteW
DragAcceptFiles
DragFinish
DragQueryPoint
DragQueryFileW
SHGetFolderPathW

openal32

alSourceQueueBuffers
alSourceStop
alBufferData
alIsBuffer
alDeleteBuffers
alGenBuffers
alcCloseDevice
alcOpenDevice
alcDestroyContext
alcMakeContextCurrent
alcCreateContext
alSourcePause
alSourcePlay
alGetSourcei
alSourcei
alSourcef
alDeleteSources
alGenSources
alGetError
alSourceUnqueueBuffers

libcurl

curl_easy_init
curl_slist_free_all
curl_easy_strerror
curl_easy_setopt
curl_easy_perform
curl_easy_cleanup
curl_easy_getinfo
curl_slist_append

libmpg123

mpg123_format
mpg123_format_none
mpg123_strerror
mpg123_getformat
mpg123_delete
mpg123_new
mpg123_exit
mpg123_init
mpg123_open
mpg123_close
mpg123_read
mpg123_tell
mpg123_seek
mpg123_scan
mpg123_length
mpg123_plain_strerror

opengl32

glGetFloatv
glScissor
glViewport
glGetError
wglGetProcAddress
glEnable
glGetString
glDrawArrays
glLineWidth
glBindTexture
glStencilOp
glStencilFunc
glAlphaFunc
glStencilMask
glColorMask
glFrontFace
glCullFace
glClearStencil
glGetBooleanv
glDrawElements
glDepthMask
glDepthFunc
glClearDepth
glClearColor
glClear
glTexSubImage2D
glTexParameteri
glTexImage2D
glGenTextures
glDeleteTextures
glGetIntegerv
glPixelStorei
glDisable
glBlendFunc
glIsEnabled

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

vorbisfile

ov_read
ov_info
ov_pcm_tell
ov_pcm_seek
ov_pcm_total
ov_fopen
ov_clear

Sections

.text
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 479KB - Virtual size: 520KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 295KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d11df005726c140160402240294b2d3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

steam_api64

glew32

winmm

ws2_32

kernel32

user32

gdi32

advapi32

shell32

openal32

libcurl

libmpg123

opengl32

version

vorbisfile

Sections

.text Size: 7.1MB - Virtual size: 7.1MB

.rdata Size: 3.6MB - Virtual size: 3.6MB

.data Size: 479KB - Virtual size: 520KB

.pdata Size: 295KB - Virtual size: 295KB

.gfids Size: 4KB - Virtual size: 3KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 332KB - Virtual size: 331KB

.reloc Size: 224KB - Virtual size: 224KB

.text
Size: 7.1MB - Virtual size: 7.1MB

.rdata
Size: 3.6MB - Virtual size: 3.6MB

.data
Size: 479KB - Virtual size: 520KB

.pdata
Size: 295KB - Virtual size: 295KB

.gfids
Size: 4KB - Virtual size: 3KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 332KB - Virtual size: 331KB

.reloc
Size: 224KB - Virtual size: 224KB