C:\work\3rd_party\build\opencv-build\bin\Debug\opencv_annotationd.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_e75b471a83a4db601c9123e0b5a7ac35_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-14_e75b471a83a4db601c9123e0b5a7ac35_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-14_e75b471a83a4db601c9123e0b5a7ac35_ryuk
-
Size
3.8MB
-
MD5
e75b471a83a4db601c9123e0b5a7ac35
-
SHA1
7874bda8442dd11468d28e027ae197c6d5ea5aa8
-
SHA256
47a5b6f048d20242af2c6875f1226d55f10badd1f02308963cd7d7b3165ea656
-
SHA512
3cc517c71a148330df611116d48dfee4b3edbe60d3d4c07571327131938e03bb80ff3491163ba74c4e72a47d23d997279787f809e2482b0d42d6a93bffd7a69e
-
SSDEEP
49152:C7rDxfYoPrq44rsZB6hLLhlrhGUNH1ThZU/sICLkvCAvSoFOIgj4zoqV0LV6DO35:C7aUBtIVxSggzIv3r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-14_e75b471a83a4db601c9123e0b5a7ac35_ryuk
Files
-
2024-05-14_e75b471a83a4db601c9123e0b5a7ac35_ryuk.exe windows:6 windows x64 arch:x64
61bf6dbadb6768cb01e54bcd675b7700
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
RaiseException
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
OutputDebugStringW
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RegisterWaitForSingleObject
LoadLibraryW
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
EncodePointer
SetThreadAffinityMask
UnregisterWait
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
CreateTimerQueue
RtlPcToFileHeader
RtlUnwindEx
HeapSize
HeapValidate
GetSystemInfo
GetModuleFileNameA
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
ReadFile
GetTempPathW
CreateFileW
SetFilePointerEx
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetConsoleCP
GetConsoleMode
ReadConsoleW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
HeapReAlloc
HeapQueryInformation
OutputDebugStringA
CreateDirectoryW
RemoveDirectoryW
SetStdHandle
SetEndOfFile
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleA
GetTickCount
Sleep
GetProcAddress
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
GetFileAttributesExA
FindNextFileA
FindFirstFileExA
GetProcessAffinityMask
FindClose
user32
OffsetRect
GetWindowLongPtrA
SetWindowLongPtrA
GetClassLongPtrA
LoadCursorA
LoadIconA
MonitorFromRect
GetMonitorInfoA
ScreenToClient
SetCursor
GetWindowRect
GetClientRect
GetWindowTextA
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
ReleaseCapture
SetCapture
GetKeyState
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
MoveWindow
ShowWindow
CreateWindowExA
UnregisterClassA
RegisterClassA
DefWindowProcA
SendMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
SubtractRect
gdi32
CreateDIBSection
StretchBlt
GetObjectA
GdiFlush
GetStockObject
SetStretchBltMode
SelectObject
GetCurrentObject
FillRgn
DeleteObject
DeleteDC
CreateRectRgn
CreateCompatibleDC
CreateCompatibleBitmap
SetDIBColorTable
BitBlt
CombineRgn
comdlg32
GetSaveFileNameA
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
SystemFunction036
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 910KB - Virtual size: 910KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 69KB - Virtual size: 618KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ