Static task
static1
Behavioral task
behavioral1
Sample
2024-05-20_e7ff828836c1761ed840275bfcecac60_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-20_e7ff828836c1761ed840275bfcecac60_ryuk.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-20_e7ff828836c1761ed840275bfcecac60_ryuk
-
Size
5.6MB
-
MD5
e7ff828836c1761ed840275bfcecac60
-
SHA1
03e5d232329edd42b031ce9f3c6d7ffc76908dc1
-
SHA256
de696ef465428248beab494d02c8ff1b4784bc1fe67dbd1e8383065a3d604904
-
SHA512
3826e45a0e8538d662c5a294c3750f27beddc3100c0090f783eaff06e52d83b3b607c809b86e1da8b446e8b71b1f6378be390901ec87b5bad41142201b0beaf8
-
SSDEEP
49152:eoRg5xKs1WXpFtB2mSdbDUAsHpD+bsxctZE+OM2EsT/HBJJdMmepI9g4pn0ekPyt:pe5xKs1W1UbYZfgs0Qlxd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-20_e7ff828836c1761ed840275bfcecac60_ryuk
Files
-
2024-05-20_e7ff828836c1761ed840275bfcecac60_ryuk.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.retplne Size: 512B - Virtual size: 24B
.tls Size: 512B - Virtual size: 305B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CPADinfo Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 427KB - Virtual size: 427KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ