2024-05-30_5008fa0eb077ffde84414a4c178785d2_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-30_5008fa0eb077ffde84414a4c178785d2_ryuk
Size 966KB
Sample240530-b532hsba79
SHA256 3e6be91be8347f9d777a90d47196fd09b0bbbd3fbf5060cbe99da627f5c68904
MD5 5008fa0eb077ffde84414a4c178785d2
SHA1 dfe4c733d1db06cbb74da0a0fed9f5b363b17d36
SHA512 27714f9db09c8de2aaf4cb89e982998789e186c6181f58aa44b90fecca0cca135d7e5ea2a129df24232f766a7533237b4f3b14115fe53bd9bb97b53aae0df808
SSDEEP 24576:gZ9/oX09zwSqLSMaHZ0CZy4BWIp9oYVhJvDX3CH9b:gfoA0azjyYVhFIb
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-05-30_5008fa0eb077ffde84414a4c178785d2_ryuk

.exe 966KB

2024-05-30_5008fa0eb077ffde84414a4c178785d2_ryuk

IMPHASH b62d3162ea2ae3a0fe9a182e31b2e468
SHA256 3e6be91be8347f9d777a90d47196fd09b0bbbd3fbf5060cbe99da627f5c68904
MD5 5008fa0eb077ffde84414a4c178785d2
SHA1 dfe4c733d1db06cbb74da0a0fed9f5b363b17d36
SHA512 27714f9db09c8de2aaf4cb89e982998789e186c6181f58aa44b90fecca0cca135d7e5ea2a129df24232f766a7533237b4f3b14115fe53bd9bb97b53aae0df808
SSDEEP 24576:gZ9/oX09zwSqLSMaHZ0CZy4BWIp9oYVhJvDX3CH9b:gfoA0azjyYVhFIb
MD5 SHA1 SHA512 SSDEEP

Digest

a2:9b:ca:ad:8c:4e:bf:81:28:ce:59:34:50:25:f4:a2:85:11:f8:2a:c7:b5:32:c0:9a:12:e8:7d:be:15:7e:f8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91420100MA49ARHU4R,CN=冷湖科技（武汉）有限公司,O=冷湖科技（武汉）有限公司,STREET=东湖新技术开发区东信路光谷创业街5栋3层01室06号(自贸区武汉片区),L=武汉,ST=湖北,C=CN,1.3.6.1.4.1.311.60.2.1.1=#1305575548414e,1.3.6.1.4.1.311.60.2.1.2=#13054855424549,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 8, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Digest

70:ce:32:d4:f4:b3:87:ae:61:f7:33:49:d7:b1:2d:8c:8c:1c:b2:46

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Apr 8, 2024

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=Globalsign TSA for MS Authenticode Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:07:64:9b:08:b0:a7:fe:7d:d6:54:a8:f2:f4:29:f6

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

78:23:9c:23:7c:48:28:0c:eb:29:7e:f6

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 21, 2023 - Jan 21, 2025

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

78:23:9c:23:7c:48:28:0c:eb:29:7e:f6

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 21, 2023 - Jan 21, 2025

Subject

CN=Globalsign TSA for Advanced - G4 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:19:75:74:71:c9:92:d7:44:df:a5:96:eb:b9:70:15

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 2, 2023 - Dec 4, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

73248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\workspace\StellarPlayer_Windows_Release\app\FlashPlayer\x64\Release\FlashPlayer.pdb

utilities

?OnInitFinished@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UEAAXVxml_node@pugi@@@Z ?SetAttribute@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UEAAJPEBD0H@Z ?SetAttribute@?$SObjectImpl@UIObject@SOUI@@@SOUI@@UEAAJAEBV?$TStringT@DUchar_traits@SOUI@@@2@0H@Z ?CvtA2W@SStrCpCvt@SOUI@@SA?AV?$TStringT@_WUwchar_traits@SOUI@@@2@AEBV?$TStringT@DUchar_traits@SOUI@@@2@II@Z ??4?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QEAAAEAV01@AEBV01@@Z ?GetLength@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QEBAHXZ ??1?$TStringT@DUchar_traits@SOUI@@@SOUI@@QEAA@XZ ??0?$TStringT@DUchar_traits@SOUI@@@SOUI@@QEAA@PEBD@Z ?Mid@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QEBA?AV12@HH@Z ??A?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QEBA_WH@Z ?Mid@?$TStringT@DUchar_traits@SOUI@@@SOUI@@QEBA?AV12@HH@Z ??B?$TStringT@DUchar_traits@SOUI@@@SOUI@@QEBAPEBDXZ ??A?$TStringT@DUchar_traits@SOUI@@@SOUI@@QEBADH@Z ?GetLength@?$TStringT@DUchar_traits@SOUI@@@SOUI@@QEBAHXZ ?SouiCalloc@soui_mem_wrapper@SOUI@@SAPEAX_K0@Z ?SouiFree@soui_mem_wrapper@SOUI@@SAXPEAX@Z ??B?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QEBAPEB_WXZ ?ConcatCopy@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@IEAA_NHPEB_WH0@Z ??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QEAA@AEBV01@@Z ??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QEAA@XZ ?SafeStrlen@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@SAHPEB_W@Z ??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QEAA@PEB_W@Z ??1?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QEAA@XZ ?GetData@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@IEBAPEAUTStringData@2@XZ ??4?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QEAAAEAV01@PEB_W@Z

soui3

?AfterPaint@SHostWnd@SOUI@@MEAAXPEAUIRenderTarget@2@AEAVSPainter@2@@Z ?CreateCaret@SWindow@SOUI@@UEAAHPEAUHBITMAP__@@HH@Z ?ShowCaret@SWindow@SOUI@@UEAAXH@Z ?SetCaretPos@SWindow@SOUI@@UEAAXHH@Z ?IsDrawToCache@SWindow@SOUI@@MEBA_NXZ ?IsLayeredWindow@SHostWnd@SOUI@@MEBAHXZ ?DispatchPaint@SWindow@SOUI@@MEAAXPEAUIRenderTarget@2@PEAUIRegion@2@II@Z ?GetBkgndColor@SWindow@SOUI@@MEBAKXZ ?OnLanguageChanged@SHostWnd@SOUI@@MEAAJXZ ?OnScaleChanged@SHostWnd@SOUI@@MEAAXH@Z ?OnRebuildFont@SWindow@SOUI@@MEAAXXZ ?OnInsertChild@SWindow@SOUI@@MEAAXPEAV12@@Z ?OnRemoveChild@SWindow@SOUI@@MEAAXPEAV12@@Z ?OnContainerChanged@SWindow@SOUI@@MEAAXPEAUISwndContainer@2@0@Z ?GetTrCtx@SWindow@SOUI@@UEBAAEBV?$TStringT@_WUwchar_traits@SOUI@@@2@XZ ?AddRef@?$TObjRefImpl@UIObjRef@SOUI@@@SOUI@@UEAAJXZ ?Release@?$TObjRefImpl@UIObjRef@SOUI@@@SOUI@@UEAAJXZ ?OnFinalRelease@?$TObjRefImpl2@UIObjRef@SOUI@@VSWindow@2@@SOUI@@UEAAXXZ ?OnWindowTextChanged@SNativeWnd@SOUI@@UEAAXPEB_W@Z ?OnFinalMessage@SNativeWnd@SOUI@@MEAAXPEAUHWND__@@@Z ?OnHostMsg@SHostWnd@SOUI@@MEAAX_NI_K_J@Z ?UpdateLayout@SHostWnd@SOUI@@MEAAXXZ ?RequestRelayout@SHostWnd@SOUI@@UEAAXKH@Z ?OnStateChanged@SWindow@SOUI@@UEAAXKK@Z ?OnStateChanging@SWindow@SOUI@@UEAAXKK@Z ?GetTextRect@SWindow@SOUI@@UEAAXPEAUtagRECT@@@Z ?OnSetCursor@SWindow@SOUI@@UEAAHAEBVCPoint@2@@Z ?GetSelectedChildInGroup@SWindow@SOUI@@UEAAPEAV12@XZ ?GetSelectedSiblingInGroup@SWindow@SOUI@@UEAAPEAV12@XZ ?BeforePaint@SHostWnd@SOUI@@MEAAXPEAUIRenderTarget@2@AEAVSPainter@2@@Z ?OnAnimationUpdate@SHostWnd@SOUI@@MEAAXPEAUIAnimation@2@@Z ?OnAnimationInvalidate@SHostWnd@SOUI@@MEAAXPEAUIAnimation@2@_N@Z ?OnAnimationStop@SHostWnd@SOUI@@MEAAXPEAUIAnimation@2@@Z ?OnAnimationStart@SWindow@SOUI@@MEAAXPEAUIAnimation@2@@Z ?KillFocus@SWindow@SOUI@@UEAAXXZ ?SetFocus@SWindow@SOUI@@UEAAXXZ ?CreateChildren@SWindow@SOUI@@UEAAHVxml_node@pugi@@@Z ?OnColorize@SWindow@SOUI@@MEAAXK@Z ?IsContainPoint@SWindow@SOUI@@UEBAHAEBUtagPOINT@@H@Z ?GetClientRect@SWindow@SOUI@@UEBAXPEAUtagRECT@@@Z ?GetClientRect@SHostWnd@SOUI@@UEBA?AVCRect@2@XZ ?GetToolTipText@SWindow@SOUI@@UEAA?AV?$TStringT@_WUwchar_traits@SOUI@@@2@XZ ?SetToolTipText@SWindow@SOUI@@UEAAXPEB_W@Z ?SetWindowTextW@SWindow@SOUI@@UEAAXPEB_W@Z ?GetWindowTextW@SWindow@SOUI@@UEAA?AV?$TStringT@_WUwchar_traits@SOUI@@@2@H@Z ?GetLayoutParam@SWindow@SOUI@@UEBAPEAUILayoutParam@2@XZ ?NeedRedrawWhenStateChange@SWindow@SOUI@@UEAAHXZ ?GetDesiredSize@SWindow@SOUI@@UEAA?AVCSize@2@HH@Z ?GetChildrenLayoutRect@SWindow@SOUI@@UEBA?AVCRect@2@XZ ?OnRelayout@SWindow@SOUI@@UEAAHAEBVCRect@2@@Z ?OnUpdateFloatPosition@SWindow@SOUI@@UEAAXAEBVCRect@2@@Z ?UpdateChildrenPosition@SWindow@SOUI@@UEAAXXZ ?IsClipClient@SWindow@SOUI@@UEAAHXZ ?OnNcHitTest@SWindow@SOUI@@UEAAHVCPoint@2@@Z ?IsFocusable@SWindow@SOUI@@UEAAHXZ ?OnGetDlgCode@SWindow@SOUI@@UEAAIXZ ?GetAttribute@SWindow@SOUI@@UEBA?AV?$TStringT@_WUwchar_traits@SOUI@@@2@AEBV32@@Z ?DefAttributeProc@SWindow@SOUI@@MEAAJAEBV?$TStringT@_WUwchar_traits@SOUI@@@2@0H@Z ?InitFromXml@SHostWnd@SOUI@@UEAAHVxml_node@pugi@@@Z ?FireEvent@SWindow@SOUI@@UEAAHAEAVEventArgs@2@@Z ?SwndFromPoint@SWindow@SOUI@@UEAAKAEAVCPoint@2@_N@Z ?OnContentChanged@SWindow@SOUI@@UEAAXXZ ?IsSiblingsAutoGroupped@SWindow@SOUI@@UEAAHXZ ?DrawTextW@SWindow@SOUI@@UEAAXPEAUIRenderTarget@2@PEB_WHPEAUtagRECT@@I@Z ?GetName@SWindow@SOUI@@UEBAPEB_WXZ ?GetID@SWindow@SOUI@@UEBAHXZ ?SetAttribute@SRootWindow@SOUI@@UEAAJAEBV?$TStringT@_WUwchar_traits@SOUI@@@2@0H@Z ?OnUpdateToolTip@SWindow@SOUI@@UEAAHVCPoint@2@AEAUSwndToolTipInfo@2@@Z ?tr@SWindow@SOUI@@UEAA?AV?$TStringT@_WUwchar_traits@SOUI@@@2@AEBV32@@Z ?GetObjectType@SHostWnd@SOUI@@UEBAHXZ ?GetObjectClass@SHostWnd@SOUI@@UEBAPEB_WXZ ?IsClass@SHostWnd@SOUI@@UEBAHPEB_W@Z ?OnUpdateCursor@SHostWnd@SOUI@@MEAAXXZ ?UnregisterTimelineHandler@SHostWnd@SOUI@@MEAAHPEAUITimelineHandler@2@@Z ?RegisterTimelineHandler@SHostWnd@SOUI@@MEAAHPEAUITimelineHandler@2@@Z ?onRootResize@SHostWnd@SOUI@@UEAA_NPEAVEventArgs@2@@Z ?OnUserXmlNode@SHostWnd@SOUI@@MEAAXVxml_node@pugi@@@Z ?OnLoadLayoutFromResourceID@SHostWnd@SOUI@@MEAAHAEBV?$TStringT@_WUwchar_traits@SOUI@@@2@@Z ?DestroyTooltip@SHostWnd@SOUI@@MEBAXPEAUIToolTip@2@@Z ?CreateTooltip@SHostWnd@SOUI@@MEBAPEAUIToolTip@2@XZ ?OnHostAnimationStoped@SHostWnd@SOUI@@MEAAXPEAUIAnimation@2@@Z ?OnHostAnimationStarted@SHostWnd@SOUI@@MEAAXPEAUIAnimation@2@@Z ?DoFrameEvent@SwndContainerImpl@SOUI@@MEAA_JI_K_J@Z ?EnableIME@SHostWnd@SOUI@@MEAAXH@Z ?OnCavasInvalidate@SHostWnd@SOUI@@MEAAXK@Z ?GetCaret@SwndContainerImpl@SOUI@@MEAAPEAUICaret@2@XZ ?GetScale@SHostWnd@SOUI@@MEBAHXZ ?GetScriptModule@SHostWnd@SOUI@@MEAAPEAUIScriptModule@2@XZ ?BuildWndTreeZorder@SwndContainerImpl@SOUI@@MEAAXXZ ?MarkWndTreeZorderDirty@SwndContainerImpl@SOUI@@MEAAXXZ ?GetMsgLoop@SHostWnd@SOUI@@MEAAPEAVSMessageLoop@2@XZ ?UnregisterTrackMouseEvent@SwndContainerImpl@SOUI@@MEAAHK@Z ?RegisterTrackMouseEvent@SwndContainerImpl@SOUI@@MEAAHK@Z ?GetAcceleratorMgr@SwndContainerImpl@SOUI@@MEAAPEAUIAcceleratorMgr@2@XZ ?FrameToHost@SwndContainerImpl@SOUI@@MEBAXAEAUtagRECT@@@Z ?UpdateTooltip@SHostWnd@SOUI@@MEAAXXZ ?UpdateWindow@SHostWnd@SOUI@@MEAAHXZ ?GetFocus@SwndContainerImpl@SOUI@@MEAAKXZ ?GetHover@SwndContainerImpl@SOUI@@MEAAKXZ ?OnSetSwndFocus@SwndContainerImpl@SOUI@@MEAAXK@Z ?OnSetSwndCapture@SHostWnd@SOUI@@MEAAKK@Z ?OnReleaseSwndCapture@SHostWnd@SOUI@@MEAAHXZ ?OnGetSwndCapture@SwndContainerImpl@SOUI@@MEAAKXZ ?OnRedraw@SHostWnd@SOUI@@MEAAXAEBVCRect@2@@Z ?OnReleaseRenderTarget@SHostWnd@SOUI@@MEAAXPEAUIRenderTarget@2@AEBVCRect@2@W4GrtFlag@2@@Z ?OnGetRenderTarget@SHostWnd@SOUI@@MEAAPEAUIRenderTarget@2@AEBVCRect@2@W4GrtFlag@2@@Z ?GetContainerRect@SHostWnd@SOUI@@MEBA?AVCRect@2@XZ ?IsSendWheel2Hover@SHostWnd@SOUI@@MEBAHXZ ?IsTranslucent@SHostWnd@SOUI@@MEBAHXZ ?GetTranslatorContext@SHostWnd@SOUI@@MEBAAEBV?$TStringT@_WUwchar_traits@SOUI@@@2@XZ ?GetHostHwnd@SHostWnd@SOUI@@MEAAPEAUHWND__@@XZ ?OnFireEvent@SHostWnd@SOUI@@MEAAHAEAVEventArgs@2@@Z ?RevokeDragDrop@SwndContainerImpl@SOUI@@MEAAHK@Z ?RegisterDragDrop@SwndContainerImpl@SOUI@@MEAAHKPEAUIDropTarget@@@Z ?OnNextFrame@SwndContainerImpl@SOUI@@UEAAXXZ ?GetClassNameW@SFlashCtrl@SOUI@@SAPEB_WXZ ?FindChildByName@SWindow@SOUI@@QEAAPEAV12@PEB_WH@Z ?KillTimer@SHostWnd@SOUI@@QEAAH_K@Z ?TrackPopupMenu@SMenuEx@SOUI@@QEAAIIHHPEAUHWND__@@H@Z ?ClientToScreen@SNativeWnd@SOUI@@QEBAHPEAUtagPOINT@@@Z ?LoadMenuW@SMenuEx@SOUI@@QEAAHAEBV?$TStringT@_WUwchar_traits@SOUI@@@2@PEAUHWND__@@@Z ??1SMenuEx@SOUI@@UEAA@XZ ??0SMenuEx@SOUI@@QEAA@XZ ?PostMessageW@SNativeWnd@SOUI@@QEAAHI_K_J@Z ?DestroyWindow@SNativeWnd@SOUI@@QEAAHXZ ?SetTimer@SHostWnd@SOUI@@QEAA_K_KI@Z ?GetFlashInterface@SFlashCtrl@SOUI@@QEBAPEAUIShockwaveFlash@ShockwaveFlashObjects@@XZ ?ShowWindow@SHostWnd@SOUI@@UEAAHH@Z ??1SHostWnd@SOUI@@UEAA@XZ ??0SHostWnd@SOUI@@QEAA@PEB_W@Z ?AfterAttribute@SWindow@SOUI@@MEAAJAEBV?$TStringT@_WUwchar_traits@SOUI@@@2@0HJ@Z ?SwndProc@SWindow@SOUI@@MEAAHI_K_JAEA_J@Z ?ProcessSwndMessage@SWindow@SOUI@@MEAAHI_K_JAEA_J@Z ?ReflectNotifications@SNativeWnd@SOUI@@QEAA_JI_K_JAEAH@Z ?ProcessWindowMessage@SHostWnd@SOUI@@UEAAHPEAUHWND__@@I_K_JAEA_JK@Z ?_HandleEvent@SHostWnd@SOUI@@UEAAHPEAVEventArgs@2@@Z ?OnCreateUnknownObject@SObjectFactoryMgr@SOUI@@MEBAPEAUIObject@2@AEBVSObjectInfo@2@@Z ?RegisterSystemObjects@SApplication@SOUI@@MEAAXXZ ?CreateAccessible@SApplication@SOUI@@UEBAPEAUIAccessible@@PEAVSWindow@2@@Z ?CreateAccProxy@SApplication@SOUI@@UEBAPEAUIAccProxy@2@PEAVSWindow@2@@Z ?CreateValueAnimatorByName@SApplication@SOUI@@UEBAPEAUIValueAnimator@2@PEB_W@Z ?CreateAnimationByName@SApplication@SOUI@@UEBAPEAUIAnimation@2@PEB_W@Z ?CreateInterpolatorByName@SApplication@SOUI@@UEBAPEAUIInterpolator@2@PEB_W@Z ?CreateSkinByName@SApplication@SOUI@@UEBAPEAVISkinObj@2@PEB_W@Z ?CreateWindowByName@SApplication@SOUI@@UEBAPEAVSWindow@2@PEB_W@Z ??1SApplication@SOUI@@UEAA@XZ ?Run@SApplication@SOUI@@QEAAHPEAUHWND__@@@Z ?SendMessageW@SNativeWnd@SOUI@@QEAA_JI_K_J@Z ?Create@SHostWnd@SOUI@@QEAAPEAUHWND__@@PEAU3@KKHHHH@Z ?AddResProvider@SResProviderMgr@SOUI@@QEAAXPEAUIResProvider@2@PEB_W@Z ?InitXmlNamedID@SApplication@SOUI@@QEAAXPEBU?$TNAMEDVALUE@H@2@HH@Z ?LoadSystemNamedResource@SApplication@SOUI@@QEAAIPEAUIResProvider@2@@Z ?CreateResProvider@SOUI@@YAHW4BUILTIN_RESTYPE@1@PEAPEAUIObjRef@1@@Z ??0SObjectDefaultRegister@SOUI@@QEAA@XZ ??0SApplication@SOUI@@QEAA@PEAUIRenderFactory@1@PEAUHINSTANCE__@@PEB_WAEBUISystemObjectRegister@1@H@Z ?getSingleton@?$SSingleton@VSApplication@SOUI@@@SOUI@@SAAEAVSApplication@2@XZ ?GetLogManager@SApplication@SOUI@@QEAAPEAUILog4zManager@2@XZ ?getSingletonPtr@?$SSingleton@VSApplication@SOUI@@@SOUI@@SAPEAVSApplication@2@XZ ?DrawFocus@SWindow@SOUI@@UEAAXPEAUIRenderTarget@2@@Z

kernel32

GetLastError CloseHandle Module32FirstW HeapSize ReadConsoleW WriteConsoleW GetTimeZoneInformation OutputDebugStringW SetConsoleCtrlHandler GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ReadFile GetConsoleMode FlushFileBuffers SetStdHandle GetCurrentThread HeapFree HeapReAlloc HeapAlloc DeleteFileW MoveFileExW RemoveDirectoryW GetCurrentDirectoryW GetCurrentDirectoryA SetCurrentDirectoryA SetEnvironmentVariableW SetEnvironmentVariableA GetFullPathNameA GetFullPathNameW GetACP WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleExW ExitProcess GetCommandLineW GetCommandLineA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx LoadLibraryExW RaiseException CreateToolhelp32Snapshot LocalFree GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW DecodePointer EncodePointer GetTickCount TlsFree TlsSetValue TlsGetValue TlsAlloc Sleep InitializeCriticalSectionAndSpinCount SetLastError MultiByteToWideChar AreFileApisANSI CreateHardLinkW CopyFileW GetTempPathW SetFilePointerEx SetFileAttributesW SetEndOfFile GetFileInformationByHandle GetFileAttributesExW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindClose CreateFileW FormatMessageW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetLocalTime Module32NextW GetSystemTime GetModuleFileNameW RtlPcToFileHeader GetConsoleCP WritePrivateProfileStringW CreateDirectoryW GetPrivateProfileStringW GetFileAttributesW ReadProcessMemory VirtualProtect WriteProcessMemory OutputDebugStringA WideCharToMultiByte LoadLibraryW GetProcAddress SetCurrentDirectoryW FreeLibrary VirtualQuery K32GetMappedFileNameW GetCurrentProcess

user32

BringWindowToTop GetWindowThreadProcessId FindWindowExW SetWindowTextW SetFocus SendMessageW FindWindowW SetWindowPos GetWindowRect

advapi32

RegOpenKeyW RegOpenKeyA

shell32

SHGetFolderPathW

ole32

OleInitialize OleUninitialize

oleaut32

SysAllocString GetErrorInfo VariantInit VariantClear VariantChangeType SetErrorInfo SysFreeString CreateErrorInfo

ws2_32

getaddrinfo

Name

.text

Size

641KB

Virtual Size

641KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

190KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-05-30_5008fa0eb077ffde84414a4c178785d2_ryuk

utilities

soui3

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

generic