2024-05-31_b3f399e33149dc07218d5a9a78d2bae3_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-31_b3f399e33149dc07218d5a9a78d2bae3_ryuk
Size

3.4MB
MD5

b3f399e33149dc07218d5a9a78d2bae3
SHA1

663da90debbddbb1b633ae15f44b17b7b6f9f9dc
SHA256

3eb8305112335efb61c53b8fe81d7af82460e52334e90e426db217d6f5fe0e38
SHA512

32da79d37b6b5729fb1e00924046dd9e163cd39497dfb6fad9d82f10cfd68fffe64c128442afd149929dd244b53a0ed954e398f972506b67185c96b1cb74f956
SSDEEP

49152:bKpQcyGivRryqqw6JbtSzK0f9aPmayf7rQOX83Zn9rzGf:9yC0Pmt7EDaf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-31_b3f399e33149dc07218d5a9a78d2bae3_ryuk

Files

2024-05-31_b3f399e33149dc07218d5a9a78d2bae3_ryuk
.exe windows:6 windows x64 arch:x64

3339369d9895741f663520bca36412ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Omar\WB\work\code\bin\x64\Final\wb.pdb

Imports

kernel32

Sleep
CreateThread
CreateDirectoryA
GetVersion
DeleteFileA
RemoveDirectoryA
CopyFileA
GetUserDefaultLCID
SetCurrentDirectoryA
GetCurrentDirectoryA
AllocConsole
SetEndOfFile
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExA
MoveFileExW
DeleteFileW
GlobalAlloc
GlobalLock
GlobalUnlock
CreateFileW
GetTimeZoneInformation
HeapSize
GetCurrentThreadId
GetCurrentThread
SetThreadAffinityMask
FlushFileBuffers
CreatePipe
GetFileAttributesExW
GetModuleHandleW
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetACP
GetCommandLineW
GetCommandLineA
WriteFile
GetStdHandle
HeapReAlloc
GetTempPathW
GetModuleHandleExW
ExitProcess
ReadFile
RtlUnwindEx
RtlPcToFileHeader
LoadLibraryW
UnregisterWaitEx
MultiByteToWideChar
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
DuplicateHandle
RaiseException
SetThreadPriority
ResumeThread
QueryPerformanceCounter
QueryPerformanceFrequency
DeleteCriticalSection
CreateProcessA
FormatMessageA
VirtualProtect
CreateDirectoryW
CreateFileA
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
GetFileAttributesA
GetFileTime
SetFileTime
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
CreateSemaphoreW
ReleaseSemaphore
FreeLibraryAndExitThread
GetThreadTimes
GetSystemTimeAsFileTime
VirtualFree
UnregisterWait
VerSetConditionMask
VerifyVersionInfoW
RegisterWaitForSingleObject
GetProcessAffinityMask
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentProcessId
HeapAlloc
HeapFree
GetProcessHeap
CancelIo
SleepEx
ReadDirectoryChangesW
WaitForSingleObjectEx
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
SwitchToFiber
DeleteFiber
ConvertFiberToThread
CreateFiberEx
ConvertThreadToFiberEx
GetLastError
FreeLibrary
GetModuleFileNameA
LoadLibraryExA
ReleaseMutex
CreateMutexW
ResetEvent
CreateEventW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
WaitForSingleObject
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetLocaleInfoW
LCMapStringW
SetEvent
GetExitCodeProcess
CloseHandle
TryEnterCriticalSection
GetStringTypeW
EncodePointer
DecodePointer
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
CompareStringW

user32

SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageW
GetRawInputDeviceList
GetRawInputDeviceInfoA
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
OpenClipboard
RegisterDeviceNotificationA
PeekMessageA
DispatchMessageA
GetMessageA
PeekMessageW
wsprintfW
DefWindowProcW
PostQuitMessage
EnumDisplayMonitors
ClientToScreen
GetCursorPos
SetCursorPos
GetActiveWindow
GetMonitorInfoW
MessageBoxA
UnregisterClassW
RegisterClassExW
MonitorFromWindow
GetForegroundWindow
UnregisterDeviceNotification
EnumDisplaySettingsW
ChangeDisplaySettingsExW
ChangeDisplaySettingsW
LoadIconW
LoadCursorW
SetWindowLongPtrW
ShowCursor
MessageBoxW
AdjustWindowRectEx
GetWindowRect
GetClientRect
ReleaseDC
GetDC
SetForegroundWindow
SetFocus
IsIconic
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW

steam_api64

SteamInternal_ContextInit
SteamAPI_GetHSteamUser
SteamAPI_GetHSteamPipe
SteamAPI_RunCallbacks
SteamAPI_Shutdown
SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamInternal_CreateInterface
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback

shell32

DragFinish
ShellExecuteA
SHFileOperationW
SHGetFolderPathW
DragQueryFileW

dinput8

DirectInput8Create

xinput1_3

ord3
ord2

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDeviceAndSwapChain

ole32

CoUninitialize
CoInitializeEx

d3dcompiler_43

D3DReflect
D3DCreateBlob

winmm

waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutReset
waveOutOpen

imm32

ImmGetContext
ImmSetCompositionWindow

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 659KB - Virtual size: 658KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 83KB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3339369d9895741f663520bca36412ca

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

steam_api64

shell32

dinput8

xinput1_3

dxgi

d3d11

ole32

d3dcompiler_43

winmm

imm32

Exports

Exports

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 659KB - Virtual size: 658KB

.data Size: 83KB - Virtual size: 3.2MB

.pdata Size: 124KB - Virtual size: 124KB

.tls Size: 512B - Virtual size: 53B

.gfids Size: 3KB - Virtual size: 2KB

_RDATA Size: 41KB - Virtual size: 41KB

.rsrc Size: 34KB - Virtual size: 33KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 659KB - Virtual size: 658KB

.data
Size: 83KB - Virtual size: 3.2MB

.pdata
Size: 124KB - Virtual size: 124KB

.tls
Size: 512B - Virtual size: 53B

.gfids
Size: 3KB - Virtual size: 2KB

_RDATA
Size: 41KB - Virtual size: 41KB

.rsrc
Size: 34KB - Virtual size: 33KB

.reloc
Size: 15KB - Virtual size: 15KB