2024-06-02_80f5dc104afceff0048e484f2e10da42_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-02_80f5dc104afceff0048e484f2e10da42_ryuk
Size

4.5MB
MD5

80f5dc104afceff0048e484f2e10da42
SHA1

07d93bf823ad6e5aa3abd36d51305658fc8a915a
SHA256

ce54322a7f919917f3529a4e7150398d475cee78ca14aa3e1b74f3306b237bb4
SHA512

152fade42af1383f4cd325e3e4385f5d0293f4f3e2a98b4228ee5e5a35aea7109dd8f8829fc75bf5b465e37077ffab598255b10bcd6950b00a5787f3b173f5de
SSDEEP

49152:nNfa1w4jxrbeplUbwaF1Tou9Nfa1w4jxrbeplUbwaF1ToMtdqBZp9p0p7:BaeA7aemG9p0p

Score

10^/10

Malware Config

Signatures

Detects executables packed with Enigma 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Enigma

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-02_80f5dc104afceff0048e484f2e10da42_ryuk

Files

2024-06-02_80f5dc104afceff0048e484f2e10da42_ryuk
.exe windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\build\nw32_win64\node-webkit\src\outst\nw\./initialexe/nw.exe.pdb

Exports

Exports

GetHandleVerifier
IsSandboxedProcess

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 259KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 25B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CPADinfo
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 362KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.enigma1
Size: 2.0MB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.enigma2
Size: 740KB - Virtual size: 740KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

PDB Paths

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 259KB - Virtual size: 259KB

.data Size: 7KB - Virtual size: 38KB

.pdata Size: 43KB - Virtual size: 43KB

.00cfg Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 25B

CPADinfo Size: 512B - Virtual size: 56B

.rsrc Size: 362KB - Virtual size: 361KB

.reloc Size: 7KB - Virtual size: 6KB

.enigma1 Size: 2.0MB - Virtual size: 4KB

.enigma2 Size: 740KB - Virtual size: 740KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 259KB - Virtual size: 259KB

.data
Size: 7KB - Virtual size: 38KB

.pdata
Size: 43KB - Virtual size: 43KB

.00cfg
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 25B

CPADinfo
Size: 512B - Virtual size: 56B

.rsrc
Size: 362KB - Virtual size: 361KB

.reloc
Size: 7KB - Virtual size: 6KB

.enigma1
Size: 2.0MB - Virtual size: 4KB

.enigma2
Size: 740KB - Virtual size: 740KB