2024-06-03_7e52272e64cbbc73d09f24131e9d5dc7_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-03_7e52272e64cbbc73d09f24131e9d5dc7_ryuk
Size 1.6MB
Sample240603-ml2vwsbd8z
SHA256 20208970ce58894b6be9012d2797e6da0dc00d476a43cdd1d37a6585c60a5a71
MD5 7e52272e64cbbc73d09f24131e9d5dc7
SHA1 9b6f6f741249746fc4e5b61936e49a2aa9707fe5
SHA512 98fb52f08d9b77e52cdaad7cfdee13e6a0e7eb2a44e40d51dc4afbcfc8188db5effd10d3f8f8835d64f69ff79ba1cca68f480f289dc2298dcdda98e95e0310ab
SSDEEP 24576:kMMeoHKy92WQ+zIh+nro8A0jsqjnhMgeiCl7G0nehbGZpbD:xMeoHKyl7zfnE8AwDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-03_7e52272e64cbbc73d09f24131e9d5dc7_ryuk

File Explorer

2024-06-03_7e52272e64cbbc73d09f24131e9d5dc7_ryuk

.exe 1.6MB

2024-06-03_7e52272e64cbbc73d09f24131e9d5dc7_ryuk

IMPHASH 23a184a246b853a7debfff68e5399c2f
SHA256 20208970ce58894b6be9012d2797e6da0dc00d476a43cdd1d37a6585c60a5a71
MD5 7e52272e64cbbc73d09f24131e9d5dc7
SHA1 9b6f6f741249746fc4e5b61936e49a2aa9707fe5
SHA512 98fb52f08d9b77e52cdaad7cfdee13e6a0e7eb2a44e40d51dc4afbcfc8188db5effd10d3f8f8835d64f69ff79ba1cca68f480f289dc2298dcdda98e95e0310ab
SSDEEP 24576:kMMeoHKy92WQ+zIh+nro8A0jsqjnhMgeiCl7G0nehbGZpbD:xMeoHKyl7zfnE8AwDmg27RnWGj
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

388336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\devrel\Playpen\yyao\VRBench\VR-FCAT\FVSDK_rel_1_0\Symbols\PresentMon_x64.pdb

gdi32

CreateDCW GetDeviceCaps

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdA SetupDiGetClassDevsA

kernel32

LoadLibraryW QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualAlloc GetVersionExW GetModuleFileNameA SetLastError GetFullPathNameW GetModuleFileNameW LocalAlloc CreateFileW GetFileAttributesW lstrcmpA GetSystemDirectoryW GetLastError OutputDebugStringW FileTimeToSystemTime CloseHandle GetProcAddress LocalFree VerSetConditionMask GetModuleHandleW FreeLibrary VerifyVersionInfoW LoadLibraryExW GetConsoleScreenBufferInfo GetStdHandle WriteConsoleOutputCharacterA SetConsoleCursorPosition QueryPerformanceCounter SetThreadPriority GetCurrentThread SetConsoleCtrlHandler SetDefaultDllDirectories RegisterWaitForSingleObject OutputDebugStringA WaitForSingleObject GetCurrentDirectoryA UnmapViewOfFile CreateEventW Sleep SetEvent QueryPerformanceFrequency CreateThread UnregisterWaitEx CreateFileMappingA OpenFileMappingA CreateEventA MapViewOfFile EnterCriticalSection LeaveCriticalSection InitializeCriticalSection OpenEventW OpenProcess QueryFullProcessImageNameA DeleteCriticalSection GetExitCodeProcess GetCurrentProcess LoadLibraryExA LoadLibraryA HeapAlloc GetProcessHeap GetCommandLineW ResetEvent DeviceIoControl GetLogicalProcessorInformationEx GetModuleHandleA GetTickCount64 RaiseException GetSystemInfo VirtualProtect VirtualQuery RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte TryEnterCriticalSection DuplicateHandle GetExitCodeThread GetNativeSystemInfo MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList ExitProcess GetModuleHandleExW GetFileType WriteConsoleW WriteFile GetCommandLineA HeapFree ExitThread FreeLibraryAndExitThread HeapReAlloc GetFileSizeEx SetFilePointerEx IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile GetTimeZoneInformation HeapSize FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadConsoleW SetEndOfFile CreateTimerQueue SignalObjectAndWait SwitchToThread GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask UnregisterWait GetThreadTimes

Name

.text

Size

702KB

Virtual Size

701KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

239KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

568B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-03_7e52272e64cbbc73d09f24131e9d5dc7_ryuk

gdi32

setupapi

kernel32

generic