2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk

General

Target
2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk
Size 127KB
Sample240603-nn7dtsec62
SHA256 8862b060db997bc9077e3bece06529c1c116af379985f6138a07ab5fde61b54c
MD5 5496313b83ccce9a11fd94c70da68ace
SHA1 62a643f171d81511912f60197f062f6b1e79bab9
SHA512 0015d7342d3ae7c247bab7e7a3489b5887562c6f93e36f7483f9f2910e060680cfbd84c51df94d1bb4ba62b4d86d1382023f19e0fd1308f56bea050bcb086732
SSDEEP 3072:3jdVRK8n0oJ6RlWPSuIZuQqEbkPnZCX/VvCN:zdVw80oJ6RGSuIZP1EN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk

File Explorer

2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk

.exe 127KB

2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk

IMPHASH 2ce62b0c0226079a88a01c701dbee7b9
SHA256 8862b060db997bc9077e3bece06529c1c116af379985f6138a07ab5fde61b54c
MD5 5496313b83ccce9a11fd94c70da68ace
SHA1 62a643f171d81511912f60197f062f6b1e79bab9
SHA512 0015d7342d3ae7c247bab7e7a3489b5887562c6f93e36f7483f9f2910e060680cfbd84c51df94d1bb4ba62b4d86d1382023f19e0fd1308f56bea050bcb086732
SSDEEP 3072:3jdVRK8n0oJ6RlWPSuIZuQqEbkPnZCX/VvCN:zdVw80oJ6RGSuIZP1EN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

44243

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess GetCurrentThread SetLastError Sleep CloseHandle LoadLibraryA WinExec GetProcAddress CreateFileW DecodePointer WriteConsoleW SetFilePointerEx QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess RtlUnwind GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetACP HeapFree HeapAlloc GetStringTypeW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode RaiseException

advapi32

CloseServiceHandle

ws2_32

htons htonl bind inet_addr

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-03_5496313b83ccce9a11fd94c70da68ace_ryuk

kernel32

advapi32

ws2_32

generic