2024-06-07_23965372ef05998dc732a1ca96a74a3c_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-07_23965372ef05998dc732a1ca96a74a3c_ryuk
Size

1.4MB
MD5

23965372ef05998dc732a1ca96a74a3c
SHA1

42174138c84a89591a740770bc64db7882003a89
SHA256

2bbfa499b4b5173f3c2f71018f5ae225c2a494b4513aab36a25867e86491fb94
SHA512

92954d4aa4a8e11030d9ad54393d9f77ba78e3d8ae6765d437786953a8fdb208e57ae0a48f4afa0f7cfdfc477f288336878a27b8a55c95c08329ae8860304fba
SSDEEP

24576:SPQv+gTc+2p2i+R1zfY7OE5Kh1RU8MQbbbNf9cfZl7KuaGavkg3NyWWBRBAUZLY7:doMi+R1zu+h1RUNAmH7KuaGaXnWBRBAT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-07_23965372ef05998dc732a1ca96a74a3c_ryuk

Files

2024-06-07_23965372ef05998dc732a1ca96a74a3c_ryuk
.exe windows:6 windows x64 arch:x64

d5cb0f0c4f325db526d1ad65813ce67c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Jenkins\workspace\Renoise_Package_Windows7_64bit\Temp\x64\Release\XRenoiseLicense\Renoise.pdb

Imports

advapi32

GetUserNameW

user32

GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
MapVirtualKeyW
GetKeyState
PostQuitMessage
PeekMessageW
DispatchMessageW
EmptyClipboard
GetWindow
MessageBoxW
GetForegroundWindow
SendMessageTimeoutW
IsWindow
ShowWindow
IsWindowVisible
IsIconic
SetForegroundWindow
TranslateMessage

kernel32

HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetProcessHeap
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEndOfFile
GetConsoleCP
SetStdHandle
GetCommandLineA
FindFirstFileExA
ExitProcess
HeapReAlloc
HeapFree
HeapAlloc
GetModuleHandleExW
FlushFileBuffers
ReadFile
CreateDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableA
GetFullPathNameW
GetDriveTypeW
ReadConsoleInputA
RtlUnwindEx
RaiseException
RtlPcToFileHeader
InterlockedPushEntrySList
WriteFile
GetCommandLineW
GetSystemInfo
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
CloseHandle
GetLastError
SetLastError
SetErrorMode
DeviceIoControl
GetCurrentProcessId
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
IsDebuggerPresent
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
GetVersionExW
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetCriticalSectionSpinCount
DeleteCriticalSection
RtlCaptureContext
DuplicateHandle
GetCurrentThread
GetModuleFileNameA
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessHeaps
GetProcessAffinityMask
SetThreadAffinityMask
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
SetEvent
ResetEvent
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
PeekConsoleInputW
FlushConsoleInputBuffer
GetNumberOfConsoleInputEvents
ReadConsoleInputW
SetConsoleMode
GetConsoleCursorInfo
SetConsoleCursorInfo
WriteConsoleOutputW
SetConsoleCursorPosition
WriteConsoleA
WriteConsoleW
GetStdHandle
GetFileType
SetUnhandledExceptionFilter
GetVersion
GetModuleHandleA
GetConsoleScreenBufferInfo
GetLargestConsoleWindowSize
SetConsoleActiveScreenBuffer
SetConsoleScreenBufferSize
SetConsoleWindowInfo
GetConsoleMode
SetConsoleCtrlHandler
CreateConsoleScreenBuffer
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
InitializeSListHead
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetACP
GetThreadTimes
LoadLibraryExW

winmm

timeGetTime

imagehlp

SymSetOptions
SymFunctionTableAccess64
SymGetModuleBase64
SymInitialize
SymGetSymFromAddr64
SymLoadModule64
StackWalk64

shell32

SHGetFolderPathW
SHFileOperationW

Sections

.text
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 944KB - Virtual size: 943KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shr
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5cb0f0c4f325db526d1ad65813ce67c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

user32

kernel32

winmm

imagehlp

shell32

Sections

.text Size: 448KB - Virtual size: 448KB

RT_CODE Size: 2KB - Virtual size: 2KB

.rdata Size: 944KB - Virtual size: 943KB

.data Size: 12KB - Virtual size: 4.0MB

.pdata Size: 24KB - Virtual size: 23KB

.shr Size: 1024B - Virtual size: 528B

.gfids Size: 1024B - Virtual size: 692B

.tls Size: 512B - Virtual size: 9B

_RDATA Size: 6KB - Virtual size: 5KB

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 448KB - Virtual size: 448KB

RT_CODE
Size: 2KB - Virtual size: 2KB

.rdata
Size: 944KB - Virtual size: 943KB

.data
Size: 12KB - Virtual size: 4.0MB

.pdata
Size: 24KB - Virtual size: 23KB

.shr
Size: 1024B - Virtual size: 528B

.gfids
Size: 1024B - Virtual size: 692B

.tls
Size: 512B - Virtual size: 9B

_RDATA
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 4KB - Virtual size: 4KB