H:\A51-CADSci-2017\A51-CADSci-2017\IP3D\dev\CadScience\TestCadSci\Debug\TestCadSci.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-24_3823d8cac18ca1fb3c6675b9bc5cf416_ryuk.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-24_3823d8cac18ca1fb3c6675b9bc5cf416_ryuk.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-24_3823d8cac18ca1fb3c6675b9bc5cf416_ryuk
-
Size
6.4MB
-
MD5
3823d8cac18ca1fb3c6675b9bc5cf416
-
SHA1
51113dfefe6415b64633289bdcb33690a09eb938
-
SHA256
528ce832f949e831178c9134ed6b026b3f559054c8736f60effae9caecffd927
-
SHA512
215c1150934b534505e3b03514e8246f1113efc14d616febc2883fb5c747a9fec9c3d315d90d94619d30f4671618cdabc6cb6a956a7ade867695fee7515b1a8e
-
SSDEEP
49152:cB/MpH5U0AD+/NcjThyRTX9Q2orh6ye0farMtiAqphlMDjBGsdXvsvVsgvE9rm/7:cB/MpZQD+/Ncxe0farMtiXlMD/imO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-24_3823d8cac18ca1fb3c6675b9bc5cf416_ryuk
Files
-
2024-06-24_3823d8cac18ca1fb3c6675b9bc5cf416_ryuk.exe windows:6 windows x64 arch:x64
2cac5ec736e3006110bd30ea9826b988
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
igitt
GITTCtxPrimaryAngle
GITTCtxPixelSpacing
GITTCtxDimensionY
GITTCtxDimensionX
GITTCtxObjects
GITTCtxRead
GITTCtxDestroy
GITTCtxFromMemory
holxlog
LogError
LogInfo
?ComputeArgLength@LogEvent@@MEAAXXZ
?WriteBody@LogEvent@@MEAAXPEAEH@Z
??1CSharpString@@UEAA@XZ
??0CSharpString@@QEAA@AEBV0@@Z
cudart64_80
cudaMemGetInfo
cudaSetDevice
cudaDeviceReset
__cudaRegisterTexture
cudaUnbindTexture
cudaGetErrorString
cudaGetLastError
cudaDeviceSynchronize
cudaGetDevice
cudaBindTextureToArray
cudaBindTexture
cudaGetChannelDesc
cudaMemcpyToArray
cudaMallocArray
__cudaRegisterFunction
__cudaRegisterVar
__cudaUnregisterFatBinary
__cudaRegisterFatBinary
cudaDestroyTextureObject
cudaCreateTextureObject
cudaCreateChannelDesc
cudaMemset2D
cudaMemset
cudaMemcpyToSymbol
cudaMemcpy2D
cudaMemcpy
cudaMallocPitch
cudaLaunch
cudaSetupArgument
cudaConfigureCall
cudaGetDeviceProperties
cudaThreadSetCacheConfig
cudaThreadGetCacheConfig
cudaMalloc
cudaFree
enhance
ArtDetectionDown
cadscience
RunCadSci
CadScienceVer
filter
ffp
fbp
fver
bp
BPpixX
BPStartX
bp_recon2metal
bp_reconstruct
bp_matrix
BPStartY
bp_all_recon2metal_2D
BPpixY
bpver
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
GetTimeZoneInformation
SetConsoleCtrlHandler
CreateThread
OutputDebugStringW
OutputDebugStringA
HeapQueryInformation
HeapReAlloc
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCurrentThread
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetEnvironmentVariableA
GetDateFormatW
GetACP
GetCommandLineW
GetCommandLineA
WriteConsoleW
GetStdHandle
GetSystemInfo
HeapValidate
HeapSize
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
InterlockedFlushSList
InterlockedPushEntrySList
LoadLibraryExW
RtlPcToFileHeader
RtlUnwindEx
QueryPerformanceFrequency
FindFirstFileA
FindClose
GetFileAttributesA
CreateDirectoryA
SetStdHandle
SetEnvironmentVariableW
ReadConsoleW
GetTimeFormatW
GetProcAddress
LoadLibraryW
UnmapViewOfFile
MapViewOfFile
GetOverlappedResult
WriteFile
ReadFile
GetFileType
CreateFileW
CreateFileA
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
DeleteFileA
CloseHandle
GetModuleFileNameA
GetModuleHandleA
WideCharToMultiByte
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
SetEndOfFile
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
RaiseException
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetLastError
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Exports
Exports
??0LogEvent@@QEAA@$$QEAV0@@Z
??0LogEvent@@QEAA@AEBV0@@Z
??0RoiVolF@@QEAA@MM@Z
??0RoiVolF@@QEAA@MMMMMM@Z
??1LogEvent@@QEAA@XZ
??4ArtifactDetector@@QEAAAEAV0@AEBV0@@Z
??4CSharpString@@QEAAAEAV0@AEBV0@@Z
??4HPP@@QEAAAEAV0@$$QEAV0@@Z
??4HPP@@QEAAAEAV0@AEBV0@@Z
??4LogEvent@@QEAAAEAV0@$$QEAV0@@Z
??4LogEvent@@QEAAAEAV0@AEBV0@@Z
??4RoiVolF@@QEAAAEAU0@$$QEAU0@@Z
??4RoiVolF@@QEAAAEAU0@AEBU0@@Z
??4TimeUtil@@QEAAAEAV0@$$QEAV0@@Z
??4TimeUtil@@QEAAAEAV0@AEBV0@@Z
??_7LogEvent@@6B@
?Add@HPP@@QEAAHAEAVimage2D@@0@Z
?Buffer@CSharpString@@QEBAPEADXZ
?FindFlipsToCadSpace@HPP@@QEAAHAEA_N0PEBD1@Z
?FindTransToCadSpace@HPP@@QEAAHAEA_NAEAW4IppiAxis@@AEAW4ROTATION@@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@3@Z
?GetAirValAndBreastBoundary@HPP@@QEAAHAEAMAEAUBreastRoi@@PEAHAEA_NPEBGHHQEAMM@Z
?GradWrapper@HPP@@QEAAHAEAVimage2D@@000MM@Z
?InvertD2G@HPP@@QEAAHAEAVimage2D@@0@Z
?InvertShort@HPP@@QEAAHAEAVimage2D@@H@Z
?IppAdd@HPP@@QEAAHAEAVimage2D@@0@Z
?IppClosing3x3@HPP@@QEAAHAEAVimage2D@@@Z
?IppConvSep2D@HPP@@QEAAHAEAVimage2D@@0PEAMH1H@Z
?IppDilate@HPP@@QEAAHAEAVimage2D@@0H@Z
?IppDistanceMap@HPP@@QEAAHAEAVimage2D@@0@Z
?IppErode@HPP@@QEAAHAEAVimage2D@@0H@Z
?IppErodeBorder@HPP@@QEAAHAEAVimage2D@@0H@Z
?IppFlip@HPP@@QEAAHAEAVimage2D@@W4IppiAxis@@@Z
?IppFloodFill@HPP@@QEAAHAEAVimage2D@@HH@Z
?IppFroCadSpace@HPP@@QEAAHAEAVimage2D@@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1@Z
?IppFroCadSpaceGPU@HPP@@QEAAHAEAUmem_2d@@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1@Z
?IppGaussian@HPP@@QEAAHAEAVimage2D@@0MMPEAM@Z
?IppHistogram@HPP@@QEAAHAEAVimage2D@@PEAHH@Z
?IppLabelCCP@HPP@@QEAAHAEAVimage2D@@PEAHH@Z
?IppMinMax@HPP@@QEAAHAEAVimage2D@@AEAF1@Z
?IppThresholdGT@HPP@@QEAAHAEAVimage2D@@0F@Z
?IppThresholdLT@HPP@@QEAAHAEAVimage2D@@0F@Z
?IppThresholdRange@HPP@@QEAAHAEAVimage2D@@0FFF@Z
?IppToCadSpace@HPP@@QEAAHAEAVimage2D@@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1@Z
?IppToCadSpaceGPU@HPP@@QEAAHAEAUmem_2d@@AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@1@Z
?IsDiv2m@HPP@@AEAA_NHH@Z
?Jan1_1601_ticks@TimeUtil@@0_KB
?Length@CSharpString@@QEBAHXZ
?Level@LogEvent@@QEAAHXZ
?Level@LogEvent@@QEAAXH@Z
?LineWrapper@HPP@@QEAAHAEAVimage2D@@000M@Z
?Mask@HPP@@QEAAHAEAVimage2D@@0F@Z
?MceDecomp@HPP@@QEAAHPEAUmem_2d@@0AEBU2@AEBUMceParams@@@Z
?MceDecomp@HPP@@QEAAHPEAUmem_2d@@AEBU2@AEBUMceParams@@@Z
?MceEnh@HPP@@QEAAHAEAUmem_2d@@AEBU2@PEAV?$xml_node@D@rapidxml@@@Z
?MceEnh@HPP@@QEAAHAEAUmem_2d@@AEBU2@PEAV?$xml_node@D@rapidxml@@PEBUBreastRoi@@@Z
?MceGetSubx0@HPP@@QEAAXPEAHHHH@Z
?MceParseXml@HPP@@QEAAHAEAUMceParams@@PEAV?$xml_node@D@rapidxml@@@Z
?MceRecon@HPP@@QEAAHAEAUmem_2d@@PEBU2@1AEBUMceParams@@@Z
?MceRecon@HPP@@QEAAHAEAUmem_2d@@PEBU2@AEBUMceParams@@@Z
?MceUpdateParaForPce@HPP@@QEAAXAEAUMceParams@@PEBUBreastRoi@@H@Z
?MeanStd@HPP@@QEAAXAEAVimage2D@@0PEAM1@Z
?MeanStdVol@HPP@@QEAAXAEAV?$vector@Vimage2D@@V?$allocator@Vimage2D@@@std@@@std@@0PEAM1@Z
?MedianPlus@HPP@@QEAAXAEAVimage2D@@0PEAF@Z
?MultC@HPP@@QEAAHAEAVimage2D@@M@Z
?Otsu@HPP@@QEAAHPEAHHH0@Z
?RawToLog@HPP@@QEAAHAEAVimage2D@@0@Z
?Resize@HPP@@QEAAHAEAVimage2D@@0HW4INTERP_MODE@@@Z
?Resize@HPP@@QEAAHAEAVimage2D@@0W4INTERP_MODE@@@Z
?Rotate@HPP@@QEAAHAEAVimage2D@@W4ROTATION@@@Z
?SkinDistWrapper@HPP@@QEAAHAEAVimage2D@@0@Z
?Subtract@HPP@@QEAAHAEAVimage2D@@0@Z
?Time@LogEvent@@QEAA_KXZ
?hppver@@YAXPEADH@Z
Sections
.text Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
RT_CODE Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 647KB - Virtual size: 646KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nv_fatb Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nvFatBi Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ