2024-06-29_efee7b539af94050d086cfa3a5704413_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-29_efee7b539af94050d086cfa3a5704413_ryuk
Size

1.7MB
MD5

efee7b539af94050d086cfa3a5704413
SHA1

ad2179a45fac440de357849f7c612f7790573c58
SHA256

c1018e9fcdcfd262d9ee37f21a826e512b38365cd2330af1743875ef90e12949
SHA512

d00208fec118bf188419ec68bd27bc9642d45b546f8f070621ab3976ac947e45d81196941e66734b983fb6cadcc51212a56912c8cc1db585f4a4846c0d93f0d9
SSDEEP

24576:2pV93U8lTeCqRk3KWtLPnZ+U4212qbks3PEsiftXrHSSQd+0b7Wy:+U8lTetoKWtLPnZs21bkG3ifwc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-29_efee7b539af94050d086cfa3a5704413_ryuk

Files

2024-06-29_efee7b539af94050d086cfa3a5704413_ryuk
.exe windows:5 windows x64 arch:x64

bfc6b49fe557cd7173ca8d50a55fb6c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
CompareStringW
CopyFileW
CreateDirectoryW
CreateFileA
CreateFileW
CreateMutexW
CreatePipe
CreateProcessW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LocalFree
MoveFileW
MulDiv
MultiByteToWideChar
OpenProcess
PeekNamedPipe
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleW
ReadFile
RegisterWaitForSingleObject
RemoveDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetEndOfFile
SetEnvironmentVariableW
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SleepEx
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnregisterWait
VerSetConditionMask
VerifyVersionInfoA
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile

user32

AdjustWindowRectEx
BeginPaint
BringWindowToTop
CallWindowProcW
CharLowerW
CharUpperW
ClientToScreen
CloseClipboard
CreateAcceleratorTableW
CreateIconFromResource
CreateIconFromResourceEx
CreateWindowExW
DefFrameProcW
DefWindowProcW
DestroyAcceleratorTable
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageW
DrawFocusRect
DrawFrameControl
DrawStateW
DrawTextW
EnableWindow
EndPaint
EnumChildWindows
EnumPropsExW
EnumWindows
FillRect
FrameRect
GetActiveWindow
GetAsyncKeyState
GetClassNameW
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetDlgCtrlID
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyState
GetMenu
GetMessagePos
GetMessageW
GetParent
GetPropW
GetScrollPos
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetUpdateRect
GetWindow
GetWindowDC
GetWindowLongPtrW
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GetWindowThreadProcessId
InflateRect
IntersectRect
InvalidateRect
InvalidateRgn
IsChild
IsDialogMessageW
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadCursorW
LoadIconW
MapWindowPoints
MessageBoxW
MoveWindow
MsgWaitForMultipleObjects
OpenClipboard
PeekMessageW
PostMessageW
RedrawWindow
RegisterClassExW
RegisterClassW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemovePropW
ScreenToClient
SendMessageW
SetActiveWindow
SetCapture
SetClassLongPtrW
SetCursor
SetFocus
SetForegroundWindow
SetMenu
SetPropW
SetRect
SetScrollPos
SetTimer
SetWindowLongPtrW
SetWindowPos
SetWindowTextW
ShowWindow
SystemParametersInfoW
TrackPopupMenu
TranslateAcceleratorW
TranslateMessage
UnregisterClassW
UpdateWindow
ValidateRect

gdi32

BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateFontIndirectW
CreateFontW
CreatePatternBrush
CreatePen
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
DeleteObject
ExcludeClipRect
ExtSelectClipRgn
GetClipRgn
GetDIBits
GetDeviceCaps
GetObjectType
GetObjectW
GetStockObject
GetTextExtentPoint32W
LineTo
MoveToEx
OffsetViewportOrgEx
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetBrushOrgEx
SetPixel
SetStretchBltMode
SetTextColor
SetViewportOrgEx
StretchBlt
TextOutW

oleaut32

DispGetIDsOfNames
DispGetParam
SysAllocString
SysFreeString
VariantChangeType
VariantClear
VariantCopy
VariantInit

uxtheme

SetWindowTheme

atl

AtlAxGetHost

ole32

CoInitialize
OleInitialize
OleUninitialize
RevokeDragDrop

comctl32

ImageList_Add
ImageList_AddMasked
ImageList_Create
ImageList_Destroy
ImageList_GetIconSize
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
InitCommonControlsEx

shell32

ShellExecuteExW
Shell_NotifyIconW

ws2_32

WSACleanup
WSAGetLastError
WSAIoctl
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
select
send
setsockopt
socket

winmm

timeBeginPeriod

advapi32

CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptReleaseContext
GetUserNameW

shlwapi

PathMatchSpecW

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeleteMatrix
GdipDeletePath
GdipDeletePen
GdipDeleteStringFormat
GdipFree

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetNameStringA
CertOpenStore
CryptQueryObject
CryptStringToBinaryA

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 238KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bfc6b49fe557cd7173ca8d50a55fb6c4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

oleaut32

uxtheme

atl

ole32

comctl32

shell32

ws2_32

winmm

advapi32

shlwapi

gdiplus

crypt32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 264KB - Virtual size: 263KB

.data Size: 238KB - Virtual size: 261KB

.pdata Size: 38KB - Virtual size: 38KB

.gxfg Size: 11KB - Virtual size: 10KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 30KB - Virtual size: 29KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 264KB - Virtual size: 263KB

.data
Size: 238KB - Virtual size: 261KB

.pdata
Size: 38KB - Virtual size: 38KB

.gxfg
Size: 11KB - Virtual size: 10KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 30KB - Virtual size: 29KB

.reloc
Size: 3KB - Virtual size: 3KB