2024-07-04_b795f0e98061fb71e838fba912547d26_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-07-04_b795f0e98061fb71e838fba912547d26_ryuk
Size

262KB
MD5

b795f0e98061fb71e838fba912547d26
SHA1

ef50bd8d3fca931752dc98c38bb9f15b8f784351
SHA256

c87f6386fe7e71b23af4313e16fe03977d05569537f65aff5983a2ca624a74d5
SHA512

1e76b252141a4eeda7399b0795bd2a8a7f6ea726c0d0f1c52be65ab6efffc709f36831280fedcb17157ddac569e6b43c0dac0916ebe093999d020a9acbfca41c
SSDEEP

6144:+/m1FJMSFCngvohFqMSnDVM0sj/4aGwFy8effJaSutlB:+O1FhC0CFI7A4ncL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-04_b795f0e98061fb71e838fba912547d26_ryuk

Files

2024-07-04_b795f0e98061fb71e838fba912547d26_ryuk
.exe windows:6 windows x64 arch:x64

5bb5a33daf99843be4a441ef31affb9e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\Project\Git\NanoBoyAdvance\nanoboyadvance\x64\Release\nanoboyadvance.pdb

Imports

sdl

SDL_FreeSurface
SDL_SetVideoMode
SDL_PollEvent
SDL_Flip
SDL_GetKeyState
SDL_Quit
SDL_WM_SetCaption
SDL_GetError
SDL_Init

kernel32

SetEndOfFile
HeapSize
CreateFileW
ReadConsoleW
WriteConsoleW
SetStdHandle
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
GetProcessHeap
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
FindClose
FindFirstFileExA
FindNextFileA

advapi32

SystemFunction036

Sections

.text
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5bb5a33daf99843be4a441ef31affb9e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

sdl

kernel32

advapi32

Sections

.text Size: 166KB - Virtual size: 165KB

.rdata Size: 76KB - Virtual size: 75KB

.data Size: 5KB - Virtual size: 11KB

.pdata Size: 9KB - Virtual size: 9KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 166KB - Virtual size: 165KB

.rdata
Size: 76KB - Virtual size: 75KB

.data
Size: 5KB - Virtual size: 11KB

.pdata
Size: 9KB - Virtual size: 9KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 3KB