X:\采集卡\test_gige\GigEDriver\Bin\Win\Installer\drvinst_x64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-11_629523f66a42dfb90e659f194cbf4db4_ryuk.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-11_629523f66a42dfb90e659f194cbf4db4_ryuk.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-11_629523f66a42dfb90e659f194cbf4db4_ryuk
-
Size
198KB
-
MD5
629523f66a42dfb90e659f194cbf4db4
-
SHA1
604ac513e69946f5f40e0da2e27fb08533f43503
-
SHA256
4f7096f852ac66d55bbbd94ae60baf6fdcfe4608fa0693f81c333015c677634e
-
SHA512
e7f04b1f70aa8ff0e223d6d4752db4bec1cdea59045817f4bdf7a23721ca5578938acd10cfcb9116468bf9cfe969a10b1458456b81dff5ed7679bc77f2afaa3e
-
SSDEEP
3072:rgBL/oX5LSJYVETSa4WBsYvmYBWB0R+A8UFIFY6YDVb25R8K6L6l11Ak18Q:rgBb6iYVE54WBsUpY3UaaadaCD8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-07-11_629523f66a42dfb90e659f194cbf4db4_ryuk
Files
-
2024-07-11_629523f66a42dfb90e659f194cbf4db4_ryuk.exe windows:6 windows x64 arch:x64
d186a5cd6e2e29958ef5eb876dedbfbc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
difxapi
DriverPackageUninstallW
DriverPackageInstallW
DIFXAPISetLogCallbackW
setupapi
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupCloseInfFile
SetupUninstallOEMInfW
SetupDiGetINFClassW
SetupCopyOEMInfW
SetupDiDestroyDeviceInfoList
SetupDiCreateDeviceInfoW
SetupDiOpenDevRegKey
SetupDiSetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiCreateDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiRemoveDevice
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdW
SetupDiClassGuidsFromNameW
SetupDiGetDeviceInfoListDetailW
SetupDiGetClassDevsExW
SetupDiGetDeviceInstallParamsW
CM_Get_Device_ID_ExW
SetupDiClassGuidsFromNameExW
SetupGetFieldCount
SetupFindFirstLineW
SetupOpenInfFileW
SetupGetStringFieldW
SetupFindNextLine
SetupDiCallClassInstaller
kernel32
GetACP
GetCommandLineW
GetCommandLineA
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
WriteFile
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
FindFirstFileW
GetFullPathNameW
FindNextFileW
GetCurrentProcess
TerminateProcess
GetModuleFileNameW
FindClose
GetSystemDirectoryW
GetWindowsDirectoryW
GetLastError
lstrlenW
Sleep
GetVersionExW
CloseHandle
GetSystemInfo
LocalFree
FormatMessageA
LoadLibraryW
GetProcAddress
VerSetConditionMask
VerifyVersionInfoW
CancelIo
VerifyVersionInfoA
HeapFree
VirtualFree
DeviceIoControl
VirtualAlloc
LeaveCriticalSection
InitializeCriticalSection
QueryDosDeviceA
WaitForSingleObject
GetModuleHandleA
CreateFileA
ResetEvent
GetOverlappedResult
DeleteCriticalSection
CreateEventA
WriteConsoleW
SetFilePointerEx
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
EnterCriticalSection
CreateFileW
ExitThread
CreateThread
SetLastError
HeapAlloc
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwindEx
FindFirstFileExW
GetFileType
RaiseException
LCMapStringW
CompareStringW
EncodePointer
RtlPcToFileHeader
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetStringTypeW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
QueryPerformanceCounter
user32
UnregisterClassA
wsprintfW
UnregisterDeviceNotification
SendMessageA
TranslateMessage
GetMessageA
DispatchMessageA
advapi32
RegSetValueExW
RegQueryValueExW
RegEnumValueW
RegisterEventSourceA
DeregisterEventSource
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
ReportEventA
RegOpenKeyExW
ole32
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoInitialize
CoTaskMemFree
shlwapi
StrToIntW
PathAppendW
newdev
DiInstallDevice
UpdateDriverForPlugAndPlayDevicesW
msports
ComDBClose
ComDBOpen
ComDBReleasePort
ComDBClaimPort
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Exports
Exports
PCIE_CL_clearFrameBuffer
PCIE_CL_closeDevice
PCIE_CL_getBuffer
PCIE_CL_getDeviceID
PCIE_CL_getDeviceInfo
PCIE_CL_getDriverVersion
PCIE_CL_getNumDevices
PCIE_CL_getStreamStatistics
PCIE_CL_getVersion
PCIE_CL_openDevice
PCIE_CL_queueBuffer
PCIE_CL_readRegister
PCIE_CL_resetStreamStatistics
PCIE_CL_setEventCallback
PCIE_CL_softTrigger
PCIE_CL_startStream
PCIE_CL_stopStream
PCIE_CL_writeRegister
Sections
.text Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 240B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ