C:\dvs\p4\build\sw\devrel\Playpen\yyao\VRBench\VR-FCAT\FVSDK_rel_1_0\Symbols\FCAT_DT_Capture_x64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-24_11df19ab381260b07de00101d388301e_ryuk.exe
Resource
win7-20240708-en
General
-
Target
2024-08-24_11df19ab381260b07de00101d388301e_ryuk
-
Size
1.6MB
-
MD5
11df19ab381260b07de00101d388301e
-
SHA1
78de4526c6fa003ee3aa0770f47dac718bbf0767
-
SHA256
3485ac54c9272917c1c93ed6da2d828d809983882e2be662436faa57735d1435
-
SHA512
14f50855eea36615a8292593b5fc6c8c81e65cc235fa24f2f7326cd4a9e5932a4100e09530a53708ca01e1afadb75a01e1955f717f9add60c632cde044ba0d64
-
SSDEEP
24576:7NBZigE3mM/SWWsbT/cq3fNuGGC5SYC8l43+pCzLDYVCuc+VBZgP:RBIgE2M/yk/dha3+p8DYRnuP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-24_11df19ab381260b07de00101d388301e_ryuk
Files
-
2024-08-24_11df19ab381260b07de00101d388301e_ryuk.exe windows:6 windows x64 arch:x64
517d22893efa193cd0a694bc7475d838
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetModuleFileNameA
SetLastError
GetFullPathNameW
GetModuleFileNameW
LocalAlloc
CreateFileW
GetFileAttributesW
lstrcmpA
GetSystemDirectoryW
GetLastError
OutputDebugStringW
FileTimeToSystemTime
CloseHandle
GetProcAddress
LocalFree
VerSetConditionMask
CreateProcessW
GetModuleHandleW
FreeLibrary
VerifyVersionInfoW
LoadLibraryExW
SetConsoleCtrlHandler
EnterCriticalSection
GetCommandLineW
SetConsoleTitleA
RegisterWaitForSingleObject
UnregisterWait
LeaveCriticalSection
InitializeCriticalSection
CreateEventW
Sleep
AttachConsole
SetEvent
QueryPerformanceFrequency
DeleteCriticalSection
GetCurrentProcessId
lstrcmpiW
QueryPerformanceCounter
AllocConsole
GetTickCount
HeapFree
SetDefaultDllDirectories
OutputDebugStringA
CreateMutexW
WaitForSingleObject
GetCurrentDirectoryA
UnmapViewOfFile
CreateThread
HeapAlloc
CreateFileMappingA
GetProcessHeap
lstrcpyW
OpenFileMappingA
MapViewOfFile
MulDiv
WritePrivateProfileStringW
GetCurrentProcess
GetPrivateProfileIntW
LoadLibraryExA
GetPrivateProfileStringW
WaitForMultipleObjects
OpenProcess
DeleteFileW
MoveFileExW
CreateEventA
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualAlloc
GetVersionExW
GetModuleHandleA
GetThreadTimes
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TryEnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
DuplicateHandle
GetCurrentThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
RtlPcToFileHeader
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetConsoleCP
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
ExitThread
FreeLibraryAndExitThread
HeapReAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleMode
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleInputW
PeekConsoleInputA
ReadConsoleW
GetTimeZoneInformation
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
ReadFile
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
shlwapi
PathFileExistsW
bcrypt
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptDestroyKey
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptFinishHash
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptVerifySignature
Sections
.text Size: 619KB - Virtual size: 619KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 217KB - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 153KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 572KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE