C:\dvs\p4\build\sw\rel\gpu_drv\r530\r530_00\drivers\ui\SedonaServers\WorkStationServer\NvGpuUtilization\NvGpuUtilization\x64\Release\bin\NvGpuUtilization.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-29_3db295310dda881f8e6a143d1aa7bb7b_ryuk.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-29_3db295310dda881f8e6a143d1aa7bb7b_ryuk.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-29_3db295310dda881f8e6a143d1aa7bb7b_ryuk
-
Size
4.3MB
-
MD5
3db295310dda881f8e6a143d1aa7bb7b
-
SHA1
703395e2630b0c635dc4d30847503ff4364d23f6
-
SHA256
567dbd42549f6f85aef2059b5066ff43ffb7cc9facacd46555016e561d1f5224
-
SHA512
f8e9f011df4da28097d0ad95beef614532a309f7da84d6f3bed624a9c9f5746f6869c92df31b2636367bda6aa4a223bbe9218cd891b0373c2c7eccc7e2ea254a
-
SSDEEP
49152:xL95k1kVAWrCsdTFg/R9Cfw4iUwlJsr1riCxb3NJm/VTlvSXrZs+IPjOLs+IPjOC:xHkWVrdTWtJEpjNJiVsFUYU+R6fzB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-29_3db295310dda881f8e6a143d1aa7bb7b_ryuk
Files
-
2024-08-29_3db295310dda881f8e6a143d1aa7bb7b_ryuk.exe windows:6 windows x64 arch:x64
0614034a1d5741459fbc3ee802c933c8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetFileAttributesExW
GetFileTime
SystemTimeToTzSpecificLocalTime
OutputDebugStringA
EncodePointer
GlobalDeleteAtom
GlobalAddAtomW
GlobalFindAtomW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
SetThreadPriority
GlobalGetAtomNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
FindClose
FindFirstFileW
FlushFileBuffers
GetFileSize
GetVolumeInformationW
LockFile
ReadFile
SetEndOfFile
SetFilePointer
UnlockFile
DuplicateHandle
GlobalFlags
CompareStringW
lstrcpyW
GetCurrentDirectoryW
GetWindowsDirectoryW
GetTempFileNameW
GetTempPathW
GetTickCount
GetProfileIntW
SearchPathW
GetUserDefaultLCID
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetStringTypeW
LCMapStringW
GetCPInfo
FormatMessageA
FindNextFileW
SetFilePointerEx
GetModuleHandleA
FileTimeToLocalFileTime
RtlUnwindEx
ExitThread
FreeLibraryAndExitThread
HeapQueryInformation
GetCommandLineA
GetCommandLineW
VirtualAlloc
SetStdHandle
GetFileType
ExitProcess
GetStdHandle
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
ReadConsoleW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
ResumeThread
CreateThread
CreateEventW
HeapFree
ResetEvent
GetSystemDefaultLCID
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
lstrcmpiW
lstrcmpW
FormatMessageW
MulDiv
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleHandleExW
FreeResource
FindResourceExW
GetVersionExW
GetSystemTimeAsFileTime
ProcessIdToSessionId
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
WaitForSingleObjectEx
WaitForSingleObject
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
OutputDebugStringW
WriteFile
GetFileSizeEx
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
CopyFileW
GlobalSize
RtlPcToFileHeader
FileTimeToSystemTime
VerifyVersionInfoW
lstrcmpA
LocalFree
LocalAlloc
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
GetModuleFileNameA
GetSystemDirectoryW
SetLastError
CloseHandle
GetFullPathNameW
GetFileAttributesW
CreateFileW
VerSetConditionMask
GetProcAddress
FreeLibrary
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
gdi32
MoveToEx
PolylineTo
DeleteObject
GetStockObject
SetDCBrushColor
SetDCPenColor
Rectangle
LineTo
SetBkColor
SetTextColor
TextOutW
CreateFontW
CreateSolidBrush
SetBkMode
SelectObject
ExtCreatePen
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
CreateRectRgnIndirect
PatBlt
SetRectRgn
DPtoLP
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
GetTextFaceW
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
CreateRoundRectRgn
CreateCompatibleBitmap
OffsetRgn
GetRgnBox
SetViewportExtEx
ExtTextOutW
SetTextAlign
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SelectPalette
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateBitmap
CreateDCW
CopyMetaFileW
CreateCompatibleDC
BitBlt
DeleteDC
GetObjectW
GetTextMetricsW
GetTextExtentPoint32W
GetDeviceCaps
CreateFontIndirectW
LPtoDP
oleaut32
LoadTypeLi
VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
SysAllocString
oleacc
CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject
uxtheme
OpenThemeData
DrawThemeParentBackground
IsThemeBackgroundPartiallyTransparent
DrawThemeText
GetThemeSysColor
GetThemePartSize
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
IsAppThemed
CloseThemeData
gdiplus
GdipDrawImageRectI
GdipAlloc
GdipFree
GdiplusStartup
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
wtsapi32
WTSQueryUserToken
winmm
PlaySoundW
shlwapi
PathIsUNCW
StrFormatKBSizeW
PathFindExtensionW
PathStripToRootW
PathRemoveFileSpecW
PathFindFileNameW
msimg32
TransparentBlt
AlphaBlend
imm32
ImmGetContext
ImmGetOpenStatus
ImmReleaseContext
winspool.drv
ClosePrinter
DocumentPropertiesW
OpenPrinterW
advapi32
ImpersonateLoggedOnUser
RevertToSelf
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteKeyW
ole32
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CoInitializeEx
CoInitialize
CoUninitialize
CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateInstance
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 726KB - Virtual size: 725KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 41KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 135KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
.data
-
.didat
-
.pdata
-
.rdata
-
.reloc
-
.rsrc/0/GROUP_ICON/103
-
.rsrc/0/ICON/1.ico
-
.rsrc/0/ICON/10.ico
-
.rsrc/0/ICON/11.ico
-
.rsrc/0/ICON/12.png
-
.rsrc/0/ICON/2.ico
-
.rsrc/0/ICON/3.ico
-
.rsrc/0/ICON/4.ico
-
.rsrc/0/ICON/8.ico
-
.rsrc/0/ICON/9.ico
-
.rsrc/1033/DIALOG/103
-
.rsrc/1033/DIALOG/105
-
.rsrc/1033/DIALOG/106
-
.rsrc/1033/DIALOG/111
-
.rsrc/1033/DIALOG/203
-
.rsrc/1033/DIALOG/205
-
.rsrc/1033/DIALOG/206
-
.rsrc/1033/DIALOG/211
-
.rsrc/1033/MANIFEST/1.xml
-
.rsrc/1033/version.txt
-
.rsrc/2052/version.txt
-
.text
-
.tls