C:\build.tc\agent\work\771734dc8677b927\release\lib\x64_Release_MT_vs2015\LMISupportM64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-29_f0f74b30534c9bc7c269b5dbdaca4bff_ryuk.exe
Resource
win7-20240708-en
General
-
Target
2024-08-29_f0f74b30534c9bc7c269b5dbdaca4bff_ryuk
-
Size
1.5MB
-
MD5
f0f74b30534c9bc7c269b5dbdaca4bff
-
SHA1
3df1404ae85dd0ec4905e0f69798f25872eccc80
-
SHA256
d29e5d1aee97e62937baf3d6948af20d6ac00727129277079be0a17db8d1f03e
-
SHA512
e6bf7dc3c0aeca1d816d7e1516342e689271147935ce628791a467dcea4ec08cd6db0d3c7f2a38bc9f8c98edf77d41baaccb818b34b6b3d6d105a574fd5f0638
-
SSDEEP
24576:ZFoa+ptP0my2vsqjnhMgeiCl7G0nehbGZpbD:Zea+ptPXXDmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-29_f0f74b30534c9bc7c269b5dbdaca4bff_ryuk
Files
-
2024-08-29_f0f74b30534c9bc7c269b5dbdaca4bff_ryuk.exe windows:6 windows x64 arch:x64
41f72046cc6b64a20f76648690ba605c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
LoadLibraryA
GetProcAddress
GetModuleFileNameA
FreeLibrary
GetCurrentDirectoryA
SetCurrentDirectoryA
OpenProcess
ExitProcess
GetCurrentProcessId
CloseHandle
WriteConsoleW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetProcessHeap
GetFileType
GetACP
GetStdHandle
GetModuleFileNameW
HeapReAlloc
HeapFree
HeapAlloc
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
GetLastError
SetLastError
RaiseException
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetErrorMode
GetCurrentProcess
GetVersion
GetModuleHandleA
GetCurrentThread
LocalFree
GetSystemTimeAsFileTime
GetTickCount
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
WaitForSingleObject
SetThreadPriority
ResumeThread
SetEvent
ResetEvent
ReleaseMutex
FindClose
FlushFileBuffers
GetFileSize
GetFileTime
ReadFile
SetFilePointer
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
WaitForMultipleObjects
CreateEventW
CreateThread
GetModuleHandleW
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
LoadLibraryW
IsWow64Process
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
LCMapStringW
GetCPInfo
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
user32
GetSystemMetrics
CharNextExA
RegisterWindowMessageW
PostThreadMessageW
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
PostQuitMessage
RegisterClassExW
CreateWindowExW
DestroyWindow
ShowWindow
DialogBoxParamW
EndDialog
SetTimer
KillTimer
LoadAcceleratorsW
TranslateAcceleratorW
UpdateWindow
BeginPaint
EndPaint
LoadCursorW
SetWindowLongPtrW
GetWindowLongPtrW
LoadIconW
SetLayeredWindowAttributes
CallWindowProcW
SendMessageW
ws2_32
closesocket
socket
WSACleanup
WSAStartup
version
VerQueryValueA
GetFileVersionInfoA
advapi32
RegCloseKey
OpenProcessToken
GetTokenInformation
OpenThreadToken
ConvertSidToStringSidW
RegQueryValueExW
RegCreateKeyExW
ole32
CoCreateGuid
CoInitialize
CoUninitialize
Sections
.text Size: 147KB - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 106KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE