C:\dvs\p4\build\sw\rel\gpu_drv\r560\r560_88\drivers\ngx\updater\_out\wddm2_amd64_release\nvngx_update.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_5e84231a6b85a98a60adfe81ef33df40_ryuk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-05_5e84231a6b85a98a60adfe81ef33df40_ryuk.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-05_5e84231a6b85a98a60adfe81ef33df40_ryuk
-
Size
1.6MB
-
MD5
5e84231a6b85a98a60adfe81ef33df40
-
SHA1
75bde347acd20974478187cb00501b726a552a92
-
SHA256
538f39ea7c05bd392b823af25253437aa85791090973d874aa117a7752fa6f71
-
SHA512
f967bdbf162f695b407b8f891c1e8e1b4fdf60079e512c2be8f01890210821728d7deb27c2673a55e1e1602d344f998e4503a508021e063d53e0d2482509acd4
-
SSDEEP
24576:bHBh4+7IqKbWxHEW6wu3mgk7sXBonJpuy0Jd7ndAXckAfYLH8AcevDN0FImbwQuE:g+tKbWxHUwsKayYnCXpAQgAT76sQuE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-05_5e84231a6b85a98a60adfe81ef33df40_ryuk
Files
-
2024-09-05_5e84231a6b85a98a60adfe81ef33df40_ryuk.exe windows:6 windows x64 arch:x64
67961047cde0daf684e70a04db3465a5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
VerSetConditionMask
GetModuleHandleW
FreeLibrary
VerifyVersionInfoW
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringW
DeleteCriticalSection
LoadLibraryW
MultiByteToWideChar
LocalFree
FormatMessageA
ReadFile
SetFilePointer
CreateFileA
GetProcAddress
GetSystemDirectoryW
GetFileAttributesW
CreateFileW
LocalAlloc
GetModuleFileNameW
WriteConsoleW
FreeEnvironmentStringsW
GetFullPathNameW
SetLastError
GetModuleFileNameA
AllocConsole
CreateEventA
CreateThread
FreeConsole
OutputDebugStringA
WriteFile
GetStdHandle
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetProcessHeap
SetEndOfFile
SetConsoleTitleA
MoveFileExW
DeleteFileW
SetFileAttributesW
FindClose
RemoveDirectoryW
FindNextFileW
FindFirstFileW
CloseHandle
SetEvent
GetLastError
Sleep
ReleaseMutex
WaitForSingleObject
CreateMutexA
WideCharToMultiByte
OpenEventA
GetFileAttributesExW
GetTimeZoneInformation
SetStdHandle
HeapSize
SetFilePointerEx
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
GetCommandLineW
GetCommandLineA
HeapReAlloc
HeapFree
HeapAlloc
ExitThread
GetCurrentDirectoryW
SetEnvironmentVariableA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FormatMessageW
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionEx
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
SleepEx
GetFileSizeEx
TryEnterCriticalSection
GetCurrentThreadId
EncodePointer
DecodePointer
GetCPInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RtlPcToFileHeader
RaiseException
RtlUnwindEx
ExitProcess
GetModuleHandleExW
CreateDirectoryW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
shlwapi
PathFileExistsW
advapi32
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
InitializeSecurityDescriptor
ConvertStringSidToSidW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclA
SetSecurityDescriptorDacl
CryptDestroyHash
shell32
SHCreateDirectoryExW
SHGetKnownFolderPath
ole32
CoTaskMemFree
bcrypt
BCryptGenRandom
normaliz
IdnToAscii
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
ws2_32
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
WSASetLastError
ntohs
WSAGetLastError
htonl
__WSAFDIsSet
connect
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
listen
recv
select
accept
WSAWaitForMultipleEvents
bind
getaddrinfo
freeaddrinfo
getpeername
getsockname
ioctlsocket
closesocket
Sections
.text Size: 789KB - Virtual size: 789KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 572KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE