2024-10-18_b88b303c49845396bf49303a6de132a4_ryuk

Sharing

Copy URL

Twitter E-mail

General

Target

2024-10-18_b88b303c49845396bf49303a6de132a4_ryuk
Size

277KB
MD5

b88b303c49845396bf49303a6de132a4
SHA1

d28032c0af3d036235bfcbb70de5c4d2dc9fdb75
SHA256

f0a9090510a2abda6d15d38a09903f6a76d7e9bbd5b35cb9a6b887abc92b24bb
SHA512

14e05a4afa26fdee7cd383f0a3a9d11672f3d1257b6be5f1fc4c43a4615aff0be2055f15302614f09915a304b15655dd5bdab8dd43e3d9e4f6b21bd543b37108
SSDEEP

3072:q8HtV6EMVKTl5lyevZxBIXcUHeQC2mCoNsi6ZWpIn+XswhHc6h0EreaRvAg0FujW:q8HOEMonBsOu1IBJhHc0AOxiK9FrW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-18_b88b303c49845396bf49303a6de132a4_ryuk

Files

2024-10-18_b88b303c49845396bf49303a6de132a4_ryuk
.exe windows:5 windows x86 arch:x86

07d6174e6d744cee87a3699a28df2a5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetModuleFileNameW
SetFilePointer
SetEndOfFile
FindClose
CreateFileW
GetVersionExW
Sleep
LoadLibraryA
WriteFile
DeleteFileW
CloseHandle
GetProcAddress
SetFilePointerEx
MoveFileExW
GetFileSize
GetDriveTypeW
HeapSize
ReadConsoleW
GetCurrentProcess
FindNextFileW
VirtualFree
GetFileSizeEx
FindFirstFileW
GetLogicalDrives
GlobalAlloc
MultiByteToWideChar
WideCharToMultiByte
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
GetLastError
FreeLibrary
LoadLibraryExW
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetProcessHeap
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
ReadFile

user32

SendMessageW

advapi32

SystemFunction036
CryptDestroyKey
CryptAcquireContextW
CryptDecrypt
RegOpenKeyExA
CryptImportKey
RegDeleteValueA

Sections

.text
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07d6174e6d744cee87a3699a28df2a5e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 193KB - Virtual size: 192KB

.rdata Size: 64KB - Virtual size: 64KB

.data Size: 4KB - Virtual size: 27KB

.gfids Size: 1KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 193KB - Virtual size: 192KB

.rdata
Size: 64KB - Virtual size: 64KB

.data
Size: 4KB - Virtual size: 27KB

.gfids
Size: 1KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.reloc
Size: 11KB - Virtual size: 10KB