2024-10-18_d3db6c4ed51bf3ec82b64817fc5fd14e_ryuk | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-18_d3db6c4ed51bf3ec82b64817fc5fd14e_ryuk
Size

636KB
MD5

d3db6c4ed51bf3ec82b64817fc5fd14e
SHA1

53c1c85e06cd78bc7a4c5af0b6b5ec58c96f70b5
SHA256

70f567dbc9c568bcfe845912eaa4863a0550ec6f1e6967a2058a5192d3be720d
SHA512

760ccd3859ab8f18743b13489c1c88d9ab6b789c4f7b5a2d97c871f4663c6cd64ccf5f66656a610887076ae6ad93a9219339088fd45752e0503c8da517b1c8f8
SSDEEP

12288:w0TE3neTuWLIJfrBE6VJSRf1E5dxFvrb36k5hKXMCZyJmgMoLwbB/H:L43cL0trbvhKXZEmgMqwh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-18_d3db6c4ed51bf3ec82b64817fc5fd14e_ryuk

Files

2024-10-18_d3db6c4ed51bf3ec82b64817fc5fd14e_ryuk
.exe windows:5 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 405KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ