P:\Target\x64\ship\setupexe\x-none\deployca\odeploy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-23_017c009465a32a70caf637dcece8f846_ryuk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-01-23_017c009465a32a70caf637dcece8f846_ryuk.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-23_017c009465a32a70caf637dcece8f846_ryuk
-
Size
691KB
-
MD5
017c009465a32a70caf637dcece8f846
-
SHA1
65149c3ba7f36d88ceb36fa6fc05b5011d4351c4
-
SHA256
45a4a550b3fa0f168adec065f417f57d17ab688a4482e97bd7d1089b9cabf654
-
SHA512
f6a4debbeba6e1ffe612519b2637d75ba5cb802bd054d35c61d4c39af37b624d699647f61f11e7bafbe1ff378cfbba36d37d6abb3d3056c21840c0d09a5a0954
-
SSDEEP
6144:JN8j0FvB/e90/HXks9BJ6zzFUT0LL0/DlVIPmYsE09xJTtP7/F30F3PM:JN8jg/fXks9BJSzEM2VIPmNf9Mlk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-01-23_017c009465a32a70caf637dcece8f846_ryuk
Files
-
2025-01-23_017c009465a32a70caf637dcece8f846_ryuk.exe windows:6 windows x64 arch:x64
b4fa0b0b2c3815d094839973734b2433
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
RegCloseKey
RegCreateKeyExW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
RegOpenKeyExW
CreateProcessAsUserW
RevertToSelf
ImpersonateLoggedOnUser
EventRegister
EventUnregister
EventWriteTransfer
EventWrite
AllocateAndInitializeSid
FreeSid
kernel32
CreateWaitableTimerW
GetModuleFileNameW
GetTickCount
GetSystemTimeAsFileTime
SleepEx
CloseHandle
FindFirstFileExW
FindClose
CompareFileTime
ExpandEnvironmentStringsW
CompareStringEx
IsWow64Process
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
FlsFree
FlsAlloc
GetLastError
CreateFileW
GetFileType
SetFilePointerEx
WriteFile
SetLastError
FlsGetValue
FlsSetValue
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
FileTimeToSystemTime
GetCurrentProcessId
MultiByteToWideChar
WideCharToMultiByte
IsValidCodePage
GetSystemTime
TerminateProcess
CreateProcessW
GetTickCount64
GetModuleFileNameA
GetShortPathNameA
GetTempPathW
CreateDirectoryW
DeleteFileW
GetFileAttributesExW
SetFileAttributesW
EnterCriticalSection
LeaveCriticalSection
FormatMessageW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
QueryPerformanceCounter
WaitForSingleObjectEx
Sleep
GetCurrentThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetProcAddress
TryEnterCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
SetEvent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
FreeLibrary
LoadLibraryExW
InterlockedPushEntrySList
GetThreadTimes
VirtualProtect
InterlockedPopEntrySList
QueryDepthSList
HeapSize
GetModuleHandleExW
HeapAlloc
HeapFree
GetStdHandle
ExitProcess
GetCommandLineA
GetCommandLineW
GetACP
GetStringTypeW
CompareStringW
LCMapStringW
HeapReAlloc
GetProcessHeap
FindFirstFileExA
FindNextFileA
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
WriteConsoleW
SetErrorMode
GlobalFree
GetExitCodeProcess
GetPriorityClass
CreateEventExW
OpenMutexW
GetSystemInfo
VirtualQuery
LoadLibraryExA
LocalFree
DecodePointer
ole32
CoTaskMemFree
StringFromIID
CoInitializeEx
CoUninitialize
Sections
.text Size: 244KB - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 182KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ