Behavioral task
behavioral1
Sample
2024-01-27_9ff9e2eb4f1d5405de3a35c8a5c25366_wannacry.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-27_9ff9e2eb4f1d5405de3a35c8a5c25366_wannacry.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-27_9ff9e2eb4f1d5405de3a35c8a5c25366_wannacry
-
Size
305KB
-
MD5
9ff9e2eb4f1d5405de3a35c8a5c25366
-
SHA1
25db133181d55e92d6a29192a49e6eb2c060bd69
-
SHA256
f78ebe96629ef0bf102ddefe4c2f08ae66c76a3d9c4a82cc6e25dd306d6ce99d
-
SHA512
eac4c150331039d96af9ca4d258ce3fa1a8c4f621b8d8e59574d4dea7bee9de6ed4827460d6e849b85037feacabe9d39131b5d0423854955db7785780fc8a3a8
-
SSDEEP
6144:ZZr9SlPdZtmguIwS4wjOamU98/FUMmoMmt:YlZtmgunSNj2A8/eMLHt
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-27_9ff9e2eb4f1d5405de3a35c8a5c25366_wannacry
Files
-
2024-01-27_9ff9e2eb4f1d5405de3a35c8a5c25366_wannacry.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 247KB - Virtual size: 246KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ