E:\code\C#\WannaCrydemo\obj\Debug\WannaCrydemo.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d103b20fa13c87e498887db5bc54d0a69829bdbe54772e9ea621a9902122125d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d103b20fa13c87e498887db5bc54d0a69829bdbe54772e9ea621a9902122125d.exe
Resource
win10v2004-20231222-en
General
-
Target
d103b20fa13c87e498887db5bc54d0a69829bdbe54772e9ea621a9902122125d.zip
-
Size
336KB
-
MD5
4a006938f5ed2622a042b827bbc77b3b
-
SHA1
4cb2c79219a6cd180d0e983e99a15bb1c5a1919a
-
SHA256
46dd826944b8652fe2cd4c418f18f55317cc4362b398be22af27f01def5730c7
-
SHA512
9bf841baaf6a7fbc423c6cc7adc68a05b4f64a4b4ac5cd94e9784bbe3818e51d89b70249d520dc837f21de915603b053aef9d6e8c78a162a8a2b6db78c7e87cd
-
SSDEEP
6144:nEEdvLdyvXQWBZZedQ8YdmdfbxsFa/Y4E7BTKEB7n8czpET7T9fp4GdGVyx:nEEdvLdxWBCQ5yOFa/27BWEB7npEJhQG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d103b20fa13c87e498887db5bc54d0a69829bdbe54772e9ea621a9902122125d.exe
Files
-
d103b20fa13c87e498887db5bc54d0a69829bdbe54772e9ea621a9902122125d.zip.zip
Password: infected
-
d103b20fa13c87e498887db5bc54d0a69829bdbe54772e9ea621a9902122125d.exe.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 424KB - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ