decrypt_WannaCryFake[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

decrypt_WannaCryFake.exe
Size

889KB
MD5

ca57530243c381d9154b22cea2b3ec68
SHA1

72dbcd84d9e26085b89c674397d8f97238d846d1
SHA256

91711348506ee7d327f16060d3256ce845474065a36b1b624ce390e0109fcea5
SHA512

0580b7f3454cea4fa54d23587c39c8713b060149b2e65bcef874bb0050a961256ce9db7b997d0ee3e98582151c8227a5370a1c6842b4e978a540bf9bb2461920
SSDEEP

24576:lfuESZ2xVLTpHR52hfZJCYRVFe7b8MKHhSiOTr7pD9d9gGT:lmEhxlpx52pZJPVOKNOfVdb

Score

1^/10

Malware Config

Signatures

Files

decrypt_WannaCryFake.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

82:4d:35:69:1d:a5:57:1a:70:20:0e:2f:67:ef:ca:f3
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/06/2019, 00:00

Not After

24/06/2022, 23:59

Subject

SERIALNUMBER=5377101,CN=Emsisoft Ltd,O=Emsisoft Ltd,POSTALCODE=7010,STREET=315a Hardy Street,L=Nelson,ST=NSN,C=NZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024e5a

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27/05/2021, 09:55

Not After

28/06/2032, 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

97:2d:1b:b0:7d:4f:22:28:8f:4f:6c:0d:ca:c7:e2:b0:52:91:34:87:92:9c:c6:95:5f:30:fe:e1:10:f4:7c:52
Signer

Actual PE Digest

97:2d:1b:b0:7d:4f:22:28:8f:4f:6c:0d:ca:c7:e2:b0:52:91:34:87:92:9c:c6:95:5f:30:fe:e1:10:f4:7c:52

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Buildserver\agent\_work\40\s\DotNet\WannaCryFake\obj\Release\decrypt_WannaCryFake.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 841KB - Virtual size: 840KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

82:4d:35:69:1d:a5:57:1a:70:20:0e:2f:67:ef:ca:f3Certificate

Extended Key Usages

Key Usages

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9fCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

97:2d:1b:b0:7d:4f:22:28:8f:4f:6c:0d:ca:c7:e2:b0:52:91:34:87:92:9c:c6:95:5f:30:fe:e1:10:f4:7c:52Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 841KB - Virtual size: 840KB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 512B - Virtual size: 12B

82:4d:35:69:1d:a5:57:1a:70:20:0e:2f:67:ef:ca:f3
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

97:2d:1b:b0:7d:4f:22:28:8f:4f:6c:0d:ca:c7:e2:b0:52:91:34:87:92:9c:c6:95:5f:30:fe:e1:10:f4:7c:52
Signer

.text
Size: 841KB - Virtual size: 840KB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 512B - Virtual size: 12B