Behavioral task
behavioral1
Sample
2024-04-18_8f2fc5dfe5bad0015842dbe92da023df_wannacry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-18_8f2fc5dfe5bad0015842dbe92da023df_wannacry.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-18_8f2fc5dfe5bad0015842dbe92da023df_wannacry
-
Size
128KB
-
MD5
8f2fc5dfe5bad0015842dbe92da023df
-
SHA1
67bc07193daa7d1682440657be9019f456a6ae6a
-
SHA256
e32188f9dfa8b7d36a95edc45a56b39311fefd1df28af00a7e56b42e00557321
-
SHA512
425de873f2cc95097ba7017b54a59905e2fc0af90a2d87f8e2ce04085350ae87e8223486ccaa6d50aba5e46a9085bda38b3099761d9f4d8869c6af4bad6b1b9c
-
SSDEEP
3072:voTyX1r9maVrm4vCiipjEC7AXRTZfkTF8qmRHXHC56POTLe:Blr9maHajEQYRV4FkXHvG3
Malware Config
Signatures
-
Chaos Ransomware 1 IoCs
resource yara_rule sample family_chaos -
Chaos family
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENRansomware -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-18_8f2fc5dfe5bad0015842dbe92da023df_wannacry
Files
-
2024-04-18_8f2fc5dfe5bad0015842dbe92da023df_wannacry.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ