593a4b3fb31a25c433f4c04fe6a9bdacfc30771ac41e3f394b81b0a13f6e5df8

General

Target
593a4b3fb31a25c433f4c04fe6a9bdacfc30771ac41e3f394b81b0a13f6e5df8
Size 191KB
Sample240514-plkbysfe49
SHA256 593a4b3fb31a25c433f4c04fe6a9bdacfc30771ac41e3f394b81b0a13f6e5df8
MD5 04d2762c440097c67cef47fcba96ce3c
SHA1 6ecf78935809ea1699a9dd075b489ef27bd00c02
SHA512 c00118b7fb2ef8c386c49cb95fc0e0e9d39d90eb9b1cdd10145ce2bc5d99bb6361daf90b9b5e5de42464583c9ee864b29de5d87aaeb8f82f610342fc6fd13bfd
SSDEEP 3072:kNmj7C7mm4HynVpIDTLjbMQ40rDi9Lpnrq3TrWmb/wnLCJuPCx:MmjO7hNnLIvnb2qiJpn23TrWmDwnLCJT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Ransomware.WannaCrypt0r.v1.exe

File Explorer

593a4b3fb31a25c433f4c04fe6a9bdacfc30771ac41e3f394b81b0a13f6e5df8

.zip 191KB
Ransomware.WannaCrypt0r.v1.exe

.exe 224KB

593a4b3fb31a25c433f4c04fe6a9bdacfc30771ac41e3f394b81b0a13f6e5df8

SHA256 593a4b3fb31a25c433f4c04fe6a9bdacfc30771ac41e3f394b81b0a13f6e5df8
MD5 04d2762c440097c67cef47fcba96ce3c
SHA1 6ecf78935809ea1699a9dd075b489ef27bd00c02
SHA512 c00118b7fb2ef8c386c49cb95fc0e0e9d39d90eb9b1cdd10145ce2bc5d99bb6361daf90b9b5e5de42464583c9ee864b29de5d87aaeb8f82f610342fc6fd13bfd
SSDEEP 3072:kNmj7C7mm4HynVpIDTLjbMQ40rDi9Lpnrq3TrWmb/wnLCJuPCx:MmjO7hNnLIvnb2qiJpn23TrWmDwnLCJT
MD5 SHA1 SHA512 SSDEEP

Password

infected

Ransomware.WannaCrypt0r.v1.exe

IMPHASH e858a14f217810d78466806d95d7fceb
SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
MD5 5c7fb0927db37372da25f270708103a2
SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSizeEx CreateFileA InitializeCriticalSection DeleteCriticalSection GetFileSize LeaveCriticalSection EnterCriticalSection SizeofResource LockResource LoadResource FindResourceA SetErrorMode VirtualAlloc VirtualFree FreeLibrary HeapAlloc GetProcessHeap GetModuleHandleA SetLastError VirtualProtect IsBadReadPtr HeapFree SystemTimeToFileTime LocalFileTimeToFileTime CreateDirectoryA GetStartupInfoA ReadFile SetFilePointer WriteFile SetFileTime GetFileAttributesA GetCurrentDirectoryA SetCurrentDirectoryA GlobalAlloc LoadLibraryA GetProcAddress GlobalFree GetModuleFileNameA CloseHandle

user32

wsprintfA

advapi32

CryptDecrypt CryptDestroyKey CryptReleaseContext CryptImportKey CryptAcquireContextA

ws2_32

WSAStartup inet_addr WSACleanup

msvcrt

_controlfp __set_app_type __p__fmode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ??1type_info@@UAE@XZ __p__commode strcpy memset strlen memcpy __CxxFrameHandler ??3@YAXPAX@Z memcmp _except_handler3 _local_unwind2 ??2@YAPAXI@Z sscanf strcmp __p___argv __p___argc strrchr realloc _stricmp free malloc ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z _CxxThrowException calloc strcat _mbsstr

Sharing

General

Malware Config

Signatures

File Explorer

593a4b3fb31a25c433f4c04fe6a9bdacfc30771ac41e3f394b81b0a13f6e5df8

Ransomware.WannaCrypt0r.v1.exe

kernel32

user32

advapi32

ws2_32

msvcrt

generic