493486883864f65f4cbffc6b7117ac44a0dc25ee14c30ec7c4408235ebb652ff

General

Target
493486883864f65f4cbffc6b7117ac44a0dc25ee14c30ec7c4408235ebb652ff
Size 193KB
Sample240521-hdf61abe38
SHA256 493486883864f65f4cbffc6b7117ac44a0dc25ee14c30ec7c4408235ebb652ff
MD5 cebfa5dd695498c59a74528face6e846
SHA1 4c0129fa36f9f702459852ffc19cd76f73273d67
SHA512 3119ddfcf2af204e6065fb4ae9d04f1c4a70c03a8c6424099a960ec7686ef1b7b44164b6a65cf570fb923b40f317795eaa0ad5b505da2f1d07ca2baef0353f9d
SSDEEP 6144:ae4eM7STHLt0F3bt477JvyN0r+Z8fXixpB:R4eMYHLt2xo7Z0KfXiPB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Ransomware.WannaCrypt0r.v1.exe

File Explorer

493486883864f65f4cbffc6b7117ac44a0dc25ee14c30ec7c4408235ebb652ff

.zip 193KB
Ransomware.WannaCrypt0r.v1.exe

.exe 224KB

493486883864f65f4cbffc6b7117ac44a0dc25ee14c30ec7c4408235ebb652ff

SHA256 493486883864f65f4cbffc6b7117ac44a0dc25ee14c30ec7c4408235ebb652ff
MD5 cebfa5dd695498c59a74528face6e846
SHA1 4c0129fa36f9f702459852ffc19cd76f73273d67
SHA512 3119ddfcf2af204e6065fb4ae9d04f1c4a70c03a8c6424099a960ec7686ef1b7b44164b6a65cf570fb923b40f317795eaa0ad5b505da2f1d07ca2baef0353f9d
SSDEEP 6144:ae4eM7STHLt0F3bt477JvyN0r+Z8fXixpB:R4eMYHLt2xo7Z0KfXiPB
MD5 SHA1 SHA512 SSDEEP

Password

infected

Ransomware.WannaCrypt0r.v1.exe

IMPHASH e858a14f217810d78466806d95d7fceb
SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
MD5 5c7fb0927db37372da25f270708103a2
SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28570

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSizeEx CreateFileA InitializeCriticalSection DeleteCriticalSection GetFileSize LeaveCriticalSection EnterCriticalSection SizeofResource LockResource LoadResource FindResourceA SetErrorMode VirtualAlloc VirtualFree FreeLibrary HeapAlloc GetProcessHeap GetModuleHandleA SetLastError VirtualProtect IsBadReadPtr HeapFree SystemTimeToFileTime LocalFileTimeToFileTime CreateDirectoryA GetStartupInfoA ReadFile SetFilePointer WriteFile SetFileTime GetFileAttributesA GetCurrentDirectoryA SetCurrentDirectoryA GlobalAlloc LoadLibraryA GetProcAddress GlobalFree GetModuleFileNameA CloseHandle

user32

wsprintfA

advapi32

CryptDecrypt CryptDestroyKey CryptReleaseContext CryptImportKey CryptAcquireContextA

ws2_32

WSAStartup inet_addr WSACleanup

msvcrt

_controlfp __set_app_type __p__fmode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ??1type_info@@UAE@XZ __p__commode strcpy memset strlen memcpy __CxxFrameHandler ??3@YAXPAX@Z memcmp _except_handler3 _local_unwind2 ??2@YAPAXI@Z sscanf strcmp __p___argv __p___argc strrchr realloc _stricmp free malloc ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z _CxxThrowException calloc strcat _mbsstr

Sharing

General

Malware Config

Signatures

File Explorer

493486883864f65f4cbffc6b7117ac44a0dc25ee14c30ec7c4408235ebb652ff

Ransomware.WannaCrypt0r.v1.exe

kernel32

user32

advapi32

ws2_32

msvcrt

generic