2024-06-07_ed9f8c2585471efd575709b44d43142a_wannacry

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-07_ed9f8c2585471efd575709b44d43142a_wannacry
Size

11.1MB
MD5

ed9f8c2585471efd575709b44d43142a
SHA1

6d147155085223da280f7ea3f7082b82a2b5f841
SHA256

bb21b5321eae15f3f02bbe7b922764843460a5de5346c4e40bab3df4169869af
SHA512

2fd8a11d2bef01b9426d710013efc4512619c9464cee7293ca128e7e8729d3a02eb169550d9946b2c9db41c387c5e55d13057cbc1905b61a7fa38a18c02c0582
SSDEEP

196608:LhYIVPZzjZn6WkU1nxoSGek2jhmE6v5NYP5bDmM/UYKQNDo169iEnYgCfG/s3d3q:xZzjt6TU1nLGek28EE5NY7UYpDoMMEnL

Score

1^/10

Malware Config

Signatures

Files

2024-06-07_ed9f8c2585471efd575709b44d43142a_wannacry
.exe windows:5 windows x86 arch:x86

c79acbde48259d5900890f97c652a34d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

60:f7:2d:e0:e6:7b:c8:4b:fd:2c:83:b1:68:02:6a:42
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/02/2014, 00:00

Not After

29/04/2016, 23:59

Subject

CN=IDRIX,O=IDRIX,L=Paris,ST=Paris,C=FR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

75:c7:a3:a0:64:e8:12:c4:27:0f:1f:fb:dd:01:f9:3a:40:62:52:80
Signer

Actual PE Digest

75:c7:a3:a0:64:e8:12:c4:27:0f:1f:fb:dd:01:f9:3a:40:62:52:80

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

setupapi

SetupOpenInfFileA
SetupCloseInfFile
SetupInstallFromInfSectionA
SetupDiOpenClassRegKey

kernel32

WaitForSingleObject
GetCurrentThread
GetCurrentThreadId
SetUnhandledExceptionFilter
ReleaseMutex
CreateMutexA
SetFileTime
GetFileTime
FlushFileBuffers
GetFileSize
GetFileSizeEx
GetVersionExA
LockResource
GetFileAttributesA
GetCurrentProcessId
SetFilePointer
GetCurrentDirectoryA
SetErrorMode
CreateFileW
FindNextFileW
FindFirstFileW
GetLocaleInfoW
GetTimeZoneInformation
SetEndOfFile
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeA
GetLocaleInfoA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetHandleCount
PeekNamedPipe
GetFileInformationByHandle
UnhandledExceptionFilter
HeapSize
GetStdHandle
HeapCreate
HeapReAlloc
VirtualFree
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoA
GetCommandLineA
GetFileType
SetStdHandle
GetFileAttributesW
MoveFileA
GetSystemTimeAsFileTime
ExitProcess
IsDebuggerPresent
TerminateProcess
CreateThread
ResumeThread
ExitThread
FileTimeToLocalFileTime
FileTimeToSystemTime
RtlUnwind
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
InterlockedExchange
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
DeleteFileA
GetModuleFileNameA
CreatePipe
SetHandleInformation
CreateProcessA
ReadFile
WriteFile
CloseHandle
SetEnvironmentVariableA
GetModuleFileNameW
LoadLibraryExA
FormatMessageW
FindFirstVolumeW
QueryDosDeviceW
FindNextVolumeW
FindVolumeClose
GetVolumePathNameA
GetVolumeInformationA
GetShortPathNameA
GetDriveTypeA
CreateDirectoryA
SetFilePointerEx
SetLastError
LoadLibraryA
GetTempPathA
GetWindowsDirectoryA
SetCurrentDirectoryA
CopyFileA
FindFirstFileA
FindClose
GetProcessHeap
HeapAlloc
HeapFree
CreateFileA
RemoveDirectoryA
GetSystemDirectoryA
Sleep
GetFullPathNameA
DeviceIoControl
FindResourceA
LoadResource
SizeofResource
FreeLibrary
IsDBCSLeadByte
FormatMessageA
LocalAlloc
LocalFree
lstrcmpiA
lstrlenA
GetModuleHandleA
GetProcAddress
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
GetConsoleCP

user32

TrackMouseEvent
CharNextA
MessageBoxA
wsprintfW
PostMessageA
MessageBoxW
AppendMenuW
AppendMenuA
SystemParametersInfoW
GetClassInfoA
SendDlgItemMessageW
ExitWindowsEx
GetSystemMenu
GetKeyState
EnumChildWindows
GetDlgCtrlID
GetClassNameA
LoadCursorA
SetCursor
DefDlgProcA
UnregisterClassA
LoadIconA
RegisterClassA
LoadBitmapA
SetWindowLongA
CallWindowProcA
GetWindowLongA
GetWindowTextW
GetSystemMetrics
GetWindowInfo
GetDC
MessageBeep
GetClientRect
SetWindowPos
GetWindowTextA
DestroyWindow
GetWindowRect
CreateDialogParamW
MapDialogRect
MoveWindow
BeginPaint
FillRect
EndPaint
ReleaseDC
GetWindowTextLengthA
SetDlgItemTextA
SetWindowTextA
ShowWindow
SetWindowTextW
SetFocus
EndDialog
DialogBoxParamW
EnableWindow
EnumWindows
SendMessageA
SendMessageW
SendDlgItemMessageA
GetParent
GetDlgItem
InvalidateRect
RegisterWindowMessageA

gdi32

GetCurrentObject
GetObjectA
CreateCompatibleBitmap
SetStretchBltMode
StretchBlt
DeleteDC
BitBlt
CreateCompatibleDC
SetMapMode
GetDeviceCaps
GetTextExtentPoint32W
GetTextMetricsA
SetBkMode
GetStockObject
SelectObject
CreateSolidBrush
SetTextColor
SetBkColor
SetTextAlign
TextOutW
CreateFontIndirectW
DeleteObject

advapi32

RegEnumValueA
RegQueryValueExA
GetTokenInformation
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
GetLengthSid
InitializeAcl
AddAccessAllowedAceEx
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
CloseServiceHandle
DeleteService
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetKeySecurity
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
ChangeServiceConfigA
StartServiceA
CreateServiceA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHFileOperationA
SHChangeNotify
SHGetFolderPathA
SHGetSpecialFolderPathA
ShellExecuteA
SHBrowseForFolderW
SHGetMalloc
ord680

ole32

CoInitialize
CoUninitialize
OleInitialize
OleUninitialize
CoCreateInstance
PropVariantClear
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi

shlwapi

SHDeleteKeyA
SHStrDupW

Sections

.text
Size: 256KB - Virtual size: 256KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 941KB - Virtual size: 941KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c79acbde48259d5900890f97c652a34d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

60:f7:2d:e0:e6:7b:c8:4b:fd:2c:83:b1:68:02:6a:42Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

75:c7:a3:a0:64:e8:12:c4:27:0f:1f:fb:dd:01:f9:3a:40:62:52:80Signer

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

setupapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 256KB - Virtual size: 256KB

.rdata Size: 50KB - Virtual size: 50KB

.data Size: 10KB - Virtual size: 185KB

.rsrc Size: 941KB - Virtual size: 941KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

60:f7:2d:e0:e6:7b:c8:4b:fd:2c:83:b1:68:02:6a:42
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

75:c7:a3:a0:64:e8:12:c4:27:0f:1f:fb:dd:01:f9:3a:40:62:52:80
Signer

.text
Size: 256KB - Virtual size: 256KB

.rdata
Size: 50KB - Virtual size: 50KB

.data
Size: 10KB - Virtual size: 185KB

.rsrc
Size: 941KB - Virtual size: 941KB