2024-06-14_5273ba1578fa3c70fcb6a0fce1ad5335_wannacry

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-14_5273ba1578fa3c70fcb6a0fce1ad5335_wannacry
Size

236KB
MD5

5273ba1578fa3c70fcb6a0fce1ad5335
SHA1

ef93f9083a14f21538caf4c452b574eecc084ca0
SHA256

5bd8a2b04a4f11d3d85763340294fb38a3839446da0cbae7bc46373a766bb417
SHA512

1a82f47a9833fc8fd335a4d8d5d05817b91daeb4b8f1489e008bc36e459c254d2dd3c7a9c7bd7945ca8644afedc6e32d45cf4e19acfc0818f0e8b933dc00de25
SSDEEP

3072:D0eIVAnbWOECR+uMEJzB4XWQamKNQHFZde0tHEGaa:4rVOEgZMYOamKN2ey

Score

10^/10

Malware Config

Signatures

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENRansomware

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-14_5273ba1578fa3c70fcb6a0fce1ad5335_wannacry

Files

2024-06-14_5273ba1578fa3c70fcb6a0fce1ad5335_wannacry
.exe windows:4 windows x86 arch:x86

217eabf271d0135a61686139075dffe9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord923
ord4277
ord940
ord640
ord2405
ord5785
ord1640
ord323
ord1168
ord6197
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord609
ord781
ord6438
ord2621
ord1134
ord654
ord4129
ord2575
ord4396
ord3574
ord1146
ord6215
ord665
ord1979
ord353
ord6136
ord6140
ord535
ord4278
ord341
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6021
ord5873
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord3571
ord3797
ord2381
ord2754
ord6194
ord6734
ord6170
ord3706
ord5781
ord5710
ord922
ord6778
ord6648
ord6334
ord2818
ord2370
ord2289
ord289
ord613
ord2860
ord4284
ord3874
ord470
ord5789
ord5875
ord6172
ord755
ord6663
ord2864
ord4275
ord540
ord860
ord858
ord795
ord3721
ord2642
ord3998
ord3301
ord283
ord5787
ord4476
ord3089
ord1641
ord3996
ord2414
ord616
ord3663
ord3626
ord1576
ord693
ord3640
ord3370
ord4402
ord2582
ord3582
ord4398
ord2578
ord4218
ord2023
ord2411
ord3573
ord3619
ord823
ord3092
ord6199
ord4376
ord6453
ord924
ord1200
ord800
ord2379
ord5280
ord4710
ord537
ord4234
ord2302
ord765
ord825
ord324
ord567
ord641
ord3698
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord3597
ord4425
ord1775
ord6052
ord2514
ord4998
ord4853
ord3708
ord5265

msvcrt

_strnicmp
_wcsicmp
_setmbcp
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_wcsnicmp
_controlfp
__CxxFrameHandler
fclose
fread
fopen
sprintf
rand
time
srand
wcscpy
wcscat
_ftol
_except_handler3
_local_unwind2
wcsrchr
wcslen
wcscmp
swprintf
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
realloc
_mbsstr
malloc
calloc
free
memmove
_purecall
strncpy
_CxxThrowException
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
fseek
fwrite
strrchr
__p___argc
__p___argv
_mbscmp
strncmp
sscanf
fgets
wcsstr

kernel32

GlobalFree
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
TerminateThread
CloseHandle
GetFileAttributesA
DeleteFileA
CreateThread
SystemTimeToFileTime
LocalFileTimeToFileTime
GetModuleHandleA
GetStartupInfoA
GlobalAlloc
DeleteFileW
MultiByteToWideChar
SetCurrentDirectoryA
GetCurrentDirectoryA
CopyFileA
MoveFileW
SetFileTime
SetFilePointerEx
SetEndOfFile
WriteFile
SetFilePointer
ReadFile
GetFileTime
CreateFileW
FindClose
FindNextFileW
GetFileAttributesW
FindFirstFileW
CreateFileA
GetExitCodeThread
GlobalUnlock
GlobalLock
WideCharToMultiByte
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDrives
FindNextFileA
FindFirstFileA
InitializeCriticalSection
DeleteCriticalSection
GetFileSize
LeaveCriticalSection
EnterCriticalSection
Sleep
ExitProcess
GetModuleFileNameA
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
CopyFileW
CreateDirectoryA
GetTempFileNameA
GetComputerNameA

user32

TabbedTextOutA
SetActiveWindow
DrawTextA
BringWindowToTop
GrayStringA
GetSysColor
OffsetRect
SystemParametersInfoW
IsIconic
GetSystemMetrics
SetFocus
SystemParametersInfoA
SetWindowPos
SetTimer
SendMessageA
DrawIcon
SetWindowTextW
LoadIconA
FillRect
RedrawWindow
InvalidateRect
SetCursor
GetParent
LoadCursorA
OpenClipboard
EmptyClipboard
KillTimer
EnableWindow
GetClientRect
CloseClipboard
SetClipboardData
ShowWindow
FindWindowW
wsprintfA
SetForegroundWindow

gdi32

PatBlt
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateCompatibleBitmap
CreateRectRgn
GetWindowOrgEx
GetViewportOrgEx
GetDeviceCaps
CreateCompatibleDC
BitBlt
DeleteObject
GetTextExtentPoint32A
GetObjectA
CreateFontIndirectA
CreateSolidBrush
CreateFontA

advapi32

CryptEncrypt
CryptDecrypt
CryptDestroyKey
CryptReleaseContext
CryptImportKey
CryptAcquireContextA
RegSetValueExA
RegCreateKeyW
RegQueryValueExA
RegCloseKey
AllocateAndInitializeSid
CheckTokenMembership
FreeSid

shell32

ShellExecuteA
SHGetFolderPathW
ShellExecuteExA

comctl32

_TrackMouseEvent
ord8

oleaut32

VariantTimeToSystemTime

urlmon

URLDownloadToFileA

msvcp60

?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Xran@std@@YAXXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB

ws2_32

gethostbyname
WSAGetLastError
bind
shutdown
send
recv
inet_ntoa
select
inet_addr
setsockopt
WSAStartup
htons
socket
ioctlsocket
connect
closesocket
__WSAFDIsSet

netapi32

NetShareEnum
NetApiBufferFree

mpr

WNetCancelConnection2A
WNetAddConnection2A

wininet

DeleteUrlCacheEntry

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

217eabf271d0135a61686139075dffe9

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

oleaut32

urlmon

msvcp60

ws2_32

netapi32

mpr

wininet

Sections

.text Size: 76KB - Virtual size: 74KB

.rdata Size: 40KB - Virtual size: 36KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 104KB - Virtual size: 102KB

.text
Size: 76KB - Virtual size: 74KB

.rdata
Size: 40KB - Virtual size: 36KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 104KB - Virtual size: 102KB