WannaCry-main[.]zip

resource
unpack001/WannaCry-main/WannaCry.EXE

WannaCry-main.zip

SHA256 07ecdced8cf2436c0bc886ee1e49ee4b8880a228aa173220103f35c535305635
MD5 3c7861d067e5409eae5c08fd28a5bea2
SHA1 44e4b61278544a6a7b8094a0615d3339a8e75259
SHA512 c2968e30212707acf8a146b25bb29c9f5d779792df88582b03431a0034dc82599f58d61fc9494324cc06873e5943f8c29bffd0272ca682d13c0bb10482d79fc5
SSDEEP 98304:yvB7TUkt1NCLt2SUlW/6GQkBhLp0ClD/5vVayInJOo3s:yvjNct2TW/rQk6CN1VayQUoc
MD5 SHA1 SHA512 SSDEEP

WannaCry-main/.github/FUNDING.yml

SHA256 a718485e8f9d87fe04684f8e8e295e4e2f1c686691d467adfc10f83a0d277dc0
MD5 148a8212d916df277b94ff7293ebaf93
SHA1 6017fb2ca1094abbab2e4b7493906334a98afdf2
SHA512 4e4ebf456ef5d41c72cab28082b89134ff4393bfd439fd4f22607b08ae4b06588a2832f1d2bfb69404903ebd05c5f2ac1171a2e66c9f697d777c941b6d243400
MD5 SHA1 SHA512

WannaCry-main/LICENSE

SHA256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986
MD5 1ebbd3e34237af26da5dc08a4e440464
SHA1 31a3d460bb3c7d98845187c716a30db81c44b615
SHA512 d361e5e8201481c6346ee6a886592c51265112be550d5224f1a7a6e116255c2f1ab8788df579d9b8372ed7bfd19bac4b6e70e00b472642966ab5b319b99a2686
SSDEEP 768:Fo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7J:Fhcycsrfrnoum
MD5 SHA1 SHA512 SSDEEP

WannaCry-main/README.md

SHA256 30f48639e02b2891005bd9520dcfdd70edd2da7de690ce7f38a054c91e5f4bc4
MD5 d5cf8ac826abe3f1161ef2266d121b89
SHA1 79a81c5e801e16625a42c5b58e6e74d532d30a4b
SHA512 7027bdbcb666cbfe556ddea300d433e0542b75fe673496c4353cc61d12a141b2c413e4c291ed58eef29da19955f494314f9631017840d05445b44b1c7ba4bf0e
MD5 SHA1 SHA512

WannaCry-main/WannaCry.EXE

IMPHASH 68f013d7437aa653a8a98a05807afeb1
SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
MD5 84c82835a5d21bbcf75a61706d8ab549
SHA1 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA512 90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

30650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesW GetFileSizeEx CreateFileA InitializeCriticalSection DeleteCriticalSection ReadFile GetFileSize WriteFile LeaveCriticalSection EnterCriticalSection SetFileAttributesW SetCurrentDirectoryW CreateDirectoryW GetTempPathW GetWindowsDirectoryW GetFileAttributesA SizeofResource LockResource LoadResource MultiByteToWideChar Sleep OpenMutexA GetFullPathNameA CopyFileA GetModuleFileNameA VirtualAlloc VirtualFree FreeLibrary HeapAlloc GetProcessHeap GetModuleHandleA SetLastError VirtualProtect IsBadReadPtr HeapFree SystemTimeToFileTime LocalFileTimeToFileTime CreateDirectoryA GetStartupInfoA SetFilePointer SetFileTime GetComputerNameW GetCurrentDirectoryA SetCurrentDirectoryA GlobalAlloc LoadLibraryA GetProcAddress GlobalFree CreateProcessA CloseHandle WaitForSingleObject TerminateProcess GetExitCodeProcess FindResourceA

user32

wsprintfA

advapi32

CreateServiceA OpenServiceA StartServiceA CloseServiceHandle CryptReleaseContext RegCreateKeyW RegSetValueExA RegQueryValueExA RegCloseKey OpenSCManagerA

msvcrt

realloc fclose fwrite fread fopen sprintf rand srand strcpy memset strlen wcscat wcslen __CxxFrameHandler ??3@YAXPAX@Z memcmp _except_handler3 _local_unwind2 wcsrchr swprintf ??2@YAPAXI@Z memcpy strcmp strrchr __p___argv __p___argc _stricmp free malloc ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z _CxxThrowException calloc strcat _mbsstr ??1type_info@@UAE@XZ _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp

Sharing

General

Malware Config

Signatures

File Explorer