Ransomware[.]wannacry[.]exe[.]malz[.]7z

Target
Ransomware.wannacry.exe.malz.7z
Size 3.4MB
Sample241116-kd8blaskax
SHA256 adb41a37499a6f0f5b1e58b1973367dd34a695293dc1fed601c79d21fd0754c1
MD5 4d9c771619255c9b937c34b4c50cec7e
SHA1 55177cd9cefc6369db31b23e324d3263b4d4e6a6
SHA512 4f017c53bf0c04118ec535f12742b83ab19b1c8f741936c0811641c78264cee8df5a84f149391cd0b5c9a3e6f38f4155b067ca95c1e759d962882414197c6b60
SSDEEP 49152:nlUTH8fWrXRTyEAP/g4CJbErYlXxgx+E/epdYMaiEK3SFNjt4Jg87nIHOVLWF4k9:nlG8mh8gV56+NjaiEK3SFNjthk5I4W3N
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Ransomware.wannacry.exe.malz

File Explorer

Ransomware.wannacry.exe.malz.7z

.7z 3.4MB
Ransomware.wannacry.exe.malz

.exe 3.6MB

Ransomware.wannacry.exe.malz.7z

SHA256 adb41a37499a6f0f5b1e58b1973367dd34a695293dc1fed601c79d21fd0754c1
MD5 4d9c771619255c9b937c34b4c50cec7e
SHA1 55177cd9cefc6369db31b23e324d3263b4d4e6a6
SHA512 4f017c53bf0c04118ec535f12742b83ab19b1c8f741936c0811641c78264cee8df5a84f149391cd0b5c9a3e6f38f4155b067ca95c1e759d962882414197c6b60
SSDEEP 49152:nlUTH8fWrXRTyEAP/g4CJbErYlXxgx+E/epdYMaiEK3SFNjt4Jg87nIHOVLWF4k9:nlG8mh8gV56+NjaiEK3SFNjthk5I4W3N
MD5 SHA1 SHA512 SSDEEP

Password

infected

Ransomware.wannacry.exe.malz

IMPHASH 9ecee117164e0b870a53dd187cdd7174
SHA256 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
MD5 db349b97c37d22f5ea1d1841e3c89eb4
SHA1 e889544aff85ffaf8b0d0da705105dee7c97fe26
SHA512 d6c60b8f22f89cbd1262c0aa7ae240577a82002fb149e9127d4edf775a25abcda4e585b6113e79ab4a24bb65f4280532529c2f06f7ffe4d5db45c0caf74fea38
SSDEEP 98304:wDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3R:wDqPe1Cxcxk3ZAEUadzR8yc4gB
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

39446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject InterlockedIncrement GetCurrentThreadId GetCurrentThread ReadFile GetFileSize CreateFileA MoveFileExA SizeofResource TerminateThread LoadResource FindResourceA GetProcAddress GetModuleHandleW ExitProcess GetModuleFileNameA LocalFree LocalAlloc CloseHandle InterlockedDecrement EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GlobalAlloc GlobalFree QueryPerformanceFrequency QueryPerformanceCounter GetTickCount LockResource Sleep GetStartupInfoA GetModuleHandleA

advapi32

StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA ChangeServiceConfig2A SetServiceStatus OpenSCManagerA CreateServiceA CloseServiceHandle StartServiceA CryptGenRandom CryptAcquireContextA OpenServiceA

ws2_32

closesocket recv send htonl ntohl WSAStartup inet_ntoa ioctlsocket select htons socket connect inet_addr

msvcp60

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ

iphlpapi

GetAdaptersInfo GetPerAdapterInfo

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle

msvcrt

__set_app_type _stricmp __p__fmode __p__commode _except_handler3 __setusermatherr _initterm __getmainargs _acmdln _adjust_fdiv _controlfp exit _XcptFilter _exit _onexit __dllonexit free ??2@YAPAXI@Z _ftol sprintf _endthreadex strncpy rand _beginthreadex __CxxFrameHandler srand time __p___argc

Resubmissions

Sharing

General