WannaCry2[.]0-main[.]zip

resource
unpack002/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

WannaCry2.0-main.zip

SHA256 a80032c76c5b96b652ad059098578b5afa4539c665650f2ae073b76657e889e0
MD5 8df4da9f105c1efe0312277681ab7657
SHA1 2f59ed04ceaca4a13e84edd6d176b2a6e6d6b2ff
SHA512 7c012c8b0e123a568631777bfc87cb2f92209d3aa221ed63ef7a07ae38a039f2d63f051190043d0acddd42b75ae2d718e81ea094253fdcf7d638bc52cf767c7d
SSDEEP 98304:Phvb2BVmAw0p9jIVcEj5nnZNRyA30yBSRTA:Phvq7Bu6EZnZN5EyBS6
MD5 SHA1 SHA512 SSDEEP

WannaCry2.0-main/.gitignore

SHA256 29a3db423bf9d10e68f8950af557ddb891f407d262a8286511fb22df48ef458f
MD5 97a40190cf692d26a40878c675a54049
SHA1 12ac538031aa43ebb2fa6c7c7db3ecec528fdad1
SHA512 546326d29f96daad767190d05485c3358272f62423ccf5ceb27dbce605ff376ab66875aff138caf7a1699cbc1123121b8ab8c9da2d22183f39305231dd3f4308
MD5 SHA1 SHA512

WannaCry2.0-main/.vscode/c_cpp_properties.json

SHA256 fdcb102f4856235745e6f824410eb411ca58681485420bd1eacb6d8f4f1b7304
MD5 e457639b6442de3a6b199e0bcf48ca61
SHA1 925fbb2a12c11dc8a5cb139ed9f7148bb342c5e7
SHA512 2ae1460488f1046c964c2c30ff0dacc554ea1de3c53fabbdf0a7b892ecef532df2af6f1f9a97a373a7da521d87148fd0ea010ec005cfe75d0008e3b73ed477fe
MD5 SHA1 SHA512

WannaCry2.0-main/LICENSE

SHA256 45c7b18777805e5847461265e89c910065901cfb4a628aa931e574d8ad97fb3d
MD5 c2d2538a4f6b21f5ad34f1b39131fce0
SHA1 03565b3c7f761defd3a05968a99518e5f27b40d7
SHA512 f3a0fb7e1f032ee88ccd2e54e17941c3aac8d8b79f8f9d1b0c49eaec0d69538902e3832c793645fbfa355f4764b30325ecdc968a4efd1e4de3f77009f4044b21
MD5 SHA1 SHA512

WannaCry2.0-main/README.md

SHA256 efa3bb1124ed953195ff07e4f8081478063be577e240b0762dfc25c8eb05fd94
MD5 7c8506983be827acefcc993d95e01e79
SHA1 5243bf14955851d323c8e7b82c587bd88a8afc15
SHA512 5ae5219f0af319274be5886efe0198791a0c68e22f26a13d5baa54b80c15091d3a34fcf42a858d12b555a8568f350f4b9ba800d7f3c69f3475faf06ad46e0b44
MD5 SHA1 SHA512

WannaCry2.0-main/Ransomware.WannaCry.zip

SHA256 707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a
MD5 efe76bf09daba2c594d2bc173d9b5cf0
SHA1 ba5de52939cb809eae10fdbb7fac47095a9599a7
SHA512 4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029
SSDEEP 98304:vhvb2BVmAw0p9jIVcEj5nnZNRyA30yBSRT:vhvq7Bu6EZnZN5EyBSN
MD5 SHA1 SHA512 SSDEEP

Password

infected

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

IMPHASH 68f013d7437aa653a8a98a05807afeb1
SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
MD5 84c82835a5d21bbcf75a61706d8ab549
SHA1 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA512 90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

30650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesW GetFileSizeEx CreateFileA InitializeCriticalSection DeleteCriticalSection ReadFile GetFileSize WriteFile LeaveCriticalSection EnterCriticalSection SetFileAttributesW SetCurrentDirectoryW CreateDirectoryW GetTempPathW GetWindowsDirectoryW GetFileAttributesA SizeofResource LockResource LoadResource MultiByteToWideChar Sleep OpenMutexA GetFullPathNameA CopyFileA GetModuleFileNameA VirtualAlloc VirtualFree FreeLibrary HeapAlloc GetProcessHeap GetModuleHandleA SetLastError VirtualProtect IsBadReadPtr HeapFree SystemTimeToFileTime LocalFileTimeToFileTime CreateDirectoryA GetStartupInfoA SetFilePointer SetFileTime GetComputerNameW GetCurrentDirectoryA SetCurrentDirectoryA GlobalAlloc LoadLibraryA GetProcAddress GlobalFree CreateProcessA CloseHandle WaitForSingleObject TerminateProcess GetExitCodeProcess FindResourceA

user32

wsprintfA

advapi32

CreateServiceA OpenServiceA StartServiceA CloseServiceHandle CryptReleaseContext RegCreateKeyW RegSetValueExA RegQueryValueExA RegCloseKey OpenSCManagerA

msvcrt

realloc fclose fwrite fread fopen sprintf rand srand strcpy memset strlen wcscat wcslen __CxxFrameHandler ??3@YAXPAX@Z memcmp _except_handler3 _local_unwind2 wcsrchr swprintf ??2@YAPAXI@Z memcpy strcmp strrchr __p___argv __p___argc _stricmp free malloc ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z _CxxThrowException calloc strcat _mbsstr ??1type_info@@UAE@XZ _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp

WannaCry2.0-main/WannaCry.c

SHA256 c65c31e80a61833efcff9da579a82e52f4a4286be2790e875acfd07cb89f1349
MD5 0382eb93cc232c460995c50e8abd4a27
SHA1 a9e2a40f8f6c748f4f548e5dce3a2ee93c7d923a
SHA512 9184513150d3c9292edeba4df9570bdff82416d5cf6eaea6b7503d00049686463a03a235e3793c18d2b2aff8503d052dd790125e399ed862c02113c06c745924
SSDEEP 6144:SxPiam1KCILCw40qCbiWjEtHvJ+wCXCqPGlV2OwUJfa:S2KL40vbY+wCXJPSV2OpJfa
MD5 SHA1 SHA512 SSDEEP

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer