d27a83154f0a89d69eca73ea47afea679a3da90edfd2593fac8c9a0576a05f38.bin
WannaCry ransomware indicators present
WannaCry embedded service payload with network APIsHigh-entropy resource loader with dynamic API resolution
SHA-256d27a83154f0a89d69eca73ea47afea679a3da90edfd2593fac8c9a0576a05f38
Evidence
⋯5 more rows
0x2fe400000000000000000000000000000000................
0x2ff400000000000000000000000000000000................
0x300400000000000000000000000057000000............W...
0x3014433a5c25735c25730000000057494e44C:\%s\%s....WIND
0x30244f5753006d737365637376632e657865OWS.mssecsvc.exe
0x303400000000000000000000000000000000................
⋯15 more rows
⋯3 more rows
0x3ff000000000000000000000000000000000................
0x400000000000000000000000000001000000................
0x401058000080180000800000000000000000X...............
0x402000000000000001006500000030000080........e...0...
0x403000000000000000000000000000000100................
0x404009040000480000006040000000005000....H...`@....P.
0x405000000000000000000100570000000000..........W.....
0x406000d038004d5a90000300000004000000..8.MZ..........
0x4070ffff0000b80000000000000040000000............@...
0x408000000000000000000000000000000000................
0x409000000000000000000000000000000000................
0x40a0f80000000e1fba0e00b409cd21b8014c............!..L
0x40b0cd21546869732070726f6772616d2063.!This program c
0x40c0616e6e6f742062652072756e20696e20annot be run in
0x40d0444f53206d6f64652e0d0d0a24000000DOS mode....$...
0x40e000000000553c5390115d3dc3115d3dc3....U<S..]=..]=.
0x40f0115d3dc36a4131c3105d3dc3924133c3.]=.jA1..]=..A3.
0x4100155d3dc37e4237c31a5d3dc37e4236c3.]=.~B7..]=.~B6.
0x4110105d3dc37e4239c3155d3dc3d25260c3.]=.~B9..]=..R`.
0x41201a5d3dc3115d3cc34a5d3dc3277b36c3.]=..]<.J]=.'{6.
0x4130105d3dc3d65b3bc3105d3dc352696368.]=..[;..]=.Rich
0x4140115d3dc3000000000000000000000000.]=.............
0x415000000000000000000000000050450000............PE..
0x41604c010400cc8ee74c0000000000000000L......L........
0x4170e0000f010b0106000090000000303800.............08.
0x418000000000169a00000010000000a00000................
0x419000004000001000000010000004000000..@.............
0x41a000000000040000000000000000b06600..............f.
0x41b000100000000000000200000000001000................
0x41c000100000000010000010000000000000................
0x41d0100000000000000000000000e0a10000................
0x41e0a00000000000310054a4350000000000......1.T.5.....
0x41f000000000000000000000000000000000................
0x420000000000000000000000000000000000................
0x421000000000000000000000000000000000................
0x422000000000000000000000000000000000................
0x42300000000000a000008801000000000000................
0x424000000000000000000000000000000000................
0x4250000000002e74657874000000ca8b0000.....text.......
0x426000100000009000000010000000000000................
0x42700000000000000000200000602e726461........ ..`.rda
0x53c95ec3909090909090909090b8842f0000^............/..
0x53e9b00857885c241088442411885c241288..W.\$..D$..\$..
0x53f9442413ffd589442414895c2418df6c24D$....D$..\$..l$
0x540914dd5c242ce8d1090000a16c14430050..\$,......l.C.P
0x54198b088d4424185150b968144300e8f96e...D$.QP.h.C...n
0x54290000be80144300dd8620270000dc0d90.....C... '.....
0x5439a14000dd5c245cffd589442414895c24.@..\$\...D$..\$
0x544918df6c2414dc64242cdc6c245cdc1588..l$..d$,.l$\...
0x5469e8868400005250e84f02000083c408eb.....RP.O.......
0x547902ddd8ffd589442444668b06895c2448......D$Df...\$H
0x5489663d0200df6c2444dd5c242c757e8b8cf=...l$D.\$,u~..
0x549924982f0000668944246451e88f830000$./..f.D$dQ.....
0x54a98b94249c2f00008944246852e8788300..$./...D$hR.x..
0x54b900536a016a026689442472e863830000.Sj.j.f.D$r.c...
0x54c98bf883ffff0f84ba0100008d4424646a............D$dj
0x54d9105057e84583000083f8ff0f84b40100.PW.E...........
0x54e9008b4e048d54243c8d44244c894c243c..N..T$<.D$L.L$<
0x54f95250b968144300895c2448e8eb6e0000RP.h.C..\$H..n..
0x55098b4c244c897910e95c010000663d0300.L$L.y..\...f=..
0x551975318b56048d4424248d4c247c5051b9u1.V..D$$.L$|PQ.
0x5529681443008954242c895c2430e8ba6e00h.C..T$,.\$0..n.
0x5539008b54247c8b421050e8cd820000e925..T$|.B.P......%
0x554901000066 ...f
0xe6866c416c6c6f6300004b45524e454c3332lAlloc..KERNEL32
0xe6962e646c6c000085004372797074416371.dll....CryptAcq
0xe6a675697265436f6e746578744100009600uireContextA....
0xe6b6437279707447656e52616e646f6d0000CryptGenRandom..
0xe6c649025374617274536572766963654100I.StartServiceA.
0xe6d63e00436c6f7365536572766963654861>.CloseServiceHa
0xe6e66e646c65000064004372656174655365ndle..d.CreateSe
0xe6f67276696365410000ad014f70656e5343rviceA....OpenSC
0xe7064d616e61676572410000440253657453ManagerA..D.SetS
0xe71665727669636553746174757300003400erviceStatus..4.
0xe7264368616e676553657276696365436f6eChangeServiceCon
0xe7366669673241000c025265676973746572fig2A...Register
0xe746536572766963654374726c48616e646cServiceCtrlHandl
0xe756657241004a0253746172745365727669erA.J.StartServi
0xe76663654374726c44697370617463686572ceCtrlDispatcher
0xe7764100af014f70656e5365727669636541A...OpenServiceA
0xe786000041445641504933322e646c6c0000..ADVAPI32.dll..
0xe7965753325f33322e646c6c00000b013f3fWS2_32.dll....??
0xe7a6315f4c6f636b697440737464404051411_Lockit@std@@QA
0xe7b64540585a0000a2003f3f305f4c6f636bE@XZ....??0_Lock
0xe7c6697440737464404051414540585a0000it@std@@QAE@XZ..
0xe7e67450657241646170746572496e666f00tPerAdapterInfo.
0xe7f61c004765744164617074657273496e66..GetAdaptersInf
0xe8066f006970686c706170692e646c6c0000o.iphlpapi.dll..
0xe8166900496e7465726e6574436c6f736548i.InternetCloseH
0xe826616e646c65009300496e7465726e6574andle...Internet
0xe8364f70656e55726c4100009200496e7465OpenUrlA....Inte
0xe846726e65744f70656e410057494e494e45rnetOpenA.WININE
0xe856542e646c6c00f1005f66746f6c00b202T.dll..._ftol...
0xe866737072696e746600c5005f656e647468sprintf..._endth
0xe8767265616465780000c1027374726e6370readex....strncp
0xe8867900a60272616e640000a6005f626567y...rand...._beg
0xe896696e7468726561646578000049005f5finthreadex..I.__
0xe8a64378784672616d6548616e646c657200CxxFrameHandler.
0xe8b6b4027372616e6400d00274696d650000..srand...time..
0xe8c662005f5f705f5f5f6172676300000f00b.__p___argc....
0xe8d63f3f3240594150415849405a00005e02??2@YAPAXI@Z..^.
0xe8e666726565000055005f5f646c6c6f6e65free..U.__dllone
0xe8f67869740086015f6f6e65786974004d53xit..._onexit.MS
0xe906564352542e646c6c0000d3005f657869VCRT.dll...._exi
0xe916740048005f5863707446696c74657200t.H._XcptFilter.
0xe92649026578697400008f005f61636d646cI.exit...._acmdl
0xe9366e0058005f5f6765746d61696e617267n.X.__getmainarg
0xe94673000f015f696e69747465726d008300s..._initterm...
0xe9565f5f736574 __set
0x352e0455249445f5f504c414345484f4c4445ERID__PLACEHOLDE
0x352f0525f5f00757365726964000074726565R__.userid..tree
0x35300696400005f5f54524545504154485f52id..__TREEPATH_R
0x3531045504c4143455f5f000000005c5c2573EPLACE__....\\%s
0x353205c495043240000004d6963726f736f66\IPC$...Microsof
0x353307420426173652043727970746f677261t Base Cryptogra
0x35340706869632050726f7669646572207631phic Provider v1
0x353502e30000025642e25642e25642e256400.0..%d.%d.%d.%d.
0x353606d73736563737663322e30004d696372mssecsvc2.0.Micr
0x353706f736f66742053656375726974792043osoft Security C
0x35380656e7465722028322e30292053657276enter (2.0) Serv
0x35390696365002573202d6d20736563757269ice.%s -m securi
0x353a074790000202f6900433a5c25735c7165ty.. /i.C:\%s\qe
0x353b0726975776a68726600000000433a5c25riuwjhrf....C:\%
0x353c0735c25730000000057494e444f575300s\%s....WINDOWS.
0x353d07461736b736368652e65786500000000tasksche.exe....
0x353e052000000436c6f736548616e646c6500R...CloseHandle.
0x353f0577269746546696c6500000043726561WriteFile...Crea
0x35400746546696c6541004372656174655072teFileA.CreatePr
0x354106f636573734100006b00650072006e00ocessA..k.e.r.n.
0x3542065006c00330032002e0064006c006c00e.l.3.2...d.l.l.
0x3543000000000687474703a2f2f7777772e69....http://www.i
0x354407571657266736f64703969666a61706fuqerfsodp9ifjapo
0x354507364666a68676f737572696a66616577sdfjhgosurijfaew
0x3546072776572677765612e636f6d00000000rwergwea.com....
0x3547000000000010000000000000000000000................
0x3548000000000000000000000000000000000................
0x3549000000000000000000000000000000000................
0x354a000000000000000000000000000000000................
0x354b000000000000000000000000000000000................
0x354c000000000000000000000000000000000................
0x354d000000000000000000000000000000000................
0x354e000000000000000000000000000000000................
0x354f000000000000000000000000000000000................
0x3550000000000000000000000000000000000................
0x3551000000000000000000000000000000000................
0x3552000000000000000000000000000000000................
0x3553000000000000000000000000000000000................
0x3554000000000000000000000000000000000................
0x3555000000000000000000000000000000000................
0x35560000000000000000000000000 ............