wc_content.raw - Win.Ransomware.WannaCry-6313787-0

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	wc_content.raw
size	5242876 (0x4ffffc)
md5	80bb757fe90745a149a2f734bcbc541a

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	Win.Ransomware.WannaCry-6313787-0 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
12	7291	1
14	7299	4
10	8047	11
11	8047	1
4	8047	4
93	4035	11
1	0	91
11	9782	1
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4ce78ecc
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x9000
SizeOfInitializedData	0x383000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x9a16
BaseOfCode	0x1000
BaseOfData	0xa000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x66b000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x8bca	0x9000	R-X CODE
.rdata	0xa000	0x998	0x1000	R-- IDATA
.data	0xb000	0x30489c	0x27000	RW- IDATA
.rsrc	0x310000	0x35a454	0x35b000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xa1e0	0xa0
RESOURCE	0x310000	0x35a454
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xa000	0x188
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
R	#1831	2061938	1252
VERSION	#1	944	1252

module_name	hint	ord	function_name
KERNEL32.dll	912		WaitForSingleObject
KERNEL32.dll	556		InterlockedIncrement
KERNEL32.dll	326		GetCurrentThreadId
KERNEL32.dll	325		GetCurrentThread
KERNEL32.dll	693		ReadFile
KERNEL32.dll	355		GetFileSize
KERNEL32.dll	83		CreateFileA
KERNEL32.dll	623		MoveFileExA
KERNEL32.dll	853		SizeofResource
KERNEL32.dll	863		TerminateThread
KERNEL32.dll	599		LoadResource
KERNEL32.dll	227		FindResourceA
KERNEL32.dll	416		GetProcAddress
KERNEL32.dll	386		GetModuleHandleW
KERNEL32.dll	185		ExitProcess
KERNEL32.dll	381		GetModuleFileNameA
KERNEL32.dll	604		LocalFree
KERNEL32.dll	600		LocalAlloc
KERNEL32.dll	52		CloseHandle
KERNEL32.dll	552		InterlockedDecrement
KERNEL32.dll	152		EnterCriticalSection
KERNEL32.dll	593		LeaveCriticalSection
KERNEL32.dll	547		InitializeCriticalSection
KERNEL32.dll	504		GlobalAlloc
KERNEL32.dll	511		GlobalFree
KERNEL32.dll	676		QueryPerformanceFrequency
KERNEL32.dll	675		QueryPerformanceCounter
KERNEL32.dll	479		GetTickCount
KERNEL32.dll	613		LockResource
KERNEL32.dll	854		Sleep
KERNEL32.dll	439		GetStartupInfoA
KERNEL32.dll	383		GetModuleHandleA
ADVAPI32.dll	586		StartServiceCtrlDispatcherA
ADVAPI32.dll	524		RegisterServiceCtrlHandlerA
ADVAPI32.dll	52		ChangeServiceConfig2A
ADVAPI32.dll	580		SetServiceStatus
ADVAPI32.dll	429		OpenSCManagerA
ADVAPI32.dll	100		CreateServiceA
ADVAPI32.dll	62		CloseServiceHandle
ADVAPI32.dll	585		StartServiceA
ADVAPI32.dll	150		CryptGenRandom
ADVAPI32.dll	133		CryptAcquireContextA
ADVAPI32.dll	431		OpenServiceA
WS2_32.dll		3
WS2_32.dll		16
WS2_32.dll		19
WS2_32.dll		8
WS2_32.dll		14
WS2_32.dll		115
WS2_32.dll		12
WS2_32.dll		10
WS2_32.dll		18
WS2_32.dll		9
WS2_32.dll		23
WS2_32.dll		4
WS2_32.dll		11
MSVCP60.dll	267		public: __thiscall std::_Lockit::~_Lockit(void) ??1_Lockit@std@@QAE@XZ
MSVCP60.dll	162		public: __thiscall std::_Lockit::_Lockit(void) ??0_Lockit@std@@QAE@XZ
iphlpapi.dll	28		GetAdaptersInfo
iphlpapi.dll	64		GetPerAdapterInfo
WININET.dll	146		InternetOpenA
WININET.dll	147		InternetOpenUrlA
WININET.dll	105		InternetCloseHandle
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	449		_stricmp
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	106		__p__commode
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	271		_initterm
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	143		_acmdln
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	183		_controlfp
MSVCRT.dll	585		exit
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	211		_exit
MSVCRT.dll	390		_onexit
MSVCRT.dll	85		__dllonexit
MSVCRT.dll	606		free
MSVCRT.dll	15		void * __cdecl operator new(unsigned int) ??2@YAPAXI@Z
MSVCRT.dll	241		_ftol
MSVCRT.dll	690		sprintf
MSVCRT.dll	197		_endthreadex
MSVCRT.dll	705		strncpy
MSVCRT.dll	678		rand
MSVCRT.dll	166		_beginthreadex
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	692		srand
MSVCRT.dll	720		time
MSVCRT.dll	98		__p___argc

VS_FIXEDFILEINFO

dwSignature	0
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
StrucVersion	0
FileFlagsMask	0
FileFlags	0
FileOS	0
FileType	0
FileSubtype	0

show previews

offset	size	type	comment
0	3723264	EXE	11/20/2010 09:03:08	#
15c1	15	HTM		#
42194	3446325	ZIP		#
38d000	1519612	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 5242876 bytes (5120 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] invalid VS_VERSIONINFO child type "\x00\x00\x00\x00\x00\x00"

wc_content.raw-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

VS_FIXEDFILEINFO

wc_content.raw
-