Suspicious
Suspect

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very low
24 files
EXE77cc800b51c3cd670f4a191cf53a3a82
Structure
Name Value
Info
PE Detect: PeReader OK (file layout)
Info 
PDB Path: C:\Users\Administrator\Desktop\WannaCry-wannacry (1)\WannaCry-wannacry\obj\Release\WannaCrydemo.pdb
Module Name
WannaCrydemo.exe
Full Name
WannaCrydemo.exe
EntryPoint
System.Void WannaCrydemo.Program::Main()
Scope Name
WannaCrydemo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
WannaCrydemo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
81
Main Method
System.Void WannaCrydemo.Program::Main()
Main IL Instruction Count
42
Main IL 
call System.Void WannaCrydemo.Program::ExtractFile()
call System.Void WannaCrydemo.Program::UpdateExtension()
ldnull <null>
ldftn System.Void WannaCrydemo.Program::OnTimerCallback(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
ldnull <null>
ldsfld System.TimeSpan System.TimeSpan::Zero
ldc.r8 15
call System.TimeSpan System.TimeSpan::FromSeconds(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
stsfld System.Threading.Timer WannaCrydemo.Program::httpTimer
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldsfld System.Action WannaCrydemo.Program/<>c::<>9__3_0
dup <null>
brtrue.s IL_005E: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld WannaCrydemo.Program/<>c WannaCrydemo.Program/<>c::<>9
ldftn System.Void WannaCrydemo.Program/<>c::<Main>b__3_0()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action WannaCrydemo.Program/<>c::<>9__3_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
newobj System.Void WannaCrydemo.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
leave.s IL_0091: ret
ldsfld System.Threading.Timer WannaCrydemo.Program::httpTimer
dup <null>
brtrue.s IL_007B: call System.Void System.Threading.Timer::Dispose()
pop <null>
br.s IL_0080: ldsfld System.Threading.CancellationTokenSource WannaCrydemo.Program::cancellationTokenSource
call System.Void System.Threading.Timer::Dispose()
ldsfld System.Threading.CancellationTokenSource WannaCrydemo.Program::cancellationTokenSource
dup <null>
brtrue.s IL_008B: call System.Void System.Threading.CancellationTokenSource::Dispose()
pop <null>
br.s IL_0090: endfinally
call System.Void System.Threading.CancellationTokenSource::Dispose()
endfinally <null>
ret <null>
Module Name
WannaCrydemo.exe
Full Name
WannaCrydemo.exe
EntryPoint
System.Void WannaCrydemo.Program::Main()
Scope Name
WannaCrydemo.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
WannaCrydemo
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
81
Main Method
System.Void WannaCrydemo.Program::Main()
Main IL Instruction Count
42
Main IL 
call System.Void WannaCrydemo.Program::ExtractFile()
call System.Void WannaCrydemo.Program::UpdateExtension()
ldnull <null>
ldftn System.Void WannaCrydemo.Program::OnTimerCallback(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
ldnull <null>
ldsfld System.TimeSpan System.TimeSpan::Zero
ldc.r8 15
call System.TimeSpan System.TimeSpan::FromSeconds(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
stsfld System.Threading.Timer WannaCrydemo.Program::httpTimer
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldsfld System.Action WannaCrydemo.Program/<>c::<>9__3_0
dup <null>
brtrue.s IL_005E: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld WannaCrydemo.Program/<>c WannaCrydemo.Program/<>c::<>9
ldftn System.Void WannaCrydemo.Program/<>c::<Main>b__3_0()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action WannaCrydemo.Program/<>c::<>9__3_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
newobj System.Void WannaCrydemo.Form1::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
leave.s IL_0091: ret
ldsfld System.Threading.Timer WannaCrydemo.Program::httpTimer
dup <null>
brtrue.s IL_007B: call System.Void System.Threading.Timer::Dispose()
pop <null>
br.s IL_0080: ldsfld System.Threading.CancellationTokenSource WannaCrydemo.Program::cancellationTokenSource
call System.Void System.Threading.Timer::Dispose()
ldsfld System.Threading.CancellationTokenSource WannaCrydemo.Program::cancellationTokenSource
dup <null>
brtrue.s IL_008B: call System.Void System.Threading.CancellationTokenSource::Dispose()
pop <null>
br.s IL_0090: endfinally
call System.Void System.Threading.CancellationTokenSource::Dispose()
endfinally <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙