WannaCry - invoice_greenanimals.pdf.exe

Question 15

This question is relatively simple to answer from the capture that can be extracted in the current environment. The sample tries to contact multiple IP addresses, likely random, for an SMB open server. The connections are on TCP port 445, which is the standard port for SMB; however, since in the environment no hosts have SMB open and there is no connectivity with the outside, the packets are all SYN without a reply.