Ransomware · Ransomworm · Worm

WannaCry - invoice_greenanimals.pdf.exe

Author: Moise Medici
Updated: 15 Feb 2026 · Completed
Difficulty: Medium
Platform: Windows
Capabilities: Command and Control C2 Communication Command Execution via Powershell Cmd Bash File Encryption Persistence Mechanisms
Tags: C++WannaCryptor

Question 6 and Question 10

Opening the sample with Ghidra, Windows → Defined Strings can be used to locate the URL. From there, searching the URL, clicking on the reference found, and following it lands in the .data area of the PE file that stores the URL.

Fig. 12: The hardcoded URL at 004313d0 in Ghidra's Defined Strings, with three cross references into FUN_00408140.

Right click on the address of the reference (in this case 004313d0): References → Show References To Addresses. There will be 3 entries:

The one marked as “DATA” is the reference just clicked on.
The two other entries marked as “READ” are addresses where the URL is read.

Fig. 13: The three references to that string, one DATA at 0040814a and two READ at 00408155 and 00408157.

In this case it is safe to double-click on any of the “READ” addresses; if you look at the “location” address, they are just one instruction apart, the first at 00408155 and the second at 00408157.

This reveals a list of assembly instructions like this:

Fig. 14: The URL copied onto the stack with MOVSD and MOVSB, a few instructions before the InternetOpenA and InternetOpenUrlA calls.

Notice that the URL has been saved in a memory space using MOVSD and MOVSB, which are just string versions of MOV 10.

Also notice that just a few lines after the MOV of the URL, there is an InternetOpenUrlA call. To confirm which URL the CALL is using, Ghidra usually helps by showing the arguments of functions that it is able to identify, but in this case it is not. This can be improved by going to the “Data Type Manager” (usually on the left side of the window), clicking on winapi_32 → Apply Function Data Types. Once that is done, go to Analysis → One Shot → WindowsPE x86 Propagate External Parameters.

Now all the parameters should be clearly named.

Fig. 15: The same listing after applying the winapi_32 data types, with every PUSH now labelled with the parameter it fills.

Before proceeding, looking at the Microsoft documentation 11 the parameters used are:

1
HINTERNET InternetOpenUrlA(
2
  [in] HINTERNET hInternet,
3
  [in] LPCSTR    lpszUrl,
4
  [in] LPCSTR    lpszHeaders,
5
  [in] DWORD     dwHeadersLength,
6
  [in] DWORD     dwFlags,
7
  [in] DWORD_PTR dwContext
8
);

The function “returns a valid handle to the URL if the connection is successfully established, or NULL if the connection fails.”

The first two parameters are those of most interest. The first one, hInternet, is a handle provided by InternetOpenA, which is called a couple of lines before InternetOpenUrlA. The second parameter of interest is lpszUrl, which is the actual URL. From here, it is useful to go backwards: look at which register contains the lpszUrl content, and see how it gets initialized.

This is the full function code up to the call under investigation:

1
                 *******************************************************
2
                 *                      FUNCTION                       *
3
                 *******************************************************
4
                 undefined FUN_00408140()
5
                    assume FS_OFFSET = 0xffdff000
6
   undefined       AL:1         <RETURN>
7
   undefined1      Stack[-0x1]  local_1                            XREF[1]:   00408177(W)
8
   undefined2      Stack[-0x3]  local_3                            XREF[1]:   0040816c(W)
9
   undefined4      Stack[-0x7]  local_7                            XREF[1]:   00408168(W)
10
   undefined4      Stack[-0xb]  local_b                            XREF[1]:   00408164(W)
11
   undefined4      Stack[-0xf]  local_f                            XREF[1]:   00408160(W)
12
   undefined4      Stack[-0x13  local_13                           XREF[1]:   0040815c(W)
13
   undefined4      Stack[-0x17  local_17                           XREF[1]:   00408158(W)
14
   undefined1      Stack[-0x50  local_50                           XREF[2]:   0040814f(*),
15
                                                                              0040818a(*)
16
                 FUN_00408140                              XREF[1]:   entry:00409b45(c)
17
00408140     SUB      ESP, 0x50
18
00408143     PUSH     ESI
19
00408144     PUSH     EDI                                             ; HINTERNET hInternet for InternetCloseHandle
20
00408145     MOV      ECX, 0xe
21
0040814a     MOV      ESI, s_http://www.iuqerfsodp9ifjaposdfj_004313  ; =
22
                                                                      ; "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergw
23
                                                                      ; ea.com"
24
0040814f     LEA      EDI=>local_50, [ESP + 0x8]
25
00408153     XOR      EAX, EAX
26
00408155     MOVSD.   ES:EDI, ESI=>s_http://www.iuqerfsodp9ifjaposdf  ; =
27
                                                                      ; "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergw
28
                                                                      ; ea.com"
29
00408157     MOVSB    ES:EDI, ESI=>s_http://www.iuqerfsodp9ifjaposdf  ; =
30
                                                                      ; "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergw
31
                                                                      ; ea.com"
32
00408158     MOV      dword ptr [ESP + local_17], EAX
33
0040815c     MOV      dword ptr [ESP + local_13], EAX
34
00408160     MOV      dword ptr [ESP + local_f], EAX
35
00408164     MOV      dword ptr [ESP + local_b], EAX
36
00408168     MOV      dword ptr [ESP + local_7], EAX
37
0040816c     MOV      word ptr [ESP + local_3], AX
38
00408171     PUSH     EAX                                             ; DWORD dwFlags for InternetOpenA
39
00408172     PUSH     EAX                                             ; LPCSTR lpszProxyBypass for InternetOpenA
40
00408173     PUSH     EAX                                             ; LPCSTR lpszProxy for InternetOpenA
41
00408174     PUSH     0x1                                             ; DWORD dwAccessType for InternetOpenA
42
00408176     PUSH     EAX                                             ; LPCSTR lpszAgent for InternetOpenA
43
00408177     MOV      byte ptr [ESP + local_1], AL
44
0040817b     CALL     dword ptr [->WININET.DLL::InternetOpenA]        ; = 0000a7dc
45
00408181     PUSH     0x0                                             ; DWORD_PTR dwContext for InternetOpenUrlA
46
00408183     PUSH     0x84000000                                      ; DWORD dwFlags for InternetOpenUrlA
47
00408188     PUSH     0x0                                             ; DWORD dwHeadersLength for InternetOpenUrlA
48
0040818a     LEA      ECX=>local_50, [ESP + 0x14]
49
0040818e     MOV      ESI, EAX
50
00408190     PUSH     0x0                                             ; LPCSTR lpszHeaders for InternetOpenUrlA
51
00408192     PUSH     ECX                                             ; LPCSTR lpszUrl for InternetOpenUrlA
52
00408193     PUSH     ESI                                             ; HINTERNET hInternet for InternetOpenUrlA
53
00408194     CALL     dword ptr [->WININET.DLL::InternetOpenUrlA]     ; = 0000a7c8
54
0040819a     MOV      EDI, EAX

lpszUrl is contained in ECX. At line 0040818a ECX is loaded with the address of local_50. Tracing local_50 back shows that ESI is first initialized with the URL string at 0040814a, and that string is then copied into the buffer pointed to by EDI (local_50) via MOVSD and MOVSB at 00408155 and 00408157.

1
0040814a     MOV      ESI, s_http://www.iuqerfsodp9ifjaposdfj_004313  ; =
2
                                                                      ; "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
3
0040814f     LEA      EDI=>local_50, [ESP + 0x8]
4
00408155     MOVSD.   ES:EDI, ESI=>s_http://www.iuqerfsodp9ifjaposdf  ; =
5
                                                                      ; "http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"

This shows how local_50 is populated and then used by InternetOpenUrlA as the URL parameter.

After the InternetOpenUrlA call, to understand what is done with the return value, the surrounding code is followed, focusing on the highlighted lines:

1
00408194     CALL     dword ptr [->WININET.DLL::InternetOpenUrlA]          ; = 0000a7c8
2
0040819a     MOV      EDI, EAX
3
0040819c     PUSH     ESI                                                  ; HINTERNET hInternet for InternetCloseHandle
4
0040819d     MOV      ESI, dword ptr [->WININET.DLL::InternetCloseHandle]  ; = 0000a7b2
5
004081a3     TEST     EDI, EDI
6
004081a5     JNZ      LAB_004081bc
7
004081a7     CALL     ESI=>WININET.DLL::InternetCloseHandle
8
004081a9     PUSH     0x0                                                  ; HINTERNET hInternet for InternetCloseHandle
9
004081ab     CALL     ESI=>WININET.DLL::InternetCloseHandle
10
004081ad     CALL     FUN_00408090                                         ; undefined FUN_00408090()
11
004081b2     POP      EDI
12
004081b3     XOR      EAX, EAX
13
004081b5     POP      ESI
14
004081b6     ADD      ESP, 0x50
15
004081b9     RET      0x10
16
                                                                           ;004081bc is below here

The return value of InternetOpenUrlA is in EAX, which is immediately moved into EDI and then tested. Since TEST is an implied AND instruction (it does not change the value of EDI but just computes EDI AND EDI and sets flags), the JNZ is used to check the zero flag set by TEST EDI, EDI, meaning:

If the connection was successful → EDI is not zero → TEST EDI, EDI sets ZF to 0 → jump to LAB_004081bc.
If the connection was not successful → EDI is zero → TEST EDI, EDI sets ZF to 1 → execution continues to 004081a7 and FUN_00408090 is executed.

When the connection is successful, the code at LAB_004081bc is straightforward: a call to InternetCloseHandle and end of the function.

1
                 LAB_004081bc                              XREF[1]:   004081a5(j)
2
004081bc     CALL     ESI=>WININET.DLL::InternetCloseHandle
3
004081be     PUSH     EDI                                             ; HINTERNET hInternet for InternetCloseHandle
4
004081bf     CALL     ESI=>WININET.DLL::InternetCloseHandle
5
004081c1     POP      EDI
6
004081c2     XOR      EAX, EAX
7
004081c4     POP      ESI
8
004081c5     ADD      ESP, 0x50
9
004081c8     RET      0x10

To see where it returns, Window → Function Call Tree shows the Incoming Calls menu containing entry. Double-clicking it shows the code that calls the function under examination, from the entry function. This shows that if the connection is successful, the program is terminated by calling MSVCRT.DLL::exit.

1
00409b45     CALL     FUN_00408140                                    ; undefined FUN_00408140()
2
00409b4a     MOV      dword ptr [EBP + local_6c], EAX
3
00409b4d     PUSH     EAX                                             ; int _Code for exit
4
00409b4e     CALL     dword ptr [->MSVCRT.DLL::exit]                  ; = 0000a8c2

If the connection fails, FUN_00408090 is executed. Looking briefly at this function shows calls to OpenSCManagerA, OpenServiceA, etc., implying that the rest of the program is executed.

This shows that the URL is actually used as a kill switch: if there is a connection to the URL, the program is terminated. The sample can be stopped from fully executing by simply allowing it to resolve the domain name.