WannaCry - invoice_greenanimals.pdf.exe

Other Open Questions

At this point, looking at the other questions, they cannot be directly answered without doing further research in the code and running the sample through a debugger.

A useful process in this situation is to understand more about the code blocks and rename functions based on what they do; this helps clarify the code structure. While looking at the code, it is also useful to identify potential good places for breakpoints in the debugger. Currently it is not obvious which question will be answered first, so the focus is on:

• how launcher.dll might be loaded
• how the resource is loaded and decrypted
• whether there is anything related to the IP connections

Functions are therefore renamed based on their purpose:

• FUN_00407c40 → service_creation
• FUN_00408090 → service_open
• FUN_00408140 → kill_switch_check
• FUN_00407ce0 → resource_extraction_c_windows