← Reports

Ransomware · Ransomworm · Worm

WannaCry - invoice_greenanimals.pdf.exe

Author
Moise Medici
Updated
15 Feb 2026 · Completed
Difficulty
Medium
Platform
Windows
Capabilities
Command and Control C2 CommunicationCommand Execution via Powershell Cmd BashFile EncryptionPersistence Mechanisms
Tags
C++WannaCryptor

Appendix

  • 1 MalwareLearn: Load Resources
  • 2 Microsoft: icacls
  • 3 Microsoft: attrib
  • 4 Microsoft: Interprocess Communication
  • 5 Microsoft: GetTempPathW function
  • 6 Microsoft: GetWindowsDirectoryW function
  • 7 Microsoft: GetLogicalDrives function
  • 8 Microsoft: FindFirstFileW function
  • 9 Microsoft: LoadLibrary function
  • 10 x86 and amd64 instruction reference: MOVS/MOVSB/MOVSW/MOVSD/MOVSQ - Move Data From String to String
  • 11 Microsoft: InternetOpenUrlA function
  • 12 Microsoft: sprintf function
  • 13 Microsoft: CreateProcess function
  • 14 Microsoft: GetProcAddress function
  • 15 Microsoft: CreateFile function
  • 16 Microsoft: EnterCriticalSection function
  • 17 Microsoft: ReadFile function
  • 18 Microsoft: CryptDecrypt function
  • 19 Microsoft: memcpy function
  • 20 Wikipedia: Rijndael S-box
  • 21 Github: Christophe Devine AES Implementation
  • 22 Microsoft: GlobalAlloc function
  • 23 Microsoft: GetFileAttributes function
  • 24 Microsoft: GetCurrentDirectoryA function
  • 25 Microsoft: WaitForSingleObject function
  • 26 Microsoft: GetModuleFileName function
  • 27 Microsoft: SetCurrentDirectory function
  • 28 Microsoft: GetUserNameW function
  • 29 Microsoft: Well-known SIDs
  • 30 Microsoft: GetCurrentProcess function
  • 31 Microsoft: GetTokenInformation function
  • 32 Microsoft: ConvertSidToStringSid function
  • 33 Microsoft: InitializeCriticalSection function
  • 34 Microsoft: DeleteCriticalSection function
  • 35 Microsoft: CryptGenRandom function
  • 36 Microsoft: CryptReleaseContext function
  • 37 Filedesc.com: Details of extension .pky
  • 38 Microsoft: GetDriveTypeW function
  • 39 Microsoft: GetTempPath function
  • 40 Microsoft: WIN32_FIND_DATA structure
  • 41 Microsoft: File attributes constants
  • 42 Microsoft: GetTempFileNameW function
  • 43 SentinelOne: EternalBlue Exploit: What It Is And How It Works
  • 44 Microsoft: 2.2.2.1 SMB_COM Command Codes