Ransomware · Ransomworm · Worm
WannaCry - invoice_greenanimals.pdf.exe
- Author
- Moise Medici
- Updated
- 15 Feb 2026 · Completed
- Difficulty
- Medium
- Platform
- Family
- Languages
- MITRE
Full Import Address Table
| Function | DLL | Attack Usage | Description | Docs |
|---|---|---|---|---|
| CryptAcquireContextA | ADVAPI32.dll | Ransomware | CryptAcquireContextA is used to acquire a handle to a particular key container within a particular cryptographic service provider (CSP) | https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptacquirecontexta |
| ioctlsocket | WS2_32.dll | Internet | ioctlsocket takes control of the I/O mode of a socket in any state | https://docs.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-ioctlsocket |
| InternetOpenA | WININET.dll | Internet | InternetOpenA is used to initialize the use of WinINet functions. | https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopenurla |
| InternetOpenUrlA | WININET.dll | Internet | InternetOpenUrlA is used to open a resource specified by a complete FTP or HTTP URL. | https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetopenurla |
| InternetCloseHandle | WININET.dll | Internet | InternetCloseHandle is used to close an internet handle. | https://docs.microsoft.com/en-us/windows/win32/api/wininet/nf-wininet-internetclosehandle |
| WaitForSingleObject | KERNEL32.dll | InjectionEvasion | WaitForSingleObject is used to delay the execution of an object. This function is commonly used to allow time for shellcode being executed within a thread to run. It is also used for time-based evasion. | https://docs.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-waitforsingleobject |
| GetProcAddress | KERNEL32.dll | InjectionEvasion | GetProcAddress is used to get the memory address of a function in a DLL. This is often used by malware for obfuscation and evasion purposes to avoid having to call the function directly. | https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getprocaddress |
| GetModuleHandleA | KERNEL32.dll | InjectionEvasion | GetModuleHandleW is used to retrieve a module handle for the specified module. The module must have been loaded by the calling process. This function is often used along with GetProcAddress to dynamically retrieve the address of a function for evasion purposes. | https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulehandlea |
| LocalAlloc | KERNEL32.dll | Injection | LocalAlloc is used for heap allocation and manipulation. | https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-localalloc |
| GlobalAlloc | KERNEL32.dll | Injection | GlobalAlloc is used to allocate the specified number of bytes from the heap. | https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-globalalloc |
| CreateFileA | KERNEL32.dll | Helper | CreateFileA is used to create a new file or opens an existing file. | https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea |
| MoveFileExA | KERNEL32.dll | Helper | MoveFileExA is used to move an existing file or a directory, including its children. | https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-movefileexa |
| TerminateThread | KERNEL32.dll | Helper | TerminateThread is used to terminate a thread. | https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-terminatethread |
| FindResourceA | KERNEL32.dll | Helper | FindResourceA is used to find a resource in an executable or loaded DLL. Malware sometimes uses resources to store strings, configuration information, or other malicious files. If you see this function used, check for a .rsrc section in the malware’s PE header. | https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-findresourcea |
| GetModuleFileNameA | KERNEL32.dll | Helper | GetModuleFileNameA is used to return the filename of a module that is loaded in the current process. Malware can use this function to modify or copy files in the currently running process. | https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulefilenamea |
| StartServiceCtrlDispatcherA | ADVAPI32.dll | Helper | StartServiceCtrlDispatcherA is used by a service to connect the main thread of the process to the service control manager. | https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-startservicectrldispatchera |
| OpenSCManagerA | ADVAPI32.dll | Helper | OpenSCManagerA is used to open a handle to the service control manager. This function is commonly used when a malware intends to interact with a service. | https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-openscmanagera |
| CreateServiceA | ADVAPI32.dll | Helper | CreateServiceA is used to create a service object and adds it to the specified service control manager database. This function is commonly used by malware for persistence. | https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-createservicea |
| StartServiceA | ADVAPI32.dll | Helper | StartServiceA is used to start a service. | https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-startservicea |
| OpenServiceA | ADVAPI32.dll | Helper | OpenServiceA is used to open an existing service. | https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-openservicea |
| LockResource | KERNEL32.dll | EvasionHelper | LockResource is used with FindResource(), LoadResource() and SizeOfResource() usually to work with embedded executables into the .rsrc section (droppers) | https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-lockresource |
| Sleep | KERNEL32.dll | EvasionAnti-Debugging | Sleep is used to suspend the execution of the current thread for a set time. This function is commonly used for time-based evasion by adding delays in the code. | https://docs.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-sleep |
| LoadResource | KERNEL32.dll | Evasion | LoadResource is used to load a resource from a PE file into memory. Malware sometimes uses resources to store strings, configuration information, or other malicious files. | https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadresource |
| GetCurrentThreadId | KERNEL32.dll | Enumeration | GetCurrentThreadId is used to retrieve the thread identifier of the calling thread. | https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-getcurrentthreadid |
| GetCurrentThread | KERNEL32.dll | Enumeration | GetCurrentThread is used to retrieve a handle for the calling thread. | https://docs.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-getcurrentthread |
| GetAdaptersInfo | iphlpapi.dll | Enumeration | GetAdaptersInfo is used to obtain information about the network adapters on the system. This function is commonly used by malware for enumeration purposes. | https://docs.microsoft.com/en-us/windows/win32/api/iphlpapi/nf-iphlpapi-getadaptersinfo |
| QueryPerformanceFrequency | KERNEL32.dll | Anti-Debugging | QueryPerformanceFrequency is used to retrieve the frequency of the performance counter. This function is commonly used by malware for anti-debugging purposes. The malware will measure the time before and after an operation, if the time exceeds taken expected time, the malware will terminate or activate a benign function. | https://docs.microsoft.com/en-us/windows/win32/api/profileapi/nf-profileapi-queryperformancefrequency |
| QueryPerformanceCounter | KERNEL32.dll | Anti-Debugging | QueryPerformanceCounter is used to retrieve the frequency of the performance counter. This function is commonly used by malware for anti-debugging purposes. The malware will measure the time before and after an operation, if the time exceeds taken expected time, the malware will terminate or activate a benign function. | https://docs.microsoft.com/en-us/windows/win32/api/profileapi/nf-profileapi-queryperformancecounter |
| GetTickCount | KERNEL32.dll | Anti-Debugging | GetTickCount is used to retrieve the number of milliseconds since bootup. This function is used by malware for anti-debugging purposes. | https://docs.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-gettickcount |
| InterlockedIncrement | KERNEL32.dll | |||
| ReadFile | KERNEL32.dll | |||
| GetFileSize | KERNEL32.dll | |||
| SizeofResource | KERNEL32.dll | |||
| GetModuleHandleW | KERNEL32.dll | |||
| ExitProcess | KERNEL32.dll | |||
| LocalFree | KERNEL32.dll | |||
| CloseHandle | KERNEL32.dll | |||
| InterlockedDecrement | KERNEL32.dll | |||
| EnterCriticalSection | KERNEL32.dll | |||
| LeaveCriticalSection | KERNEL32.dll | |||
| InitializeCriticalSection | KERNEL32.dll | |||
| GlobalFree | KERNEL32.dll | |||
| GetStartupInfoA | KERNEL32.dll | |||
| RegisterServiceCtrlHandlerA | ADVAPI32.dll | |||
| ChangeServiceConfig2A | ADVAPI32.dll | |||
| SetServiceStatus | ADVAPI32.dll | |||
| CloseServiceHandle | ADVAPI32.dll | |||
| CryptGenRandom | ADVAPI32.dll | |||
| closesocket | WS2_32.dll | |||
| recv | WS2_32.dll | |||
| send | WS2_32.dll | |||
| htonl | WS2_32.dll | |||
| ntohl | WS2_32.dll | |||
| WSAStartup | WS2_32.dll | |||
| inet_ntoa | WS2_32.dll | |||
| select | WS2_32.dll | |||
| htons | WS2_32.dll | |||
| socket | WS2_32.dll | |||
| connect | WS2_32.dll | |||
| inet_addr | WS2_32.dll | |||
| ??1_Lockit@std@@QAE@XZ | MSVCP60.dll | |||
| ??0_Lockit@std@@QAE@XZ | MSVCP60.dll | |||
| GetPerAdapterInfo | iphlpapi.dll |