WannaCry - invoice_greenanimals.pdf.exe

Basic Static Analysis

The very first thing to notice is the double extension .pdf.exe, which on most user systems where file extensions are hidden will appear only as .pdf. This already raises suspicions about the nature of the file.

Starting with FLOSS, it was first run with -n 12, and then without any length filtering. Checking the filtered list first allows a quicker review of what is returned before proceeding to a more fine-grained review.

The first few lines of FLOSS already show some of the potential capabilities that the sample might use to avoid debugging, as both these system calls are used to track how much time it takes to go from two different lines of code. Usually they are followed by a jump to exit if the time is higher than a threshold.

1
GetTickCount
2
QueryPerformanceCounter

The following are used to load a resource from within the program itself. A resource is usually a DLL or another EXE/script that is extracted from within the original sample and often executed. A more in-depth explanation can be found in the Learn section 1.

1
SizeofResource
2
LockResource
3
LoadResource
4
FindResourceA

These are used to create a service:

1
StartServiceA
2
CloseServiceHandle
3
CreateServiceA
4
OpenSCManagerA
5
SetServiceStatus

And to get something from the internet:

1
InternetCloseHandle
2
InternetOpenUrlA
3
InternetOpenA

These might be the names of the resources extracted:

1
launcher.dll
2
mssecsvc.exe

Sometimes when there are identifiers like %s or %d in a line, it might be that the next line is what fills that identifier (%s for strings and %d for digits like IP addresses). So in the case below it might be that the final string is going to be C:\WINDOWS\mssecsvc.exe.

1
C:\%s\%s
2
WINDOWS
3
mssecsvc.exe

Another anti-debugging technique:

1
IsDebuggerPresent

A suspicious path that should be kept in mind for the dynamic analysis:

1
C:\%s\qeriuwjhrf

Another suspicious executable name followed by CreateProcessA, which is used for starting executables.

1
tasksche.exe
2
CreateProcessA

A very suspicious domain:

1
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

Syscalls that allow the executable to write to the registry:

1
RegQueryValueExA
2
RegSetValueExA
3
RegCreateKeyW

And to encrypt data:

1
CryptDecrypt
2
CryptEncrypt
3
CryptDestroyKey
4
CryptImportKey
5
CryptAcquireContextA

In the next four lines there are two interesting strings, the first and last, and two Windows built-in commands: icacls 2 , which allows changing access levels on files and attrib 3 , which with +h sets the file as hidden.

1
t.wnry
2
icacls . /grant Everyone:F /T /C /Q
3
attrib +h .
4
WNcry@2ol7

The following are not necessarily dangerous but are a potential hint that some information might be translated:

1
msg/m_bulgarian.wnry
2
msg/m_chinese (simplified).wnry
3
msg/m_chinese (traditional).wnry
4
msg/m_croatian.wnry
5
msg/m_czech.wnryn
6
msg/m_danish.wnryo

Closer to the end there are two internal IP addresses with \IPC$ at the end, which stands for Interprocess Communication 4 and is used for data sharing between applications.

1
Windows 2000 2195
2
Windows 2000 5.0
3
\172.16.99.5\IPC$
4
Windows 2000 2195
5
Windows 2000 5.0
6
\192.168.56.20\IPC$
7
diskpart.exe

Lastly, there is a WanaCrypt0r string that hints that the sample could be a WannaCry sample, followed by a list of extensions which are probably the file types targeted for the encryption process.

1
WanaCrypt0r
2
Software\
3
.der
4
.pfx
5
.key
6
.crt
7
.csr
8
.p12
9
.pem
10
.odt
11
.ott

See Appendix A for the whole list of file extensions used.

Loading the sample in pestudio reveals a few details.

On the landing page of pestudio, the names → versions → original-file-name is set to lhdfrgui.exe and the file → description is Microsoft® Disk Defragmenter, which are both legitimate values for the Windows “Defragment and Optimize Drives” utility. It is also interesting to compare the real lhdfrgui.exe file in C:\Windows\system32\lhdfrgui.exe (on the right side of the screenshot) with the sample from the pestudio version page and notice all the mirroring happening, which again increases suspicion about the sample, given that it was meant to be a PDF.

Also in the resources page there is indeed a resource entry as suspected by the resource-related entries in the FLOSS output. Note that the location starts from address 0x000320A4, which will be useful in a moment.

Moving to the sections page, which shows the different sections of the PE file, note the last column called .rsrc: it takes almost 95% of the size of the executable and at the very bottom you can see it starts from the same address found above. This means the resource will probably be extracted quite early in the program execution and will do all the heavy lifting, given that the vast majority of the code resides in that secondary file. The address helped confirm that the resource found in the resources page is the same analyzed in the sections page.

Also note that because of what has been mentioned above, it is very likely that most of the capabilities and Windows system calls observed so far are actually used and extracted by the resource code.

As a last step in the static analysis, capa was run to see if at a high level anything had been missed. In this case the results align with what has been found, but they might still be useful later on when going through the code with Ghidra.