STAGE 2: ANALYZE
Deep Static Binary Analysis Studio
Extract cryptographic fingerprints, PE/ELF section headers, entropy scores, Import Address Table (IAT) mapped to MalAPI.io, and FLOSS deobfuscated strings.
Entropy Rating
7.98 / 8.0
Packed (Custom Zip Archive in Resource Section)
Architecture & Subsystem
x86 (32-bit)
Target OS: Windows
MalAPI Critical Matches
4 Suspicious APIs
Mapped to known threat behaviors
Digital Signature
Unsigned
Compile Time: 2017-05-12 07:05:42 UTC
MalAPI.io Threat API Detections
InternetOpenUrlANetwork
Performs HTTP GET probe to unresolvable killswitch URL.
CryptEncryptCryptography
Encrypts user file streams using imported AES session keys.
CreateServiceAPersistence
Installs autonomous service wrapper for reboot survivability.
CreateProcessAExecution
Launches tasksche.exe and @WanaDecryptor@.exe UI.
Import Address Table (IAT) Breakdown by DLL
| Imported DLL | Function Count | Key Functions | Suspicion Rating |
|---|---|---|---|
| KERNEL32.dll | 7 | CreateProcessA, WriteFile, ReadFile, CreateFileA, MoveFileExA, CreateServiceA, OpenSCManagerA | High |
| ADVAPI32.dll | 5 | CryptAcquireContextA, CryptGenKey, CryptEncrypt, CryptExportKey, CryptImportKey | High |
| WININET.dll | 3 | InternetOpenA, InternetOpenUrlA, InternetCloseHandle | High |
| WS2_32.dll | 5 | WSAStartup, socket, connect, send, recv | Medium |