wannacry: 16fdcfbc — May 2017 outbreak DLL, kill-switch + EternalBlue + 27-language ransom note ZIP

Executive Summary

A PE32+ x64 DLL compiled 11 May 2017, mislabeled dionaea by OpenCTI but unmistakably the wannacry outbreak binary. It carries the hardcoded kill-switch URL, the mssecsvr.exe SMB propagation service, a .rsrc-embedded ZIP archive with 27 encrypted ransom-note translations, and service-installation APIs for persistence. No CAPE detonation available; analysis is static-only with radare2 and string forensics.

What It Is

The binary is a DLL with console subsystem (Subsystem: 0x3) ^[pefile.txt:69], intended to be loaded by a launcher or run via rundll32. Export table shows launcher.dll / PlayGame masquerade strings ^[strings.txt:177-178] — a common WannaCry launcher artifact.

How It Works

Kill-Switch Gate

On load, the binary attempts to reach http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com via InternetOpenUrlA ^[strings.txt:656] ^[strings.txt:247-248]. If the GET succeeds, the payload exits without encrypting. This is the famous kill switch discovered by Marcus Hutchins in May 2017. The domain is hardcoded as a plain ASCII string — no encoding. See kill-switch-domain-check for the technique breakdown.

Service Persistence

If the kill switch is not reachable, the DLL installs itself as a Windows service named Microsoft Security Center (2.1) Service ^[strings.txt:646] using OpenSCManagerA → CreateServiceA → StartServiceCtrlDispatcherA ^[strings.txt:231-232] ^[strings.txt:235-236]. The service name mimics a legitimate Windows component for evasion.

SMB Propagation

The binary contains the EternalBlue exploit (CVE-2017-0144) for lateral movement over SMB on TCP/445. Evidence:

• mssecsvr.exe — the known WannaCry propagation service binary name ^[strings.txt:74] ^[strings.txt:297] ^[strings.txt:371]
• \\%s\IPC$ — IPC share path used during SMB exploitation ^[strings.txt:642]
• WS2_32.dll imports for socket creation ^[strings.txt:239]

This is static inference; the actual exploit payload is embedded in the encrypted s.wnry resource and not visible in the outer DLL.

Embedded Resource Payload

The .rsrc section (5,124,608 bytes, 98% of the file) ^[pefile.txt:163-179] contains a password-protected ZIP archive detected by binwalk ^[binwalk.txt]. Contents include:

• c.wnry — encrypted configuration (780 bytes compressed) ^[binwalk.txt:9]
• msg/m_*.wnry — 27 ransom-note translations (Bulgarian through Vietnamese) ^[binwalk.txt:10-38]
• r.wnry — encrypted Tor client (864 bytes compressed) ^[binwalk.txt:39]
• s.wnry — encrypted main payload (~3 MB compressed, ~3.03 MB uncompressed) ^[binwalk.txt:40]

The ZIP is encrypted with ZIP 2.0 password protection. The outer DLL decrypts and extracts these at runtime.

Cryptography

Key generation uses the Microsoft Base Cryptographic Provider:

• CryptAcquireContextA + CryptGenRandom ^[strings.txt:227-228] for RNG
• The ransomware uses RSA-2048 (per public literature) to encrypt per-file AES-128 keys

Decompiled Behavior

Radare2 analysis (level 2, 209 functions) shows a small .text section (~32 KB) with a DLL entry point at 0x1800015ec ^[rabin2-info.txt]. The entry point branches on the DllMain reason code (DLL_PROCESS_ATTACH, DLL_THREAD_ATTACH, etc.) and dispatches to two major function clusters:

• fcn.180001000 — service control dispatcher path (persistence)
• fcn.18000137c — payload execution path (encryption)

The decompiled entry point is heavily CRT-initialized (SEH frames, FLS/TLS setup) with minimal obfuscation. No anti-debug or VM checks are visible in the outer DLL — the binary relies on the kill switch and encrypted inner payload for defense.

The fcn.1800056d0 cluster handles resource enumeration (FindResourceA / LoadResource / LockResource / SizeofResource) ^[strings.txt:109-113], suggesting the ZIP payload is accessed via standard PE resource APIs.

C2 Infrastructure

No hardcoded IP addresses, Bitcoin wallets, or email addresses are visible in the outer DLL. Payment instructions live inside the encrypted msg/m_english.wnry resource.

Interesting Tidbits

• OpenCTI mislabel: The sample is tagged dionaea and exe by OpenCTI ^[triage.json]. It is neither a Dionaea honeypot artifact nor an EXE — it is a DLL. This is a clear false positive from the connector.
• Launcher masquerade: Export names launcher.dll and PlayGame ^[strings.txt:177-178] suggest the binary was distributed as a game crack or cheat loader.
• CRT bloat: The binary links MSVCP60.dll (Visual C++ 6.0 era C++ runtime) despite being compiled with VS2010. This is WannaCry's known build stack.
• Zero packing: No UPX, Themida, or custom packer on the outer DLL. The 5 MB bulk is the encrypted ZIP in .rsrc.
• Kill-switch opsec failure: The domain is hardcoded in plaintext, not even XOR-encoded. A single domain registration by a researcher stopped the initial outbreak globally.

How To Mess With It (Homelab Replication)

Goal: Build a minimal DLL that embeds an encrypted ZIP in .rsrc and checks a kill-switch URL before extraction.

Toolchain: Visual Studio 2010 (v100) or compatible, x64, DLL project.

Steps:

1. Create a Win32 DLL project in VS2010.
2. Add a ZIP file to Resources → Import → custom resource type ZIP.
3. In DllMain, on DLL_PROCESS_ATTACH:
   • InternetOpenA → InternetOpenUrlA("http://your-killswitch.test/check")
   • If HTTP 200, return FALSE (abort)
   • If fail, FindResource / LoadResource to read the ZIP blob
   • Use zlib or miniz to decompress, then AES-decrypt with a hardcoded key
4. Compile with /SUBSYSTEM:CONSOLE to match the WannaCry DLL subsystem.

Verification: Run capa on your reproducer. It should hit load .NET assembly, create service, reference anti-VM string, etc. (capa signatures were unavailable for this sample due to missing ruleset, but the pattern is well-known).

What you'll learn: How PE resource embedding works, how simple a kill-switch circuit-breaker is to implement, and why it is a fragile anti-analysis technique.

Deployable Signatures

YARA Rule

rule WannaCry_KillSwitch_DLL {
    meta:
        description = "WannaCry DLL variant with hardcoded kill-switch and .wnry resources"
        author = "PacketPursuit SOC"
        date = "2026-06-10"
        sha256 = "16fdcfbc4c5d2a7d5e2ccfd28e4b99208797c91315390718de532d9bd9e46d20"
    strings:
        $kill = "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com" ascii wide
        $svc  = "Microsoft Security Center (2.1) Service" ascii wide
        $msse = "mssecsvr.exe" ascii wide
        $task = "tasksche.exe" ascii wide
        $wnry = ".wnry" ascii wide
        $ipc  = "\\%s\\IPC$" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x4550 and
        3 of them
}

Sigma Rule

title: WannaCry Service Installation
detection:
    selection:
        EventID: 7045
        ServiceName: 'Microsoft Security Center (2.1) Service'
    condition: selection

Behavioral Hunt Query (KQL)

DeviceProcessEvents
| where ProcessCommandLine contains "tasksche.exe" or ProcessCommandLine contains "mssecsvr.exe"
| where InitiatingProcessCommandLine !contains "services.exe"
| project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine

IOC List

Behavioral Fingerprint

This DLL, when loaded by a launcher or rundll32, first attempts an outbound HTTP GET to a hardcoded nonsense domain. If the domain resolves and returns data, the process terminates immediately. On failure, it installs itself as a fake "Microsoft Security Center" service for persistence, then extracts an encrypted ZIP payload from its own .rsrc section and begins SMB scanning on TCP/445 for lateral movement. The binary contains no anti-debug checks in the outer layer; its defense is entirely the kill-switch gate and payload encryption.

Detection Signatures

References

• MITRE ATT&CK: WannaCry (S0367) — https://attack.mitre.org/software/S0367/
• Marcus Hutchins kill-switch analysis, May 2017
• Microsoft Security Response Center: CVE-2017-0144 (EternalBlue)
• Wiki: wannacry entity page, ransomware concept page, kill-switch-domain-check technique page

Provenance

• file.txt — file(1) 5.44
• pefile.txt — pefile 2023.2.7
• strings.txt — GNU strings 2.40
• binwalk.txt — binwalk v2.3.4
• rabin2-info.txt — radare2 5.9.4
• exiftool.json — ExifTool 12.76
• triage.json — PacketPursuit triage-fast, 2026-05-26
• Radare2 decompilation — r2mcp, analysis level 2, 209 functions