python app.py -f /root/theZoo/test/WannaCry/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe -y 1 -e 1
{
"access_time": 1580971650,
"device": 2049,
"entropy": 0.033813754006364494,
"features": {
"pe_features": {
"anti_debugging_capabilities": [],
"anti_vm_capabilities": [],
"check_sum": 0,
"compile_date": 1290243905,
"datadir_IMAGE_DIRECTORY_ENTRY_BASERELOC_size": 0,
"datadir_IMAGE_DIRECTORY_ENTRY_EXPORT_size": 0,
"datadir_IMAGE_DIRECTORY_ENTRY_IAT_size": 472,
"datadir_IMAGE_DIRECTORY_ENTRY_IMPORT_size": 100,
"datadir_IMAGE_DIRECTORY_ENTRY_RESOURCE_size": 3448736,
"debug_size": 0,
"export_size": 0,
"generated_check_sum": 3551250,
"iat_rva": 54696,
"import_bound_symbols": [],
"import_symbols": [
"GetFileAttributesW",
"wsprintfA",
"CreateServiceA",
"realloc"
],
"major_version": 0,
"minor_version": 0,
"number_of_bound_import_symbols": -1,
"number_of_bound_imports": -1,
"number_of_export_symbols": -1,
"number_of_import_symbols": 114,
"number_of_imports": 4,
"number_of_rva_and_sizes": 16,
"number_of_sections": 4,
"pe_char": 271,
"pe_dll": 0,
"pe_driver": 0,
"pe_exe": 1,
"pe_i386": 1,
"pe_majorlink": 6,
"pe_minorlink": 0,
"pe_warnings": 0,
"sec_entropy_data": 4.455749507869132,
"sec_entropy_rdata": 6.663570968407935,
"sec_entropy_reloc": -1,
"sec_entropy_rsrc": 7.999867975099674,
"sec_entropy_text": 6.404235106100745,
"sec_raw_execsize": 3506712,
"sec_rawptr_data": 57344,
"sec_rawptr_rdata": 32768,
"sec_rawptr_rsrc": 65536,
"sec_rawptr_text": 4096,
"sec_rawsize_data": 8192,
"sec_rawsize_rdata": 24576,
"sec_rawsize_rsrc": 3448832,
"sec_rawsize_text": 28672,
"sec_va_execsize": 3510272,
"sec_vasize_data": 6488,
"sec_vasize_rdata": 24432,
"sec_vasize_rsrc": 3448736,
"sec_vasize_text": 27056,
"size_code": 28672,
"size_image": 3514368,
"size_initdata": 3481600,
"size_uninit": 0,
"std_section_names": 1,
"total_size_pe": 3514368,
"virtual_address": 4096,
"virtual_size": 27056,
"virtual_size_2": 24432
},
"pe_rare_features": {
"imported_symbols": -1,
"pe_warning_strings": -1,
"section_names": [
".text",
".rdata",
".data",
".rsrc"
]
}
},
"file_name": "wannacry.exe",
"file_path": "/root/theZoo/test/test/wannacry.exe",
"file_size_not_multiple_8": 0,
"group_id_of_owner": 0,
"inode_number": 664945,
"macro": 1,
"magic_buffer": "PE32 executable (GUI) Intel 80386, for MS Windows",
"magic_info": "PE32 executable (GUI) Intel 80386, for MS Windows",
"md5": "84c82835a5d21bbcf75a61706d8ab549",
"meta_data_change_time": 1580855573,
"mime": "application/x-dosexec",
"min_possible_file_size": 118833.97503983918,
"modification_time": 1494772147,
"no_of_hard_links": 1,
"protection_bytes": 33188,
"sha1": "84c82835a5d21bbcf75a61706d8ab549",
"sha256": "5ff465afaabcbf0150d1a3ab2c2e74f3a4426467",
"size": 3514368,
"user_id_of_owner": 0,
"yara": [
"domain",
"Microsoft_Visual_Cpp_v60",
"WannaCry_Ransomware_Dropper",
"CRC32_poly_Constant",
"WannaCry_Ransomware",
"Microsoft_Visual_Cpp_v50v60_MFC_additional",
"wannacry_static_ransom",
"HasRichSignature",
"Str_Win32_Winsock2_Library",
"CRC32_table",
"RijnDael_AES",
"win_files_operation",
"IsPacked",
"RijnDael_AES_CHAR",
"Wanna_Sample_84c82835a5d21bbcf75a61706d8ab549",
"WannaDecryptor",
"IP",
"contentis_base64",
"IsPE32",
"IsWindowsGUI",
"SEH_Init",
"Microsoft_Visual_Cpp",
"ransom_telefonica",
"Microsoft_Visual_Cpp_50",
"Microsoft_Visual_Cpp_v50v60_MFC",
"win_registry",
"RijnDael_AES_LONG",
"Misc_Suspicious_Strings",
"Wanna_Cry_Ransomware_Generic"
]
}