wannacry

Kill-Switch Analysis Report

RANSOMWARE-WORM // KILL-SWITCH STUDY // 2026

focus: kill switch 32-bit windows pe hardcoded domain check wininet api sequence
Archive banner

[ DISCLAIMER: For Defensive Use Only ]

Summary

ANALYSIS SCOPE / KILL-SWITCH BEHAVIOR

01 // Scope

Overview

This report examines WannaCry's hardcoded-domain kill switch. The analysis focuses on how the sample checks whether the domain is reachable and how the result influences execution.

Static analysis identified the domain string and the WinINet API sequence used to contact it. Dynamic analysis was then used to observe the sample's behavior when the domain lookup succeeded and when it was unavailable.

SCOPE This report does not analyze WannaCry's encryption, persistence, resource extraction, network propagation, or dropped payloads in detail.

Static Analysis

SAMPLE IDENTIFICATION / STRINGS / PE STRUCTURE

01

Sample identification

The analyzed sample was identified as a 32-bit Windows Portable Executable:

Ransomware.wannacry.exe.malz: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

SHA-256:

24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c

Sample architecture and SHA-256 identifier.

02

Hardcoded domain

FLOSS string extraction revealed the following hardcoded domain:

http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

The domain was selected for the sample's connectivity check. Its presence alone does not prove the complete runtime behavior, so the control flow and dynamic results were examined separately.

Hardcoded domain identified during string analysis.

Code Analysis

CONTROL FLOW / WININET / EXECUTION GATE

01

Network-check sequence

The sample uses a WinINet call sequence to test whether the hardcoded domain can be reached (check Microsoft's documentation for more information):

1.InternetOpenA → initialize an Internet session
2.InternetOpenUrlA → request the hardcoded domain
3.InternetCloseHandle → close the returned handle
4.test / conditional branch → evaluate whether the request succeeded

Simplified execution flow of the kill-switch check.

02

Conditional branch

The returned network handle is tested before the sample continues through its normal execution path:

004081a3 test edi, edi
004081a5 jne 0x4081bc ; non-null result diverts execution
STATIC FINDING The network result acts as an execution gate. A successful request and a failed request follow different control-flow paths. The exact effect of the alternate path should be described as confirmed only where it was observed during dynamic analysis.

Dynamic Analysis

DNS RESOLUTION / EXECUTION BEHAVIOR / ISOLATED TESTING

01

Kill-switch confirmation

In an isolated REMnux VM, that is running INetSim, the domain lookup was allowed to succeed. Wireshark captured the DNS request associated with the hardcoded domain.

Wireshark capture showing the kill-switch DNS request Wireshark capture showing related kill-switch traffic

Wireshark capture of the kill-switch DNS lookup.

The sample then followed the alternate execution path instead of continuing through its normal payload flow, causing the payload to self-distruct instead. This dynamic result supports the conclusion that the domain check functions as an execution gate.

02

Behavior when the domain is unavailable

When the simulated network was disabled and the domain could not be reached, the sample continued beyond the connectivity check. This result is consistent with the branch behavior identified during static analysis.

DYNAMIC FINDING Domain reachability changed the sample's execution path. The test supports the interpretation that the hardcoded domain operates as a kill switch rather than as a normal command-and-control dependency.

Patch Analysis

DEBUGGER-ASSISTED CONTROL-FLOW TEST

01

Patching the conditional branch

A breakpoint was placed before the network-check result was evaluated. The conditional branch was then modified at runtime so execution would continue regardless of the DNS result.

Debugger showing the kill-switch branch Modified conditional branch in the debugger

Modifying the conditional branch used by the kill switch.

RESULT With the branch modified, the sample continued execution while the domain was reachable. This confirms the network check is strictly an execution gate, not a functional dependency: payload logic is otherwise independent of network availability.

[ WARNING: Potentially Malicious Link — Do Not Open ]

Indicator of Compromise

KILL-SWITCH DOMAIN

Category Indicator Notes
Network iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com Hardcoded domain used by the connectivity check

Appendix A — Callback URL

URL Port
hxxp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com 80