WannaCry/WannaDecrypt0r is described as a ransomware worm for unpatched Windows systems vulnerable to MS17-010, using EternalBlue for SMB propagation through exposed port 445 or hosts already infected with DOUBLEPULSAR. The factsheet notes that the malware can run in active RDP sessions, install the DOUBLEPULSAR backdoor, corrupt shadow volumes, and encrypt broad classes of documents, archives, media, databases, source code, and key or certificate files. A hard-coded kill-switch domain caused the original worm to exit when reachable, while a later damaged variant removed that check but retained the same encryption keys and Bitcoin addresses. The source also documents per-infection RSA-2048 key generation, AES-128-CBC file encryption, and Microsoft MS17-010 patch guidance for affected Windows versions.