MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04f468bec220fa9dfd4897adf86f28f8ceb04a72806c473cd22e366f716389a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04f468bec220fa9dfd4897adf86f28f8ceb04a72806c473cd22e366f716389a3
SHA3-384 hash: dd3b4067de99bc80ae2d72a0c2d2a806193f195202f169814b1c44688ab26ee86598b9af817c6788e93194d6a58d5037
SHA1 hash: 28f4efd9fbb9bb8e14d2946da97eff28fed682c9
MD5 hash: f42d29367786af1b8919a9d0cbedfd3f
humanhash: oklahoma-six-speaker-nitrogen
File name:iec56w4ibovnb4wc.onion_Library__Ransomeware__WannaCry.exe.malw
Download: download sample
File size:3'514'368 bytes
First seen:2020-03-18 22:47:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 68f013d7437aa653a8a98a05807afeb1 (28 x WannaCry, 1 x Worm.Ramnit)
ssdeep 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAFj:QqPe1Cxcxk3ZAEUadzR8yOj
Threatray 3 similar samples on MalwareBazaar
TLSH 60F533E8A131B76CF3950DF80566C56B3A8715B1FAEF6F2AD78001AA0C44F6F9BC0585
Reporter ov3rflow1
Tags:malw

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Ransomware.WannaCry-6313787-0
Create hunting rule

Win.Malware.Djwy-6775897-0
Create hunting rule

Win.Ransomware.Wannacry-6803937-0
Create hunting rule

Win.Ransomware.Wannacrypt-6804263-0
Create hunting rule

Win.Malware.Djwy-6923377-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wannacrypt
Create hunting rule
Status:
Malicious
First seen:
2017-12-01 21:17:40 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd
19b3c091f3805bd947578183b5f4f77b0cc8bc542527e69cd14f7e1e6337351d
773186144282a63cc3502ad10a3d8fd781a6c83eaabf06de4369b4ef96d93178
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Ransomware
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/04f468bec220fa9dfd4897adf86f28f8ceb04a72806c473cd22e366f716389a3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::GetWindowsDirectoryW
KERNEL32.dll::GetFileAttributesA
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyW
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegSetValueExA
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::CreateServiceA
ADVAPI32.dll::OpenSCManagerA
ADVAPI32.dll::OpenServiceA
ADVAPI32.dll::StartServiceA

Comments