🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WannaCry


Vendor detections: 19


Intelligence 19 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c
SHA3-384 hash: 9da41993d78194bab8755a669be0535b9b449ac447b891871052ddc7849181849092d620fe3ca621b33792921771db2f
SHA1 hash: e003ec10d87f3e1cc1039515fa79da33310c8f66
MD5 hash: 937b152cd14bf6d9c11901425cfbc549
humanhash: oscar-quebec-saturn-glucose
File name:0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c
Download: download sample
Signature WannaCry
Create hunting rule
File size:2'281'472 bytes
First seen:2025-12-16 08:46:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9ecee117164e0b870a53dd187cdd7174 (82 x WannaCry, 1 x Worm.Virut)
ssdeep 49152:QnnMSPbcBVQej/1INx+TSqTdXP6SAy/utMv12f:QnPoBhz1axcSU96SAr
TLSH T1CFB5128A736851B8F025A271C4A74B16EBF33C991377534F9FD08AB61F13B946A24723
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10522/11/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter JAMESWT_WT
Tags:38-55-205-7 exe WannaCry

Intelligence

File Origin
# of uploads :
1
# of downloads :
378
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Malware family:
wannacry
Create hunting rule
ID:
1
File name:
0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c
Verdict:
Malicious activity
Analysis date:
2025-12-16 08:48:52 UTC
Tags:
ransomware wannacry
Link:
https://app.any.run/tasks/c2dbad8f-6079-4d01-b8d2-3c36795e9079

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45182/
Detection(s):
Win.Ransomware.Wanna-9769986-0
Create hunting rule

Win.Ransomware.Wanacryptor-9942127-1
Create hunting rule

Win.Ransomware.WannaCry-10011460-0
Create hunting rule

Win.Ransomware.Wannacry-6803937-0
Create hunting rule

Win.Ransomware.Wannacrypt-6804263-0
Create hunting rule

Win.Ransomware.WannaCry-6313787-0
Create hunting rule

Win.Malware.Djwy-6775897-0
Create hunting rule

Win.Malware.Djwy-6923377-0
Create hunting rule

BC.Win.Exploit.Exe_With_CVE_2017_0147-6316126-2
Create hunting rule

Win.Exploit.Doublepulsar-7427328-0
Create hunting rule

SecuriteInfo.com.Trojan.DownLoader46.24199.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69411c944d2b81828c3b453a
Tags:
ransomware wannacry virus overt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending an HTTP GET request to an infection source
Creating a service
Launching a service
Restart of the analyzed sample
Searching for synchronization primitives
Connection attempt
Sending a custom TCP request
Query of malicious DNS domain
Connection attempt to an infection source
Enabling autorun for a service
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd crypt crypto cryptolocker CVE-2017-0147 eternalblue exploit lolbin microsoft_visual_cc overlay overlay packed packed ransomware smb unsafe wanna wannacry wannacry wannacrypt wannacryptor wcry zero
Link:
https://www.filescan.io/uploads/69411c92e126b9ff4382218d/reports/0f56a42c-bf05-4518-af27-1633afadfdb4/overview
Verdict:
Malicious
Labled as:
CVE-2017-0147
Link:
https://www.hybrid-analysis.com/sample/0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c
Verdict:
Malicious
File Type:
exe x32
First seen:
2024-09-15T09:50:00Z UTC
Last seen:
2024-09-15T10:13:00Z UTC
Hits:
~10
Detections:
Trojan-Ransom.Win32.Wanna.sb Trojan.Win32.EquationDrug.sb Trojan.Win32.Eb.a HEUR:Worm.Win32.Generic HEUR:Exploit.Win32.MS17-010.gen Trojan-Ransom.Wanna.UDP.C&C PDM:Trojan.Win32.Generic Exploit.Win32.MS17-010.kpn Trojan-Ransom.Win32.Wanna.m Trojan.Win32.Eb.b HEUR:Trojan-Ransom.Win32.Wanna.gen HEUR:Trojan.Win32.EquationDrug.gen
Link:
https://opentip.kaspersky.com/0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c/results?tab=lookup
Malware family:
Mimikatz
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6de0adb7-359e-406d-8dfa-380c87b7c730
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) Win 32 Exe x86
Link:
https://app.malva.re/file/937b152cd14bf6d9c11901425cfbc549
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c/
Verdict:
Malicious
Threat:
Family.WANNACRY
Link:
https://tip.neiki.dev/file/0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c
Threat name:
Win32.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2024-09-15 10:55:00 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
35 of 36 (97.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=btual7n7aeucfp4du3dbtclfdtpb24glnpukfgi7jzukx7bfqooa._file
Verdict:
malicious
Label(s):
wannacryptor
Create hunting rule
Similar samples:
error
WannaCry
Result
Malware family:
wannacry
Create hunting rule
Score:
  10/10
Tags:
family:wannacry discovery ransomware worm
Link:
https://tria.ge/reports/251216-kpxn8sxkep/
Behaviour
Modifies data under HKEY_USERS
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
Creates a large amount of network flows
Executes dropped EXE
Contacts a large (3257) amount of remote hosts
Wannacry
Wannacry family
Verdict:
Malicious
Tags:
ransomware wannacryptor Win.Ransomware.Wanna-9769986-0
YARA:
Wanna_Cry_Ransomware_Generic MS17_010_WanaCry_worm WannaDecryptor NHS_Strain_Wanna WannaCry_Ransomware_Dropper WannaCry_SMB_Exploit wannacry_static_ransom worm_ms17_010 ransomware_windows_wannacry WannaCry_Ransomware WannaCry_Ransomware_Gen
Link:
https://app.threat.zone/submission/8932632c-bad8-4a02-ac80-aa9e528f1021
Unpacked files
SH256 hash:
0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c
MD5 hash:
937b152cd14bf6d9c11901425cfbc549
SHA1 hash:
e003ec10d87f3e1cc1039515fa79da33310c8f66
Detections:
WannaCry
Create hunting rule
Link:
https://www.unpac.me/results/9312c7b7-f4fb-421c-917b-13e94f462630/
Malware family:
WannaCry
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0ce805fdbf01/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0ce805fdbf012822bf83a6c61989651cde1d70cb6be8a2991f4e68abfc25839c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:WannaCry_Ransomware
Create hunting rule
Author:Florian Roth (Nextron Systems) (with the help of binar.ly)
Description:Detects WannaCry Ransomware
Reference:https://goo.gl/HG2j5T
Rule name:WannaCry_Ransomware_Gen
Create hunting rule
Author:Florian Roth (Nextron Systems) (based on rule by US CERT)
Description:Detects WannaCry Ransomware
Reference:https://www.us-cert.gov/ncas/alerts/TA17-132A
Rule name:WannaCry_Ransomware_Gen_RID302B
Create hunting rule
Author:Florian Roth (based on rule by US CERT)
Description:Detects WannaCry Ransomware
Reference:https://www.us-cert.gov/ncas/alerts/TA17-132A

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/45182/

Comments