MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ce7eb9db4dc18eb57c678cf29f30246ee1398fe54184871e5b34b8cf68a9abd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WannaCry

Vendor detections: 14

Intelligence 14 IOCs YARA 9 File information Comments

SHA256 hash:	1ce7eb9db4dc18eb57c678cf29f30246ee1398fe54184871e5b34b8cf68a9abd
SHA3-384 hash:	c3c8ea5449f56d76da7d6697fefefa0f7e3ded14836f698f19641449591039e93dd3bbc2aac300f222aef371254eb36d
SHA1 hash:	83351a0f33c4bc5fb19d50319c5392179de37ae7
MD5 hash:	78fe2a3c6511116c8b01ae113a0d4fb0
humanhash:	black-red-video-skylark
File name:	1ce7eb9db4dc18eb57c678cf29f30246ee1398fe54184871e5b34b8cf68a9abd
Download:	download sample
Signature	WannaCry Create hunting rule
File size:	1'366'016 bytes
First seen:	2026-06-14 08:15:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0cdadfa1098d845dd3b4cf92625b5f04 (400 x WannaCry)
ssdeep	24576:jbLg+bLgurgDdmMSirYbcMNgef0QeQjG/D8kIqRYov:jnXnsEMSPbcBVQej/1L
Threatray	759 similar samples on MalwareBazaar
TLSH	T1B455239A32EC50FCD1162374D4B78E25E2B77C5922B9870F9B5086760E03791BF68B63
TrID	39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 8.3% (.EXE) Win64 Executable (generic) (6522/11/2) 6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	pawscobbler
Tags:	dionaea exe WannaCry

pawscobbler

Captured by Dionaea honeypot automation

Intelligence

File Origin

# of uploads :

# of downloads :

266

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

_1ce7eb9db4dc18eb57c678cf29f30246ee1398fe54184871e5b34b8cf68a9abd.dll

Verdict:

No threats detected

Analysis date:

2026-06-14 08:18:07 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3a8da7eb-ba83-404d-b1be-559050ea5acb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/70654/

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a2e633734eaf30d8ce5b75a

Tags:

ransomware shellcode injection wannacry

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug base64 cmd crypto lolbin microsoft_visual_cc obfuscated overlay packed packed ransomware ransomware smb wannacry

Link:

https://www.filescan.io/uploads/6a2e632fe6f7d2d27d57f7d6/reports/e606cbea-91fa-4f0c-a1de-b28403fab3ec/overview

Verdict:

Malicious

Labled as:

CVE-2017-0147

Link:

https://www.hybrid-analysis.com/sample/1ce7eb9db4dc18eb57c678cf29f30246ee1398fe54184871e5b34b8cf68a9abd

Verdict:

Malicious

File Type:

dll x64

First seen:

2026-06-14T05:20:00Z UTC

Last seen:

2026-06-15T22:50:00Z UTC

Hits:

~10

Detections:

HEUR:Worm.Win32.Generic HEUR:Trojan.Win32.EquationDrug.gen HEUR:Trojan-Ransom.Win32.Wanna.gen HEUR:Exploit.Win32.MS17-010.gen Trojan-Ransom.Win32.Wanna.m Trojan-Ransom.Win32.Wanna.ak Trojan-Ransom.Win32.Agentb.h

Link:

https://opentip.kaspersky.com/1ce7eb9db4dc18eb57c678cf29f30246ee1398fe54184871e5b34b8cf68a9abd/results?tab=lookup

Malware family:

Mimikatz

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f3e9ddc6-2497-4252-a976-99a71ad1aa6d

Score:

75%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1ce7eb9db4dc18eb57c678cf29f30246ee1398fe54184871e5b34b8cf68a9abd

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1ce7eb9db4dc18eb57c678cf29f30246ee1398fe54184871e5b34b8cf68a9abd/

Verdict:

Malicious

Threat:

Family.WANNACRY

Link:

https://tip.neiki.dev/file/1ce7eb9db4dc18eb57c678cf29f30246ee1398fe54184871e5b34b8cf68a9abd

Threat name:

Win64.Ransomware.WannaCry

Status:

Malicious

First seen:

2026-06-14 08:15:47 UTC

File Type:

PE+ (Dll)

Extracted files:

AV detection:

24 of 24 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dtt6xhnu3qmowv6gpdhst4yci3xbhgh6kqmeq4pfwnfyz5uktk6q._file

Verdict:

malicious

Label(s):

wannacryptor

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260614-j5x49sbz31/

Unpacked files

SH256 hash:

1ce7eb9db4dc18eb57c678cf29f30246ee1398fe54184871e5b34b8cf68a9abd

MD5 hash:

78fe2a3c6511116c8b01ae113a0d4fb0

SHA1 hash:

83351a0f33c4bc5fb19d50319c5392179de37ae7

Detections:

WannaCry

Link:

https://www.unpac.me/results/d3600740-b478-4a57-bbb3-ed01cf9b56a4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1ce7eb9db4dc18eb57c678cf29f30246ee1398fe54184871e5b34b8cf68a9abd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	suspicious_PEs Create hunting rule
Author:	txc
Description:	This rule detected suspicious PE files, based on high entropy and low amount of imported DLLs. This behaviour indicates packed files or files, that hide their true intention.

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	WannaCry_Ransomware Create hunting rule
Author:	Florian Roth (Nextron Systems) (with the help of binar.ly)
Description:	Detects WannaCry Ransomware
Reference:	https://goo.gl/HG2j5T

Rule name:	WannaCry_Ransomware_Gen Create hunting rule
Author:	Florian Roth (Nextron Systems) (based on rule by US CERT)
Description:	Detects WannaCry Ransomware
Reference:	https://www.us-cert.gov/ncas/alerts/TA17-132A

Rule name:	WannaCry_Ransomware_Gen_RID302B Create hunting rule
Author:	Florian Roth (based on rule by US CERT)
Description:	Detects WannaCry Ransomware
Reference:	https://www.us-cert.gov/ncas/alerts/TA17-132A

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/70654/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample