MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WannaCry

Vendor detections: 14

Intelligence 14 IOCs YARA 8 File information Comments

SHA256 hash:	24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
SHA3-384 hash:	7c6c39f43597afe297bbf69dc76216fa8e982713831490d1826adcd90c8e0adff3b87c681ae74fe38a56467700eeec65
SHA1 hash:	e889544aff85ffaf8b0d0da705105dee7c97fe26
MD5 hash:	db349b97c37d22f5ea1d1841e3c89eb4
humanhash:	berlin-angel-beer-quebec
File name:	invoice_greenanimals.pdf.exe
Download:	download sample
Signature	WannaCry Create hunting rule
File size:	3'723'264 bytes
First seen:	2022-12-16 12:38:17 UTC
Last seen:	2022-12-16 12:39:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9ecee117164e0b870a53dd187cdd7174 (82 x WannaCry, 1 x Worm.Virut)
ssdeep	98304:wDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3R:wDqPe1Cxcxk3ZAEUadzR8yc4gB
Threatray	1'016 similar samples on MalwareBazaar
TLSH	T1B70633A8962DA1BCF0050DB044928557EBFB3C57B7BA5A2FCF4045660D43B6F9BC0E61
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	Anonymous
Tags:	exe WannaCry

Intelligence

File Origin

# of uploads :

# of downloads :

1'364

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c.bin

Verdict:

No threats detected

Analysis date:

2020-10-08 18:39:07 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/31b0dd88-a8d2-4b49-bdf1-d01cdd8463e8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

WanaCry

Link:

https://www.capesandbox.com/analysis/346982/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Query of malicious DNS domain

Sending an HTTP GET request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

cmd.exe CVE-2017-0147 eternalblue exploit greyware packed ransomware shell32.dll virus virut wanna wannacry wannacryptor wcry worm

Link:

https://www.filescan.io/uploads/639c66e6c3104919a5d15018/reports/86f3fb1c-0a6a-418f-8bde-b3234e97e03e/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Mimikatz

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/83fdd4a4-f8c7-4ae0-b973-fb5b3003a948

Result

Threat name:

Wannacry

Detection:

malicious

Classification:

rans

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/908217

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to download HTTP data from a sinkholed server

Yara detected Wannacry ransomware

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c/

Threat name:

Win32.Ransomware.WannaCry

Status:

Malicious

First seen:

2017-05-12 08:37:47 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 26 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=etiajiie2tkuang3z76cusyzueptsaekk5nkmfhkarydjafraiwa._file

Verdict:

malicious

WannaCry

49e8d4991eca6a3f52c688d6398f9e166b7cf1b41ff7b0541e4adb6bc395cfe9

WannaCry

6cf273e91bb4a2455f08604ed402d151d39ab528ef9901738c45770097b35ebb

WannaCry

8c1ef884611f42e99c832194d6d1d446c0a99cf8070e556e6b15204327cf3d84

WannaCry

8de495d0f6c9b65bd1e5ef586b1f05864c0fb50485b8d71097c94ee2ca99121a

WannaCry

b48f682b2eb280061211435817f9a0f74431eb6a3841bb506b0614be524e7fdb

WannaCry

c75a86773ca170086b4ab1041bbe86ac5781c43ad98c2c26c43ee89bec65ee0c

WannaCry

ed492db95034ca288dd52df88e3ce3ec7b146ffd854a394ac187f0553ef966d9

WannaCry

+ 1'006 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/221216-pvlldaef98/

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f3cf59aa-68e0-4e23-ad8f-a88f3ced55d8

Unpacked files

SH256 hash:

24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c

MD5 hash:

db349b97c37d22f5ea1d1841e3c89eb4

SHA1 hash:

e889544aff85ffaf8b0d0da705105dee7c97fe26

Link:

https://www.unpac.me/results/db619dc7-4778-435c-890d-7d23d25b98a1/

Malware family:

WannaCry

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/24d004a104d4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	WannaCry Create hunting rule
Author:	Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>
Description:	Detects WannaCry Ransomware
Reference:	https://dissectingmalwa.re/third-times-the-charm-analysing-wannacry-samples.html

Rule name:	WannaCry_Ransomware Create hunting rule
Author:	Florian Roth (with the help of binar.ly)
Description:	Detects WannaCry Ransomware
Reference:	https://goo.gl/HG2j5T

Rule name:	WannaCry_Ransomware_Gen Create hunting rule
Author:	Florian Roth (based on rule by US CERT)
Description:	Detects WannaCry Ransomware
Reference:	https://www.us-cert.gov/ncas/alerts/TA17-132A

Rule name:	WannaCry_Ransomware_Gen_RID302B Create hunting rule
Author:	Florian Roth (based on rule by US CERT)
Description:	Detects WannaCry Ransomware
Reference:	https://www.us-cert.gov/ncas/alerts/TA17-132A