MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4fbcfb4cecbe39248de53e9564d34d26d3a6053b91183eb4d0cd2598db9f0123. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Worm.Virut


Vendor detections: 14


Intelligence 14 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4fbcfb4cecbe39248de53e9564d34d26d3a6053b91183eb4d0cd2598db9f0123
SHA3-384 hash: 0fee837124468758ca1efd0b1768760d3646f89578a284f75533e9febb1d7ae35ec0ba427767878c871877c269ff340b
SHA1 hash: b2beff735401274a8ba8f3756766880328df21de
MD5 hash: a86ac5079c0fa733090a3d75b3df2e37
humanhash: asparagus-carbon-fix-single
File name:4fbcfb4cecbe39248de53e9564d34d26d3a6053b91183eb4d0cd2598db9f0123
Download: download sample
Signature Worm.Virut
Create hunting rule
File size:5'267'459 bytes
First seen:2026-01-04 07:21:00 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2e5708ae5fed0403e8117c645fb23e5b (1'107 x WannaCry, 7 x Worm.Virut, 2 x Expiro)
ssdeep 12288:jibLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFd:ObLgddQhfdmMSirYbcMNgef0QeQjGt8
Threatray 2'536 similar samples on MalwareBazaar
TLSH T16436235A766C90FCC11A627964634A66E6B73C5A327D920F8F908B520D13760FF78F0B
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10522/11/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter Butter1
Tags:dll eternalblue honeypot SMB WannaCry Worm.Virut

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
AU AU
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/47427/
Detection(s):
Win.Ransomware.Wanna-9769986-0
Create hunting rule

Win.Ransomware.Wannacryptor-9940180-0
Create hunting rule

Win.Ransomware.Wanacryptor-9942127-1
Create hunting rule

Win.Ransomware.WannaCry-10011460-0
Create hunting rule

Win.Ransomware.WannaCry-6313787-0
Create hunting rule

Win.Malware.Djwy-6775897-0
Create hunting rule

Win.Ransomware.Wanna-6888334-0
Create hunting rule

Win.Malware.Djwy-6923377-0
Create hunting rule

BC.Win.Exploit.Exe_With_CVE_2017_0147-6316126-2
Create hunting rule

Win.Exploit.Doublepulsar-7427328-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=695a14efe148d42004df285d
Tags:
wannacry madi
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd crypto CVE-2017-0147 eternalblue exploit lolbin microsoft_visual_cc overlay overlay packed ransomware ransomware smb unsafe virut wanna wannacry wannacry wannacrypt wannacryptor wcry
Link:
https://www.filescan.io/uploads/695a14e98d1aa9829e29f67a/reports/73ea2859-d789-49b5-ac39-14318dadef46/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4fbcfb4cecbe39248de53e9564d34d26d3a6053b91183eb4d0cd2598db9f0123
Verdict:
Malicious
File Type:
dll x32
First seen:
2018-05-02T02:07:00Z UTC
Last seen:
2022-03-18T16:05:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.EquationDrug.sb Trojan.Win32.Eb.b HEUR:Trojan-Ransom.Win32.Wanna.gen Trojan-Ransom.Win32.Wanna.sb HEUR:Virus.Win32.Generic HEUR:Exploit.Win32.MS17-010.gen Trojan-Ransom.Win32.Wanna.zbu Trojan-Ransom.Win32.Wanna.m HEUR:Worm.Win32.Generic HEUR:Trojan.Win32.EquationDrug.gen HEUR:Trojan-Ransom.Win32.Wanna.a Trojan.Win32.Eb.a HEUR:Trojan.Win32.Generic Exploit.Win32.MS17-010.kpn Virus.Win32.Virut.ce
Link:
https://opentip.kaspersky.com/4fbcfb4cecbe39248de53e9564d34d26d3a6053b91183eb4d0cd2598db9f0123/results?tab=lookup
Malware family:
Mimikatz
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/eb10325a-84d5-4bab-9edb-d6819ca0a421
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4fbcfb4cecbe39248de53e9564d34d26d3a6053b91183eb4d0cd2598db9f0123
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE Memory-Mapped (Dump)
Link:
https://app.malva.re/file/a86ac5079c0fa733090a3d75b3df2e37
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4fbcfb4cecbe39248de53e9564d34d26d3a6053b91183eb4d0cd2598db9f0123/
Threat name:
Win32.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2018-05-02 04:57:23 UTC
File Type:
PE (Dll)
Extracted files:
4
AV detection:
34 of 36 (94.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j66pwthmxy4sjdpfh2kwju2ne3j2mbj3semd5ngqzuszrw47aerq._file
Verdict:
malicious
Label(s):
wannacryptor
Create hunting rule
Similar samples:
12a45143a35ee31f3e9c92deb6377873b3aaf360aab15bd606d347bedd0a2378
Worm.Virut
56973e4b94aed3715bee770815d287fae869e3c1c35a7307e252f8e2950dac67
Worm.Virut
5aa4328001eb57a54a716ba3c7f0fa7f6b8c390828ea8b33a3c85dfb2838a512
Worm.Virut
8c07a168b11c30dffb306605a02039ca58803c7fb511127f673d29f84d57bd37
Worm.Virut
9cd5e29bbd76c3074ff077844d6984932eb2968c82f369ea3c2b559130564a94
Worm.Virut
b06f763db65124fc25523c16d8850580af3769771440e6fc9cec856718740f15
Worm.Virut
cc7796413fb3fab847c0f15ef1359dd4d73ce859cb7a0f840243368aaa11eb30
Worm.Virut
cdecb17866aa95ae171740ba4fc9b73b0f7a75ee817119fbe423b074c2c3e8a6
Worm.Virut
d551f8f0d78d6017bcd4291bc70495e45cb500402d9c45476c7af2324155a93b
Worm.Virut
df520418cf167ad7a21b89d8042c6fda139fdd32159ebca27d6fc128bf1cbcd3
Worm.Virut
error
Worm.Virut
+ 2'526 additional samples on MalwareBazaar
Result
Malware family:
wannacry
Create hunting rule
Score:
  10/10
Tags:
family:wannacry defense_evasion discovery ransomware worm
Link:
https://tria.ge/reports/260106-kmsbqsylfp/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
Creates a large amount of network flows
Executes dropped EXE
Drops file in Drivers directory
Contacts a large (3313) amount of remote hosts
Modifies firewall policy service
Wannacry
Wannacry family
Unpacked files
SH256 hash:
4fbcfb4cecbe39248de53e9564d34d26d3a6053b91183eb4d0cd2598db9f0123
MD5 hash:
a86ac5079c0fa733090a3d75b3df2e37
SHA1 hash:
b2beff735401274a8ba8f3756766880328df21de
Detections:
WannaCry
Create hunting rule
Link:
https://www.unpac.me/results/768a94dc-6c32-4d26-ae90-4f2aa6e54b8e/
Malware family:
Virut
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4fbcfb4cecbe/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Armadillov1xxv2xx
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:SUSP_Imphash_Mar23_2
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:Internal Research
Rule name:WannaCry_Ransomware
Create hunting rule
Author:Florian Roth (Nextron Systems) (with the help of binar.ly)
Description:Detects WannaCry Ransomware
Reference:https://goo.gl/HG2j5T

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/47427/

Comments