🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5393ae32ac0338e591278eeb2cfd05a8140e4d98f8654a6da51646c12acbf3c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WannaCry


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5393ae32ac0338e591278eeb2cfd05a8140e4d98f8654a6da51646c12acbf3c3
SHA3-384 hash: 203cc9d66d0ad9fdb20cc91d5f30c59ad0064742c6fed4547e40c1c5aba42418b2f8d07d679c522d90cdddd8d66bc8ef
SHA1 hash: 4e8a56f1b8d5403579563f7a2fbd3f9913b1eed0
MD5 hash: f1cacc74de4d362859d977c846ac0ec5
humanhash: cup-pip-lake-uncle
File name:VirusShare_84c82835a5d21bbcf75a61706d8ab549.zip
Download: download sample
Signature WannaCry
Create hunting rule
File size:3'481'356 bytes
First seen:2025-04-21 02:00:09 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: infected
ssdeep 98304:F4QQyKI22j2XGhkAJGIcptlGdwz0dJsyehpm:6Q/UOCS+pywrrg
TLSH T168F53344DD1F6AEB44E0885F673E7840B0B53311B680A1FC1FEF466D468DCE662AE61E
Magika zip
Reporter FelloBoiYuuka
Tags:pw-infected Ransomware WannaCry zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
726
Origin country :
CA CA
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
File size:3'514'368 bytes
SHA256 hash: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
MD5 hash: 84c82835a5d21bbcf75a61706d8ab549
MIME type:application/x-dosexec
Signature Ransomware.WannaCry
Vendor Threat Intelligence
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/5393ae32ac0338e591278eeb2cfd05a8140e4d98f8654a6da51646c12acbf3c3/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd crypto entropy filecoder lolbin microsoft_visual_cc packed packed packer_detected ransomware wanna wannacry wannacrypt wannacryptor
Link:
https://www.filescan.io/uploads/6805a6ac89fec6b88b9fc2ea/reports/c9ae0073-cf2d-4135-ac24-efca679ffddf/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/5393ae32ac0338e591278eeb2cfd05a8140e4d98f8654a6da51646c12acbf3c3
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/5393ae32ac0338e591278eeb2cfd05a8140e4d98f8654a6da51646c12acbf3c3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5393ae32ac0338e591278eeb2cfd05a8140e4d98f8654a6da51646c12acbf3c3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=koj24mvmam4olejhr3vsz7ifvaka4tmy7bsuu3nfczdmckwl6pbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5393ae32ac0338e591278eeb2cfd05a8140e4d98f8654a6da51646c12acbf3c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:WannaCry_Ransomware
Create hunting rule
Author:Florian Roth (with the help of binar.ly)
Description:Detects WannaCry Ransomware
Reference:https://goo.gl/HG2j5T

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments