MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

WannaCry

Vendor detections: 14

Intelligence 14 IOCs YARA 8 File information Comments

SHA256 hash:	7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633
SHA3-384 hash:	501c0dcb0702e94400efeb1d2831666ee7d19b4166cddbb9f7c1b8937b105aa886d10eb9ac78f6fd515de4defad0dc4f
SHA1 hash:	f8aba1eca44b9d4aaabd9d0b6d43d75b73e9f413
MD5 hash:	1e77c609fbcc2c7d61b84a843b5322ef
humanhash:	dakota-alpha-oven-fourteen
File name:	7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633
Download:	download sample
Signature	WannaCry Create hunting rule
File size:	5'298'176 bytes
First seen:	2026-05-25 11:15:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0cdadfa1098d845dd3b4cf92625b5f04 (444 x WannaCry)
ssdeep	98304:DXDqPoVaRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DXDqPaCxcxk3ZAEUadzR8yc4H
Threatray	1'019 similar samples on MalwareBazaar
TLSH	T1C636F126FBC2AC18E40E8171A561DFF76863B5F2456B833BF89343DE49B52A17F10921
TrID	39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 8.3% (.EXE) Win64 Executable (generic) (6522/11/2) 6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	pawscobbler
Tags:	dionaea exe WannaCry

pawscobbler

Captured by Dionaea honeypot automation

Intelligence

File Origin

# of uploads :

# of downloads :

201

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

_7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633.dll

Verdict:

No threats detected

Analysis date:

2026-05-25 11:16:36 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/fc5c4f92-6562-48a0-b409-46c000828985

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/67854/

Detection(s):

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a142f6e5d76862ef947a77d

Tags:

ransomware shellcode wannacry virus

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug base64 cmd crypto evasive explorer lolbin microsoft_visual_cc overlay overlay packed ransomware ransomware reconnaissance smb wannacry

Link:

https://www.filescan.io/uploads/6a142f66861ee596e64acf97/reports/388add55-0b83-482b-997e-676f6c142ddb/overview

Verdict:

Malicious

Labled as:

CVE-2017-0147

Link:

https://www.hybrid-analysis.com/sample/7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633

Verdict:

Malicious

File Type:

dll x64

First seen:

2026-05-25T08:22:00Z UTC

Last seen:

2026-05-27T05:39:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.Shelm.a10 Trojan.Win32.EquationDrug.sb Trojan.Win32.Eb.b HEUR:Trojan.Win32.EquationDrug.gen Trojan.Win32.Eb.s HEUR:Exploit.Win32.MS17-010.gen Exploit.Win32.MS17-010.bf Trojan.Win32.Eb.a Trojan-Ransom.Win32.Wanna.zbu Trojan-Ransom.Win32.Wanna.sb Trojan-Ransom.Win32.Wanna.m Trojan-Ransom.Win32.Wanna.ak HEUR:Worm.Win32.Generic HEUR:Trojan.Win32.Generic HEUR:Trojan-Ransom.Win32.Wanna.gen Exploit.Win32.MS17-010.cb

Link:

https://opentip.kaspersky.com/7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633/results?tab=lookup

Malware family:

Metasploit Framework

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5c0ee4df-77b0-4bd5-ae66-ca112af84c8e

Score:

44%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE Memory-Mapped (Dump)

Link:

https://app.malva.re/file/1e77c609fbcc2c7d61b84a843b5322ef

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633/

Verdict:

Malicious

Threat:

Family.WANNACRY

Link:

https://tip.neiki.dev/file/7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633

Threat name:

Win64.Ransomware.WannaCry

Status:

Malicious

First seen:

2026-05-25 11:16:13 UTC

File Type:

PE+ (Dll)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pnzocpsqjnviqvnuido33hpuvqov2bkzfcfu2w6djz4jbhmqcyzq._file

Verdict:

malicious

Label(s):

wannacryptor

WannaCry

23888151013d27bf9128a5add0182e7642029d850a2be60a57cbb7ae146593c9

WannaCry

3337d8bae0e2d0c50b5a86449b8591a434c3225c3d4b2b15802053d4950228e6

WannaCry

71f478119e31ec5fbf96089ce37e501748f740e99e1e7ba0a28569b78ab8779b

WannaCry

cbf41a65dcfd5c00a9564cbed62ad766d2fff30e43d6e567a87591947bc79086

WannaCry

error

WannaCry

fbdff3b5acedc12399c81aa8153be5a4246b2d11f7dfbfa1db0e5d37b790f343

WannaCry

+ 1'009 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260525-nc1f5shw9v/

Unpacked files

SH256 hash:

7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633

MD5 hash:

1e77c609fbcc2c7d61b84a843b5322ef

SHA1 hash:

f8aba1eca44b9d4aaabd9d0b6d43d75b73e9f413

Detections:

WannaCry

Link:

https://www.unpac.me/results/7a52957e-2555-4995-b77c-8e4e7067b96d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ccrewMiniasp Create hunting rule
Author:	AlienVault Labs

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	Sus_All_Windows_PE_Malware Create hunting rule
Author:	DiegoAnalytics
Description:	Detects Windows PE malware of all types, avoids non-executables like .html

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	WannaCry_Ransomware Create hunting rule
Author:	Florian Roth (Nextron Systems) (with the help of binar.ly)
Description:	Detects WannaCry Ransomware
Reference:	https://goo.gl/HG2j5T

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/67854/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample