🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80574e5856fd4541b7635aeee7c94eb47a710bbfd74f60917b41881e01f87f50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WannaCry


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80574e5856fd4541b7635aeee7c94eb47a710bbfd74f60917b41881e01f87f50
SHA3-384 hash: dc84b762419faf23f50decd9474cb70d0e0bf8f12fa75dcb83a742eadcedaf713a58bb6fe3d3cc61df9dbe8eed6ec6d3
SHA1 hash: a288d2b7429659220f33b6ba63febe4eef5a0a81
MD5 hash: b5a289e26a38745aa0df305a30c46f35
humanhash: jupiter-purple-summer-lion
File name:80574e5856fd4541b7635aeee7c94eb47a710bbfd74f60917b41881e01f87f50
Download: download sample
Signature WannaCry
Create hunting rule
File size:5'267'459 bytes
First seen:2026-01-04 07:47:23 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2e5708ae5fed0403e8117c645fb23e5b (1'124 x WannaCry, 7 x Worm.Virut, 2 x Expiro)
ssdeep 49152:TnjQdPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9PAMEcaE:z8RoBhz1aRxcSUDk36SAEdhvxWa9P5
TLSH T11136BF01D1E41A60D5F24AF72AB9DB10933ABE46995B9A6E1222410F0C73F1DDDE6F3C
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10522/11/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter Butter1
Tags:dll eternalblue honeypot SMB WannaCry

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
AU AU
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/47543/
Detection(s):
Win.Ransomware.Wanna-9769986-0
Create hunting rule

Win.Ransomware.Wannacryptor-9940180-0
Create hunting rule

Win.Ransomware.Wanacryptor-9942127-1
Create hunting rule

Win.Ransomware.Wannacry-9982112-0
Create hunting rule

Win.Ransomware.WannaCry-6313787-0
Create hunting rule

Win.Malware.Djwy-6775897-0
Create hunting rule

Win.Ransomware.Wanna-6888027-0
Create hunting rule

Win.Ransomware.Wanna-6888334-0
Create hunting rule

BC.Win.Exploit.Exe_With_CVE_2017_0147-6316126-2
Create hunting rule

Win.Exploit.Doublepulsar-7427328-0
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=695a1b42d2357cccc3df4592
Tags:
wannacry madi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto microsoft_visual_cc overlay overlay packed ransomware ransomware smb virut wannacry wannacry
Link:
https://www.filescan.io/uploads/695a1b3d8d1aa9829e29f965/reports/250f444f-411e-47d4-8418-0f077706b4ce/overview
Verdict:
Malicious
Labled as:
CVE-2017-0147
Link:
https://www.hybrid-analysis.com/sample/80574e5856fd4541b7635aeee7c94eb47a710bbfd74f60917b41881e01f87f50
Verdict:
Malicious
File Type:
dll x32
First seen:
2018-11-15T13:07:00Z UTC
Last seen:
2025-08-02T01:22:00Z UTC
Hits:
~10
Detections:
Virus.Win32.Virut.ce Trojan.Win32.EquationDrug.sb Trojan.Win32.Eb.b Exploit.Win32.MS17-010.kpn PDM:Trojan.Win32.Generic Trojan.Snojan.UDP.ServerRequest HEUR:Trojan-Ransom.Win32.Wanna.gen Trojan-Ransom.Win32.Wanna.zbu Trojan-Ransom.Win32.Wanna.m Trojan.Win32.Eb.a HEUR:Worm.Win32.Generic HEUR:Virus.Win32.Generic HEUR:Trojan.Win32.EquationDrug.gen HEUR:Exploit.Win32.MS17-010.gen Trojan.IRCbot.IRC.C&C
Link:
https://opentip.kaspersky.com/80574e5856fd4541b7635aeee7c94eb47a710bbfd74f60917b41881e01f87f50/results?tab=lookup
Malware family:
Mimikatz
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f131b539-86f4-44fd-ad63-70dcedd5803f
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/80574e5856fd4541b7635aeee7c94eb47a710bbfd74f60917b41881e01f87f50
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE Memory-Mapped (Dump)
Link:
https://app.malva.re/file/b5a289e26a38745aa0df305a30c46f35
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/80574e5856fd4541b7635aeee7c94eb47a710bbfd74f60917b41881e01f87f50/
Verdict:
Malicious
Threat:
Trojan.Win32.Wanna
Link:
https://tip.neiki.dev/file/80574e5856fd4541b7635aeee7c94eb47a710bbfd74f60917b41881e01f87f50
Threat name:
Win32.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2018-11-12 12:50:42 UTC
File Type:
PE (Dll)
Extracted files:
3
AV detection:
33 of 36 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qblu4wcw7vcudn3dllxopskowr5hcc5725hwbel3igeb4apyp5ia._file
Verdict:
malicious
Label(s):
wannacryptor
Create hunting rule
Similar samples:
error
WannaCry
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/260106-jc9btsdq7t/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
Executes dropped EXE
Unpacked files
SH256 hash:
80574e5856fd4541b7635aeee7c94eb47a710bbfd74f60917b41881e01f87f50
MD5 hash:
b5a289e26a38745aa0df305a30c46f35
SHA1 hash:
a288d2b7429659220f33b6ba63febe4eef5a0a81
Link:
https://www.unpac.me/results/dd06b9d5-f476-4c37-aaea-a4005d7bd510/
SH256 hash:
e767f68e3a62aef227be3263882954cf2bb71ced020e11992b2555f16c7ea95a
MD5 hash:
0b4684e9684497beb7810bd0a0668877
SHA1 hash:
70d12e569642b5636d280b6e7c29108d742924f3
Detections:
WannaCry_Ransomware
Create hunting rule
WannaCry_Ransomware_Gen
Create hunting rule
Link:
https://www.unpac.me/results/dd06b9d5-f476-4c37-aaea-a4005d7bd510/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Armadillov1xxv2xx
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:SUSP_Imphash_Mar23_2
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:Internal Research
Rule name:WannaCry_Ransomware
Create hunting rule
Author:Florian Roth (Nextron Systems) (with the help of binar.ly)
Description:Detects WannaCry Ransomware
Reference:https://goo.gl/HG2j5T

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/47543/

Comments