🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5e8ed118ebda8bebd08e69cd2a602866dca8f0aebe20429f4eaf31732c9cc38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WannaCry


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5e8ed118ebda8bebd08e69cd2a602866dca8f0aebe20429f4eaf31732c9cc38
SHA3-384 hash: 6b6278c5bbff22472c4a14d69cad4a934371caeed6b62dc6b397a57f4bf70eb7ab5c8cbff0caed6a89b0c9d5a2ef63d5
SHA1 hash: d7f288460dc5ae70d71d0fe81e078ebdf778db5f
MD5 hash: 9b79fa675dfdaaa9e8a2b3fd917bef0c
humanhash: mars-enemy-apart-william
File name:b5e8ed118ebda8bebd08e69cd2a602866dca8f0aebe20429f4eaf31732c9cc38
Download: download sample
Signature WannaCry
Create hunting rule
File size:3'514'368 bytes
First seen:2022-10-13 12:38:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 68f013d7437aa653a8a98a05807afeb1 (28 x WannaCry, 1 x Worm.Ramnit)
ssdeep 49152:nQqMSPbcBVQej/1INRk+TSqTdX1HkQo6SA:QqPoBhz1aRkcSUDk36SA
TLSH T1E3F533A9B171B7BCD3062DB9109BC5A72AD238A776DF7E06DF8004A65C04F2D9F805C6
TrID 38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.0% (.EXE) Win64 Executable (generic) (10523/12/4)
8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter petikvx
Tags:WannaCry

Intelligence

File Origin
# of uploads :
1
# of downloads :
306
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/319939/
Detection(s):
Win.Ransomware.Wannacryptor-9940180-0
Create hunting rule

Win.Ransomware.Wannacry-6803937-0
Create hunting rule

Win.Ransomware.Wannacrypt-6804263-0
Create hunting rule

Win.Ransomware.WannaCry-6313787-0
Create hunting rule

Win.Malware.Djwy-6775897-0
Create hunting rule

Win.Malware.Djwy-6923377-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/42939/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd.exe greyware ransomware shell32.dll wanna wannacry
Link:
https://www.filescan.io/uploads/634806e6316b332dfca8fbe7/reports/15ee9c78-00a1-4126-b29b-27debef8c0f8/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3736ee97-e354-4c2f-8842-648e51839406
Result
Threat name:
Wannacry
Create hunting rule
Detection:
malicious
Classification:
rans
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1089836
Signature
Antivirus / Scanner detection for submitted sample
Detected Wannacry Ransomware
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Behaviour
Behavior Graph:
Download SVG
Detection:
wannacry
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b5e8ed118ebda8bebd08e69cd2a602866dca8f0aebe20429f4eaf31732c9cc38/
Threat name:
Win32.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2022-10-13 12:39:08 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
40 of 41 (97.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxuo2emoxwul5pii42onfjqcqzw4vdyk5praikpu5lzromwjzq4a._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221013-pvlw5seadl/
Unpacked files
SH256 hash:
b5e8ed118ebda8bebd08e69cd2a602866dca8f0aebe20429f4eaf31732c9cc38
MD5 hash:
9b79fa675dfdaaa9e8a2b3fd917bef0c
SHA1 hash:
d7f288460dc5ae70d71d0fe81e078ebdf778db5f
Link:
https://www.unpac.me/results/b0523887-a9a7-476f-9b52-3e0081eaaacf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b5e8ed118ebda8bebd08e69cd2a602866dca8f0aebe20429f4eaf31732c9cc38

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:WannaCry_Ransomware
Create hunting rule
Author:Florian Roth (with the help of binar.ly)
Description:Detects WannaCry Ransomware
Reference:https://goo.gl/HG2j5T
Rule name:Win32_Ransomware_WannaCry
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects WannaCry ransomware.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/319939/

Comments