🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d048f0164808c5daab17d4e224bcaa079ac7371f36618e9e6d4eb1b2b65c3953. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


WannaCry


Vendor detections: 15


Intelligence 15 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d048f0164808c5daab17d4e224bcaa079ac7371f36618e9e6d4eb1b2b65c3953
SHA3-384 hash: 9da246645c1dd9a25f980fce5e3d13b76495bc5654afa834bfe8488f029d7cdd8760ee283c67c708078bc394bf45be14
SHA1 hash: eef0b45632e55705c1cab4bb6da58e882a8ab865
MD5 hash: 23d048d04f55b993301b477b1b8bd7a8
humanhash: carolina-salami-delta-nuts
File name:23d048d04f55b993301b477b1b8bd7a8
Download: download sample
Signature WannaCry
Create hunting rule
File size:5'267'459 bytes
First seen:2025-01-15 01:56:02 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2e5708ae5fed0403e8117c645fb23e5b (1'124 x WannaCry, 7 x Worm.Virut, 2 x Expiro)
ssdeep 49152:RnAMSDbcBVQej/1INRx+DX1HkQo6SAARdhn:1ADoBhz1aRxqk36SAEdh
Threatray 1'040 similar samples on MalwareBazaar
TLSH T1ED36124272FC0178F2B37B70D9BA4661ABB77C652A7ED50E5780055E0CF2E80EA61763
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10522/11/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter mentality
Tags:dll exe WannaCry

Intelligence

File Origin
# of uploads :
1
# of downloads :
500
Origin country :
CA CA
Vendor Threat Intelligence
Detection(s):
Win.Ransomware.Wanna-9769986-0
Create hunting rule

Win.Ransomware.Wanacryptor-9942127-1
Create hunting rule

Win.Ransomware.Wannacry-9982112-0
Create hunting rule

Win.Ransomware.WannaCry-10011460-0
Create hunting rule

Win.Ransomware.WannaCry-6313787-0
Create hunting rule

Win.Malware.Djwy-6775897-0
Create hunting rule

Win.Ransomware.Wanna-6888027-0
Create hunting rule

Win.Ransomware.Wanna-6888334-0
Create hunting rule

Win.Exploit.Doublepulsar-7427328-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=678715b74487910100df1928
Tags:
wannacry madi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto microsoft_visual_cc overlay packed packed ransomware smb threat wanna wannacry wannacryptor
Link:
https://www.filescan.io/uploads/678715baf6ef415507dbb09c/reports/89731c28-47d5-4c07-a5cc-0a9f9179859b/overview
Verdict:
Malicious
Labled as:
CVE-2017-0147
Link:
https://www.hybrid-analysis.com/sample/d048f0164808c5daab17d4e224bcaa079ac7371f36618e9e6d4eb1b2b65c3953
Malware family:
Mimikatz
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f72ab018-cfb8-42c3-b4d7-2c14a3348fc3
Result
Threat name:
Wannacry
Create hunting rule
Detection:
malicious
Classification:
rans.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1591529
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Wannacry ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1591529 Sample: NLWfV87ouS.dll Startdate: 15/01/2025 Architecture: WINDOWS Score: 100 37 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com 2->37 39 ww25.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com 2->39 41 77026.bodis.com 2->41 51 Suricata IDS alerts for network traffic 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 Antivirus detection for URL or domain 2->55 57 7 other signatures 2->57 8 loaddll32.exe 1 2->8         started        10 mssecsvr.exe 12 2->10         started        signatures3 process4 dnsIp5 14 rundll32.exe 8->14         started        16 rundll32.exe 8->16         started        19 cmd.exe 1 8->19         started        21 conhost.exe 8->21         started        43 192.168.2.100 unknown unknown 10->43 45 192.168.2.101 unknown unknown 10->45 47 98 other IPs or domains 10->47 65 Connects to many different private IPs via SMB (likely to spread or exploit) 10->65 67 Connects to many different private IPs (likely to spread or exploit) 10->67 signatures6 process7 signatures8 23 mssecsvr.exe 13 14->23         started        49 Drops executables to the windows directory (C:\Windows) and starts them 16->49 27 mssecsvr.exe 13 16->27         started        29 rundll32.exe 1 19->29         started        process9 file10 31 C:\Windows\tasksche.exe, PE32 23->31 dropped 59 Antivirus detection for dropped file 23->59 61 Multi AV Scanner detection for dropped file 23->61 63 Machine Learning detection for dropped file 23->63 33 C:\WINDOWS\qeriuwjhrf (copy), PE32 27->33 dropped 35 C:\Windows\mssecsvr.exe, PE32 29->35 dropped signatures11
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d048f0164808c5daab17d4e224bcaa079ac7371f36618e9e6d4eb1b2b65c3953
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d048f0164808c5daab17d4e224bcaa079ac7371f36618e9e6d4eb1b2b65c3953/
Threat name:
Win32.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2018-10-28 12:05:23 UTC
File Type:
PE (Dll)
Extracted files:
3
AV detection:
35 of 38 (92.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2bepafsibdc5vkyx2trcjpfka6nmony7gzqy5htnj2y3fns4hfjq._file
Verdict:
malicious
Label(s):
wannacryptor
Create hunting rule
Similar samples:
016b40a769d4d34da8cdf3bf08a166c3243b659c31c152d3c0899993a7aa8f07
WannaCry
0ca55fe01cf52696f424100ee6de4e8dd262ce1c83257d22bc3edc42c30fb944
WannaCry
0f1516a8c0600c59defcf96c87c27de6a81e732ecb2f64b5e48904c31ab2cbb2
WannaCry
3befcb73c9497db265428aa3dc0b0692fa5722344d4a772b25973e244b085266
WannaCry
499e277bcb0c1712223fe211751a00e56a9ab6580e96e27128877615aca811cb
WannaCry
540749acd2da3530292fed430ee05bd8752bd4f40499b987da31a24e67959352
WannaCry
8b51945ada866301cd583744f4363bbeac1b7ec84ee78c0135824a2dc57f7244
WannaCry
9782298315b127534cfb24720e76e4cc946f71a72126da11f9bcb738b94d6b49
WannaCry
b10225bfe75854f01b5f9aea098c2fde6f5fdc543f2a81aadafe389ae9a1dc94
WannaCry
error
WannaCry
f2cf2c68920d3812d76104aa8388cfa07934c53a39e8f48e098a282ddccbfbcf
WannaCry
+ 1'030 additional samples on MalwareBazaar
Result
Malware family:
wannacry
Create hunting rule
Score:
  10/10
Tags:
family:wannacry discovery ransomware worm
Link:
https://tria.ge/reports/250115-ccq2xswre1/
Behaviour
Modifies data under HKEY_USERS
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Drops file in Windows directory
Drops file in System32 directory
Creates a large amount of network flows
Executes dropped EXE
Contacts a large (3176) amount of remote hosts
Wannacry
Wannacry family
Unpacked files
SH256 hash:
1a92bc14a30f6e43fcdb694ae71878d855ecd82750e624a0840c0fc3c1deebbe
MD5 hash:
b4c7d095ef445aa050b9fa5f407b8ff5
SHA1 hash:
12060172180fc5838878510302cab889083318bb
Link:
https://www.unpac.me/results/460aa1f9-4c02-46b9-b7d4-01d7d51bbdfb/
SH256 hash:
7bc4541796db119bf27491b0242466c2fa0228f187884dbbe3e4c132ed0b448f
MD5 hash:
3c0e625a8af8122cc80638346d3bfd51
SHA1 hash:
0ae7baadf28a9c21d646917731b21332d4538f37
Detections:
WannaCry_Ransomware
Create hunting rule
WannaCry_Ransomware_Gen
Create hunting rule
Link:
https://www.unpac.me/results/460aa1f9-4c02-46b9-b7d4-01d7d51bbdfb/
SH256 hash:
d048f0164808c5daab17d4e224bcaa079ac7371f36618e9e6d4eb1b2b65c3953
MD5 hash:
23d048d04f55b993301b477b1b8bd7a8
SHA1 hash:
eef0b45632e55705c1cab4bb6da58e882a8ab865
Link:
https://www.unpac.me/results/460aa1f9-4c02-46b9-b7d4-01d7d51bbdfb/
Malware family:
WannaCry
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d048f0164808/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
SNC
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d048f0164808c5daab17d4e224bcaa079ac7371f36618e9e6d4eb1b2b65c3953

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Armadillov1xxv2xx
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SUSP_Imphash_Mar23_2
Create hunting rule
Author:Arnim Rupp (https://github.com/ruppde)
Description:Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:Internal Research
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:WannaCry_Ransomware
Create hunting rule
Author:Florian Roth (Nextron Systems) (with the help of binar.ly)
Description:Detects WannaCry Ransomware
Reference:https://goo.gl/HG2j5T

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::CloseHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA

Comments