s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-916574f7a6b66bf6fea909e04cbd31b744dcffb745de554e2ee595545dc62c35 high

📛 Threat Title

WannaCry: 916574f7a6b66bf6fea909e04cbd31b744dcffb745de554e2ee595545dc62c35

Category: WannaCry Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: exe. Size: 5298176 bytes. Tags: dionaea, exe, WannaCry. Reporter: pawscobbler. First seen: 2026-11-03 09:15:16.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_imphash 0cdadfa1098d845dd3b4cf92625b5f04

IOC database

Type
hash_imphash
Value
0cdadfa1098d845dd3b4cf92625b5f04
First seen
Last seen
Attached to this threat
Appears in
222 threats

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 916574f7a6b66bf6fea909e04cbd31b744dcffb745de554e2ee595545dc62c35 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/916574f7a6b66bf6fea909e04cbd31b744dcffb745de554e2ee595545dc62c35

IOC database

Type
hash_sha256
Value
916574f7a6b66bf6fea909e04cbd31b744dcffb745de554e2ee595545dc62c35
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
WannaCry

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/916574f7a6b66bf6fea909e04cbd31b744dcffb745de554e2ee595545dc62c35

hash_sha1 16a8cb4ccaaed6ed2ec102c0323cad6bf349c55d VT 54 / 75

IOC database

Type
hash_sha1
Value
16a8cb4ccaaed6ed2ec102c0323cad6bf349c55d
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA1 hash of a malware sample (payload) attributed to WannaCryptor

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 54 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.WannaCryptor.R200894
Alibaba malicious Ransom:Win32/WannaCrypt.50a
alibabacloud malicious RansomWare:Win/Wannacryptor.6d8dbf74
ALYac malicious Exploit.CVE-2017-0147
Antiy-AVL malicious Trojan[Exploit]/Win64.CVE-2017-0147
APEX malicious Malicious
Arcabit malicious Exploit.CVE-2017-0147
Avira malicious EXP/W32.CVE-2017-01.B
Bkav malicious W32.Malware.9C849AC6
CAT-QuickHeal malicious Ransom.WcryG.S28363974
ClamAV malicious Win.Ransomware.Wanna-9769986-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious dll.exploit-kit.cve-2017-0147
Cylance malicious Unsafe
Cynet malicious Malicious (score: 100)
DrWeb malicious Trojan.Encoder.11432
Elastic malicious malicious (high confidence)
Emsisoft malicious Exploit.CVE-2017-0147 (B)
ESET-NOD32 malicious Win64/Exploit.CVE-2017-0147.A trojan
F-Secure malicious Exploit.EXP/W32.CVE-2017-01.B
Fortinet malicious W64/Wanna.AK!tr
GData malicious Exploit.CVE-2017-0147
Gridinsoft malicious Trojan.Win64.Downloader.oa!s1
huorong malicious Exploit/EquationDrug.a
Ikarus malicious Exploit.CVE-2017-0147
Jiangmin malicious Trojan.Wanna.e
K7AntiVirus malicious Trojan ( 0058feba1 )
K7GW malicious Trojan ( 0058feba1 )
Kaspersky malicious Trojan.Win32.Eb.s
Kingsoft malicious Win32.Exploit.MS17-010.cb
Lionic malicious Trojan.Win32.Wanna.ts4v
Malwarebytes malicious CVE20170147.Trojan.Exploit.DDS
McAfeeD malicious Trojan:Win/WannaCry.AA
Microsoft malicious Ransom:Win32/WannaCrypt!pz
MicroWorld-eScan malicious Exploit.CVE-2017-0147
NANO-Antivirus malicious Trojan.Win32.Wanna.epclsl
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Exploit.EternalBlue!1.AAED (CLASSIC)
Sangfor malicious Ransom.Win32.Save.WannaCry
SentinelOne malicious Static AI - Suspicious PE
Sophos malicious Mal/Wanna-A
Symantec malicious Ransom.Wannacry
TACHYON malicious Ransom/W32.WannaCry.5298176
Tencent malicious Trojan.Win64.Wanna.a
TrellixENS malicious Ransom-WannaCry!D039810BBF79
Varist malicious W64/S-e4f863f0!Eldorado
VBA32 malicious TrojanRansom.Win64.Wanna
VIPRE malicious Exploit.CVE-2017-0147
VirIT malicious Trojan.Win32.Genus.LWU
Webroot malicious W32.Trojan.Gen
Yandex malicious Trojan.GenAsa!DtE/ovQwFGg
Zillya malicious Trojan.Wanna.Win32.27
ZoneAlarm malicious Mal/Wanna-A

Details From VirusTotal

Basic Properties
MD5d039810bbf79b82ea57a0babf8763ca0
SHA-116a8cb4ccaaed6ed2ec102c0323cad6bf349c55d
SHA-256916574f7a6b66bf6fea909e04cbd31b744dcffb745de554e2ee595545dc62c35
VHash156066655d151565bz47?z1
SSDEEP98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp:DI8qPe1Cxcxk3ZAEUadzR8yc
TLSHT1D3363398736C91BCE00519B444738D2AF7777C6667BE4B0F8B9045AB0E03B9BBB90752
File typeWin32 DLL
File type tagpedll
File extensiondll
MagicPE32+ executable (DLL) (console) x86-64, for MS Windows
File size5.1 MB
History
Creation date2017-05-11 12:20 UTC
First seen on VirusTotal2026-11-03 09:18 UTC
Last submission2026-11-03 17:52 UTC
Last analysis2026-11-03 12:02 UTC
Last modified on VirusTotal2026-11-03 20:37 UTC
Known Names
  • 916574f7a6b66bf6fea909e04cbd31b744dcffb745de554e2ee595545dc62c35.exe
  • nz3je.exe
hash_md5 d039810bbf79b82ea57a0babf8763ca0 VT 54 / 75

IOC database

Type
hash_md5
Value
d039810bbf79b82ea57a0babf8763ca0
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
MD5 hash of a malware sample (payload) attributed to WannaCryptor

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 54 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win32.WannaCryptor.R200894
Alibaba malicious Ransom:Win32/WannaCrypt.50a
alibabacloud malicious RansomWare:Win/Wannacryptor.6d8dbf74
ALYac malicious Exploit.CVE-2017-0147
Antiy-AVL malicious Trojan[Exploit]/Win64.CVE-2017-0147
APEX malicious Malicious
Arcabit malicious Exploit.CVE-2017-0147
Avira malicious EXP/W32.CVE-2017-01.B
Bkav malicious W32.Malware.9C849AC6
CAT-QuickHeal malicious Ransom.WcryG.S28363974
ClamAV malicious Win.Ransomware.Wanna-9769986-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious dll.exploit-kit.cve-2017-0147
Cylance malicious Unsafe
Cynet malicious Malicious (score: 100)
DrWeb malicious Trojan.Encoder.11432
Elastic malicious malicious (high confidence)
Emsisoft malicious Exploit.CVE-2017-0147 (B)
ESET-NOD32 malicious Win64/Exploit.CVE-2017-0147.A trojan
F-Secure malicious Exploit.EXP/W32.CVE-2017-01.B
Fortinet malicious W64/Wanna.AK!tr
GData malicious Exploit.CVE-2017-0147
Gridinsoft malicious Trojan.Win64.Downloader.oa!s1
huorong malicious Exploit/EquationDrug.a
Ikarus malicious Exploit.CVE-2017-0147
Jiangmin malicious Trojan.Wanna.e
K7AntiVirus malicious Trojan ( 0058feba1 )
K7GW malicious Trojan ( 0058feba1 )
Kaspersky malicious Trojan.Win32.Eb.s
Kingsoft malicious Win32.Exploit.MS17-010.cb
Lionic malicious Trojan.Win32.Wanna.ts4v
Malwarebytes malicious CVE20170147.Trojan.Exploit.DDS
McAfeeD malicious Trojan:Win/WannaCry.AA
Microsoft malicious Ransom:Win32/WannaCrypt!pz
MicroWorld-eScan malicious Exploit.CVE-2017-0147
NANO-Antivirus malicious Trojan.Win32.Wanna.epclsl
Paloalto malicious generic.ml
Panda malicious Trj/GdSda.A
Rising malicious Exploit.EternalBlue!1.AAED (CLASSIC)
Sangfor malicious Ransom.Win32.Save.WannaCry
SentinelOne malicious Static AI - Suspicious PE
Sophos malicious Mal/Wanna-A
Symantec malicious Ransom.Wannacry
TACHYON malicious Ransom/W32.WannaCry.5298176
Tencent malicious Trojan.Win64.Wanna.a
TrellixENS malicious Ransom-WannaCry!D039810BBF79
Varist malicious W64/S-e4f863f0!Eldorado
VBA32 malicious TrojanRansom.Win64.Wanna
VIPRE malicious Exploit.CVE-2017-0147
VirIT malicious Trojan.Win32.Genus.LWU
Webroot malicious W32.Trojan.Gen
Yandex malicious Trojan.GenAsa!DtE/ovQwFGg
Zillya malicious Trojan.Wanna.Win32.27
ZoneAlarm malicious Mal/Wanna-A

Details From VirusTotal

Basic Properties
MD5d039810bbf79b82ea57a0babf8763ca0
SHA-116a8cb4ccaaed6ed2ec102c0323cad6bf349c55d
SHA-256916574f7a6b66bf6fea909e04cbd31b744dcffb745de554e2ee595545dc62c35
VHash156066655d151565bz47?z1
SSDEEP98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp:DI8qPe1Cxcxk3ZAEUadzR8yc
TLSHT1D3363398736C91BCE00519B444738D2AF7777C6667BE4B0F8B9045AB0E03B9BBB90752
File typeWin32 DLL
File type tagpedll
File extensiondll
MagicPE32+ executable (DLL) (console) x86-64, for MS Windows
File size5.1 MB
History
Creation date2017-05-11 12:20 UTC
First seen on VirusTotal2026-11-03 09:18 UTC
Last submission2026-11-03 17:52 UTC
Last analysis2026-11-03 12:02 UTC
Last modified on VirusTotal2026-11-03 20:37 UTC
Known Names
  • 916574f7a6b66bf6fea909e04cbd31b744dcffb745de554e2ee595545dc62c35.exe
  • nz3je.exe

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: exe. Size: 5298176 bytes. Tags: dionaea, exe, WannaCry. Reporter: pawscobbler. First seen: 2026-11-03 09:15:16.

Remediations (10)

  • MalwareBazaar | SHA256 ...
    web:bazaar.abuse.ch

    Information on WannaCry malware sample (SHA256 050c6b14a0308fc4adbafec1465b2202b8d378b0e8df7cce38b04e35772b04f3) MalwareBazaar uses YARA rules from several public and ...

  • MalwareBazaar | SHA256 ... - abuse.ch
    web:bazaar.abuse.ch

    Information on WannaCry malware sample (SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844) MalwareBazaar uses YARA rules from several public and ...

  • WannaCry ransomware attack - Wikipedia
    web:en.wikipedia.org

    The WannaCry ransomware attack was a worldwide cyberattack in May 2017 by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the form of bitcoin cryptocurrency. [4]

  • GitHub - limiteci/WannaCry: this repository contains the active DOS ...
    web:github.com

    this repository contains the active DOS/Windows ransomware, WannaCry ⚠️ WARNING ⚠️ running this .exe file will damage your PC, use a secure burner VM / VirtualBox to test it link to download the .exe file here

  • How To Remove Wanacry Ransomware (Virus Removal Guide)
    web:malwaretips.com

    This guide teaches you how to remove Wanacry ransomware for free by following easy step-by-step instructions.

  • Analyzing the Wannacry Ransomware | by Chinaza Emmanuela Obidike - Medium
    web:medium.com

    Analyzing the Wannacry Ransomware In today's digital landscape, cyber threats have evolved dramatically, with ransomware and banking trojans emerging as significant challenges for individuals ...

  • WannaCry Ransomware Explained: How the 2017 Attack Spread, What It ...
    web:www.adaptivesecurity.com

    WannaCry ransomware hit 150+ countries in a single day. How the worm spread, what it really cost, who was behind it, and what it still means for defenders.

  • What was WannaCry? | WannaCry Ransomware | Malwarebytes
    web:www.malwarebytes.com

    For example, not every victim of WannaCry got their files back after paying the fee, possibly due to a flaw in the ransomware itself. What are some good ransomware mitigation strategies? For the devices you use at home, use antivirus/anti-malware software that defends against all kinds of malicious software, including ransomware protection.

  • WannaCry Ransomware - Decryption, removal, and lost files ... - PCrisk
    web:www.pcrisk.com

    What is WannaCry ? Discovered by GrujaRS and belonging to the Phobos family, WannaCry (also known as WannaCryFake) is software categorized as ransomware. This malicious program encrypts files and keeps them locked unless the victim pays a ransom (purchases decryption software/tool).

  • WannaCry 3.0 Ransomware - Decryption, removal, and lost files ... - PCrisk
    web:www.pcrisk.com

    WannaCry 3.0 is actually based on the open-source Crypter (Python) ransomware. Malware within the ransomware category is designed to encrypt data and demand payment for its decryption. On our test machine, WannaCry 3.0 encrypted files and appended their filenames with a ".wncry " extension (which is also used by the real WannaCry ).

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.