Question regarding mining difficulty
As you say, the result of sha256 is a hexadecimal string.  Hexadecimal only uses the digits 0-9 and a-f, which is 16 possibilities, not 36.

If you redo your calculation with 16^18 instead of 36^18, you get an average time of around 3600 seconds, or 1 hour.