2026-05-05_8aa0033274dc521d0d2a2dc2abbb4afd_elex_nitol_wannacry

General

Target
2026-05-05_8aa0033274dc521d0d2a2dc2abbb4afd_elex_nitol_wannacry
Size 62KB
Sample260505-ejj83af121
SHA256 8fade851592b0f81b9140893b8bb12b899d48dcdce0e3e4cfd8af0a89bf71a66
MD5 8aa0033274dc521d0d2a2dc2abbb4afd
SHA1 ceca421438b53259b81c52b80cdc1063a1caee12
SHA512 39c3e2c55212a85d85f886d0895b369c176fb15e9f90165caf6af3bba8393fc9cd801068784452d65c09b0294cfa9ac6f7154b1a6aaf66fdc400cb933da271f7
SSDEEP 768:MDcpEBMLfQcub5Ep1PnGz96XyX9TdtldE9rsssgOOO8:MDcfLfIb5Ep1uzgyXVdtnysssK
TLSH
T10A5319A6F59184A7E41741348886F3F6E8A2BC35C50EAA42FFC0BF4F5C75A51F92450B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-05_8aa0033274dc521d0d2a2dc2abbb4afd_elex_nitol_wannacry

File Explorer

2026-05-05_8aa0033274dc521d0d2a2dc2abbb4afd_elex_nitol_wannacry

.exe 62KB

2026-05-05_8aa0033274dc521d0d2a2dc2abbb4afd_elex_nitol_wannacry

IMPHASH 44d09e288cc76827b62dde98d4028728
SHA256 8fade851592b0f81b9140893b8bb12b899d48dcdce0e3e4cfd8af0a89bf71a66
MD5 8aa0033274dc521d0d2a2dc2abbb4afd
SHA1 ceca421438b53259b81c52b80cdc1063a1caee12
SHA512 39c3e2c55212a85d85f886d0895b369c176fb15e9f90165caf6af3bba8393fc9cd801068784452d65c09b0294cfa9ac6f7154b1a6aaf66fdc400cb933da271f7
SSDEEP 768:MDcpEBMLfQcub5Ep1PnGz96XyX9TdtldE9rsssgOOO8:MDcfLfIb5Ep1uzgyXVdtnysssK
TLSH
T10A5319A6F59184A7E41741348886F3F6E8A2BC35C50EAA42FFC0BF4F5C75A51F92450B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord823 ord825

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit strncmp _except_handler3 strstr strcspn strncpy atoi time srand rand realloc free malloc sprintf

kernel32

ExitProcess Sleep lstrcpyA CreateProcessA TerminateProcess ExitThread GetStartupInfoA GetModuleHandleA WaitForSingleObject CreateFileA SetFilePointer WriteFile lstrcpynA lstrlenA OpenMutexA ReleaseMutex GetComputerNameA GetCurrentProcess GetCurrentThread CloseHandle CreateThread LoadLibraryA GetProcAddress GetSystemDefaultUILanguage GetTickCount

user32

GetDesktopWindow wsprintfA

shell32

SHChangeNotify ShellExecuteExA ShellExecuteA

shlwapi

SHDeleteKeyA

ws2_32

setsockopt recv __WSAFDIsSet select WSAIoctl closesocket WSAStartup inet_ntoa htonl WSACleanup socket connect send inet_addr sendto htons

iphlpapi

GetIfTable GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-05_8aa0033274dc521d0d2a2dc2abbb4afd_elex_nitol_wannacry

mfc42

msvcrt

kernel32

user32

shell32

shlwapi

ws2_32

iphlpapi

generic