2026-05-11_188d7d22718fb9f9f064540c194776ee_amadey_elex_glassworm_hijackloader_icedid_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-11_188d7d22718fb9f9f064540c194776ee_amadey_elex_glassworm_hijackloader_icedid_vidar_wannacry
Size 1.4MB
Sample260511-psklash18y
SHA256 cfa209b4cb4dc8d5141bf11c4c6538ee105c02a0e3312baf86b8ab1ceb84d680
MD5 188d7d22718fb9f9f064540c194776ee
SHA1 43078156a5f738b28193ca109b0e944355f2a7a8
SHA512 e6204c4026e189a1d7f297855a5cf912a1a7dbb6d1121e876e5ef8b9c42c123ffc9b440fa3a54918c468b7febad6f151a3b1302e07ce894d5f9f051d59b9cfc3
SSDEEP 24576:8zaudkxqatgl8b75jcAkSYqyEeAhYu4papUrEZ3G7+:82TqatglOpYq+9UpmEZR
TLSH
T166652901B6A485B1E072817589A2969EDB317851CB238E8F12849FEDFFF36D19E31731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_188d7d22718fb9f9f064540c194776ee_amadey_elex_glassworm_hijackloader_icedid_vidar_wannacry

File Explorer

2026-05-11_188d7d22718fb9f9f064540c194776ee_amadey_elex_glassworm_hijackloader_icedid_vidar_wannacry

.exe 1.4MB

2026-05-11_188d7d22718fb9f9f064540c194776ee_amadey_elex_glassworm_hijackloader_icedid_vidar_wannacry

IMPHASH a0134d609f618d627a963155ef434726
SHA256 cfa209b4cb4dc8d5141bf11c4c6538ee105c02a0e3312baf86b8ab1ceb84d680
MD5 188d7d22718fb9f9f064540c194776ee
SHA1 43078156a5f738b28193ca109b0e944355f2a7a8
SHA512 e6204c4026e189a1d7f297855a5cf912a1a7dbb6d1121e876e5ef8b9c42c123ffc9b440fa3a54918c468b7febad6f151a3b1302e07ce894d5f9f051d59b9cfc3
SSDEEP 24576:8zaudkxqatgl8b75jcAkSYqyEeAhYu4papUrEZ3G7+:82TqatglOpYq+9UpmEZR
TLSH
T166652901B6A485B1E072817589A2969EDB317851CB238E8F12849FEDFFF36D19E31731
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\T\M\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb

kernel32

WaitForSingleObject CreateFileW DisconnectNamedPipe GetLastError SetEvent CloseHandle CreateThread ResetEvent GetProcAddress LocalFree DeleteCriticalSection GetCurrentProcessId GetModuleHandleW TransactNamedPipe GetFileType CreateEventA WaitNamedPipeW ConnectNamedPipe LocalAlloc GetCurrentThreadId VerSetConditionMask VerifyVersionInfoW CreateNamedPipeA WaitForMultipleObjects PeekNamedPipe OpenProcess GetOverlappedResult FlushFileBuffers InitializeCriticalSection LoadLibraryA FreeLibrary WideCharToMultiByte Sleep GetCommandLineA MultiByteToWideChar TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreA GetCurrentThread OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateMutexW LeaveCriticalSection CreateNamedPipeW WriteFile GetCurrentProcess EnterCriticalSection SetLastError SetNamedPipeHandleState InitializeCriticalSectionEx ReadFile

user32

GetMessageA DispatchMessageA TranslateMessage

advapi32

OpenThreadToken OpenProcessToken GetTokenInformation ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA

shell32

SHGetFileInfoW

ole32

CoWaitForMultipleHandles

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_except_handler4_common memchr __current_exception_context memmove memset __CxxFrameHandler3 __current_exception memcpy __std_exception_destroy __std_exception_copy __std_terminate memcmp _CxxThrowException _purecall

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function terminate _controlfp_s _set_invalid_parameter_handler _invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo _crt_atexit _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

strlen strtok_s wcstok_s wcscat_s wcscpy_s

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswscanf __stdio_common_vsnwprintf_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_188d7d22718fb9f9f064540c194776ee_amadey_elex_glassworm_hijackloader_icedid_vidar_wannacry

kernel32

user32

advapi32

shell32

ole32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic