2026-05-29_3a23256e9408d27fce7c7bf259f4c0c3_amadey_cobalt-strike_glassworm_hijackloader_satacom_vidar_wannacry

General

Target
2026-05-29_3a23256e9408d27fce7c7bf259f4c0c3_amadey_cobalt-strike_glassworm_hijackloader_satacom_vidar_wannacry
Size 568KB
Sample260529-lddbwsf19m
SHA256 20e8a1763784912eafcd9167341aa48946e3c3fed0eda8e85b74bea1588d7db4
MD5 3a23256e9408d27fce7c7bf259f4c0c3
SHA1 064abb6a7ab6c603dc41b7709c81fc9901b7436d
SHA512 56e12e5ded6c1f833b157989321112769f06398379e02214251f093268504623532d0b47c8d270bec739456a83583aeb21c4117060ce52b56b55d7aa619575ec
SSDEEP 12288:PCGD3JeU7vinrm1KHCpeVQIa0dUIVlN9o:PCGD5Tvinrm1KipeXa0HVlN9o
TLSH
T11AC4900666544FB5D16F45348A61A65EA373BC15CE134FCB12906EDEFFF2A809E28233
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-29_3a23256e9408d27fce7c7bf259f4c0c3_amadey_cobalt-strike_glassworm_hijackloader_satacom_vidar_wannacry

2026-05-29_3a23256e9408d27fce7c7bf259f4c0c3_amadey_cobalt-strike_glassworm_hijackloader_satacom_vidar_wannacry

.exe 568KB

IMPHASH 3325e12181a2525dc192101472612d6a
SHA256 20e8a1763784912eafcd9167341aa48946e3c3fed0eda8e85b74bea1588d7db4
MD5 3a23256e9408d27fce7c7bf259f4c0c3
SHA1 064abb6a7ab6c603dc41b7709c81fc9901b7436d
SHA512 56e12e5ded6c1f833b157989321112769f06398379e02214251f093268504623532d0b47c8d270bec739456a83583aeb21c4117060ce52b56b55d7aa619575ec
SSDEEP 12288:PCGD3JeU7vinrm1KHCpeVQIa0dUIVlN9o:PCGD5Tvinrm1KipeXa0HVlN9o
TLSH
T11AC4900666544FB5D16F45348A61A65EA373BC15CE134FCB12906EDEFFF2A809E28233
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

2

Major OS version

5

Entry point

10852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\CB\11X_MainQ\BuildResults\bin\Release\chrome_wow_helper.pdb