2026-05-29_b5655d8649e24989402e568cd851813a_amadey_elex_hijackloader_mespinoza_vidar_wannacry

General

Target
2026-05-29_b5655d8649e24989402e568cd851813a_amadey_elex_hijackloader_mespinoza_vidar_wannacry
Size 1.6MB
Sample260529-sdp41sd16t
SHA256 82954fab9d8d8967b28d303b6e4efabc14b7e12b1a19c2293459c442465934e3
MD5 b5655d8649e24989402e568cd851813a
SHA1 9ff1fb3c0cc00b62b4d0aec87d107c99052f9863
SHA512 aa73fdded108e6dbdfbf711c73f8f3db87558052e723731c4d2c9a6509ed25951e97eec48dc776035d672ddbb8dd17e890d09143f3d1fc136b7545f34c70995b
SSDEEP 24576:04HOsRgiiplc+lPY/azauIZe0p4Ek4niOkl/A04szE87JKTvmjIh7CH:04usuzN2ZeW4SkZP4sz9MbBhOH
TLSH
T16C850815B6B88332D0B28075C596A65DFA323401DB238ECB12859FECBFE36D58A35735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-29_b5655d8649e24989402e568cd851813a_amadey_elex_hijackloader_mespinoza_vidar_wannacry

File Explorer

2026-05-29_b5655d8649e24989402e568cd851813a_amadey_elex_hijackloader_mespinoza_vidar_wannacry

.exe 1.6MB

2026-05-29_b5655d8649e24989402e568cd851813a_amadey_elex_hijackloader_mespinoza_vidar_wannacry

SHA256 82954fab9d8d8967b28d303b6e4efabc14b7e12b1a19c2293459c442465934e3
MD5 b5655d8649e24989402e568cd851813a
SHA1 9ff1fb3c0cc00b62b4d0aec87d107c99052f9863
SHA512 aa73fdded108e6dbdfbf711c73f8f3db87558052e723731c4d2c9a6509ed25951e97eec48dc776035d672ddbb8dd17e890d09143f3d1fc136b7545f34c70995b
SSDEEP 24576:04HOsRgiiplc+lPY/azauIZe0p4Ek4niOkl/A04szE87JKTvmjIh7CH:04usuzN2ZeW4SkZP4sz9MbBhOH
TLSH
T16C850815B6B88332D0B28075C596A65DFA323401DB238ECB12859FECBFE36D58A35735
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

94229

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\msosrec.pdb

Name

.text

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-29_b5655d8649e24989402e568cd851813a_amadey_elex_hijackloader_mespinoza_vidar_wannacry

generic