2026-06-26_c0ab785974db73f00f6513de40979b0b_elex_scribble_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_c0ab785974db73f00f6513de40979b0b_elex_scribble_wannacry
Size 116KB
Sample260629-pvbfeafs7k
SHA256 5f81ce19b26b953d58e8a84d6e84fc6775cb2833f74c49cdea9a0f3f0ce16a0d
MD5 c0ab785974db73f00f6513de40979b0b
SHA1 2563500e6acedc3c634d9f6c232b7bb7c16a53a3
SHA512 7e759121cfbe2b7535a1b23a4ff4026c2c1434c3746a3fb37247fd51e156462b9c78735f8f5d4a3b2462420ddd28aee30dbe07873106a74b4bfda55b48059f8f
SSDEEP 1536:qX81TBttWhWW/kn/fXyHt0qfWT5MtFPEbtaR82GB/2wwHVHrq/fKrGBZ9AecxzrF:pTYl/knHyHKwWT5yFPAaC/BAFrWFkxv
TLSH
T115C3CF07FE8590F2D8131071214EABFB966A1D79871FFA8AEB48DCC72471390A83B15D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_c0ab785974db73f00f6513de40979b0b_elex_scribble_wannacry

File Explorer

2026-06-26_c0ab785974db73f00f6513de40979b0b_elex_scribble_wannacry

.exe 116KB

2026-06-26_c0ab785974db73f00f6513de40979b0b_elex_scribble_wannacry

IMPHASH 1b366007670c77a9492e77f7c4e7ce2b
SHA256 5f81ce19b26b953d58e8a84d6e84fc6775cb2833f74c49cdea9a0f3f0ce16a0d
MD5 c0ab785974db73f00f6513de40979b0b
SHA1 2563500e6acedc3c634d9f6c232b7bb7c16a53a3
SHA512 7e759121cfbe2b7535a1b23a4ff4026c2c1434c3746a3fb37247fd51e156462b9c78735f8f5d4a3b2462420ddd28aee30dbe07873106a74b4bfda55b48059f8f
SSDEEP 1536:qX81TBttWhWW/kn/fXyHt0qfWT5MtFPEbtaR82GB/2wwHVHrq/fKrGBZ9AecxzrF:pTYl/knHyHKwWT5yFPAaC/BAFrWFkxv
TLSH
T115C3CF07FE8590F2D8131071214EABFB966A1D79871FFA8AEB48DCC72471390A83B15D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

149593

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord4837 ord4425 ord3597 ord1146 ord1168 ord324 ord4234 ord2379 ord755 ord470 ord3798 ord5280 ord825 ord4353 ord6374 ord5163 ord2385 ord5241 ord4407 ord1775 ord4078 ord6052 ord4710 ord4998 ord4853 ord4376 ord5265 ord1134 ord2514 ord641 ord815 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord4673 ord4627

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm _strrev rand __getmainargs _acmdln _XcptFilter _exit _onexit __dllonexit _except_handler3 strncmp exit sprintf __CxxFrameHandler strstr strncpy atoi strcspn

kernel32

EnumResourceNamesA FindResourceA LoadResource LockResource MoveFileExA OpenMutexA ReleaseMutex ExitProcess CreateThread WaitForSingleObject WriteFile CloseHandle CreateFileA EndUpdateResourceA lstrlenA GetTempPathA lstrcatA GetProcAddress WinExec LoadLibraryA Sleep GetComputerNameA GetLocaleInfoW GetModuleHandleA GetStartupInfoA CreateProcessA TerminateProcess ExitThread UpdateResourceA BeginUpdateResourceA GlobalFree ReadFile GlobalAlloc GetFileSize GetFileAttributesA lstrcpyA GetLastError CreateMutexA CopyFileA GetSystemDirectoryA GetTickCount lstrcpynA GlobalMemoryStatusEx

user32

EnableWindow IsIconic wsprintfA LoadIconA DrawIcon GetClientRect GetSystemMetrics SendMessageA

advapi32

RegOpenKeyA CloseServiceHandle StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA SetServiceStatus RegOpenKeyExA RegQueryValueExA RegCloseKey OpenSCManagerA OpenServiceA DeleteService StartServiceA CreateServiceA RegSetValueExA

ws2_32

WSAStartup send select __WSAFDIsSet recv setsockopt WSAIoctl htons socket connect closesocket gethostbyname inet_addr sendto WSASocketA htonl

winmm

timeGetTime

Name

2z90A

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

496B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

02N

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

39KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

cvofshi

Size

31KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

bbhxiky

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_c0ab785974db73f00f6513de40979b0b_elex_scribble_wannacry

mfc42

msvcrt

kernel32

user32

advapi32

ws2_32

winmm

generic