2026-07-31_923e05ac5144dedf0349443302964995_elex_emotet_glassworm_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_923e05ac5144dedf0349443302964995_elex_emotet_glassworm_wannacry
Size 696KB
Sample260801-br5cesbd99
SHA256 bcf84217c79bad704111cb49c073b285ad23a707419b9e8b2ce9f9235075647d
MD5 923e05ac5144dedf0349443302964995
SHA1 12993874d2d0f9772a74c033729852624d028010
SHA512 5e4f56f8b24884ce63b88d25f278484da20fdfd2d10c4e17d2bc007e520b432487997136ce18036a772d508e9736552deed0587c09ffa39ef57c5b4a7a365a71
SSDEEP 12288:W47htyim6CJ1tjiNqZrLiwkBs5j2/Lnk1zFqIs4xT8y1N0IzP54+WtYCTXOkdDsd:rht6zZrqByjYLnQqz4xT8y1NrP54jWCi
TLSH
T1EFE45BC22690C4B9DF631570D8691EF776E8AC51C6F1C86F22F47D3B3A3064196E622B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-31_923e05ac5144dedf0349443302964995_elex_emotet_glassworm_wannacry

File Explorer

2026-07-31_923e05ac5144dedf0349443302964995_elex_emotet_glassworm_wannacry

.exe 696KB

2026-07-31_923e05ac5144dedf0349443302964995_elex_emotet_glassworm_wannacry

IMPHASH eafbc6fad14da33f5754bd77fec36f62
SHA256 bcf84217c79bad704111cb49c073b285ad23a707419b9e8b2ce9f9235075647d
MD5 923e05ac5144dedf0349443302964995
SHA1 12993874d2d0f9772a74c033729852624d028010
SHA512 5e4f56f8b24884ce63b88d25f278484da20fdfd2d10c4e17d2bc007e520b432487997136ce18036a772d508e9736552deed0587c09ffa39ef57c5b4a7a365a71
SSDEEP 12288:W47htyim6CJ1tjiNqZrLiwkBs5j2/Lnk1zFqIs4xT8y1N0IzP54+WtYCTXOkdDsd:rht6zZrqByjYLnQqz4xT8y1NrP54jWCi
TLSH
T1EFE45BC22690C4B9DF631570D8691EF776E8AC51C6F1C86F22F47D3B3A3064196E622B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9c:51:ba:81:d6:9d:a3:ce:79:58:65:db:89:64:ca:0a:36:7c:91:71

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Citrix Online,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Online,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US

Chains

Jun 20, 2007

CN=Citrix Online,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Online,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Citrix Online,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Online,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US

Serial Number

6a:d5:72:eb:16:e9:7c:3f:8f:86:64:46:e4:d0:ae:71

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 16, 2006 - Jun 26, 2009

Minor OS version

Major OS version

Entry point

326266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\P4Builds\Apps\G2v6.1\output\g2fileh.pdb

rpcrt4

NdrOleFree IUnknown_QueryInterface_Proxy IUnknown_AddRef_Proxy IUnknown_Release_Proxy CStdStubBuffer_QueryInterface CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease NdrCStdStubBuffer_Release NdrOleAllocate NdrDllGetClassObject

mpr

WNetCloseEnum WNetAddConnection3A WNetOpenEnumA WNetEnumResourceA

comctl32

ImageList_Create _TrackMouseEvent InitCommonControlsEx ImageList_DragLeave ImageList_EndDrag ImageList_DragMove ImageList_Merge ImageList_GetImageInfo ImageList_BeginDrag ImageList_DragEnter ImageList_SetBkColor ImageList_Destroy ImageList_ReplaceIcon

winmm

timeGetTime

shlwapi

PathRemoveExtensionA PathStripPathA SHDeleteKeyA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

msvcrt

__p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit _onexit __dllonexit ??1type_info@@UAE@XZ calloc __CxxFrameHandler malloc sscanf wcslen _beginthreadex _errno exit strchr time _snprintf clock fflush _iob fputs _itoa strtol strpbrk printf _strlwr _strupr __p__fmode strstr localtime mktime realloc _makepath strncpy free _chdir wcstombs strcat _vsnprintf _strnicmp div strcmp __set_app_type _splitpath fopen fclose _ui64toa __p___argc sprintf _atoi64 _stricmp _ismbcalpha _except_handler3 ??8type_info@@QBEHABV0@@Z strrchr strlen memcmp strcpy memset strncmp memmove ??2@YAPAXI@Z ??3@YAXPAX@Z _controlfp memcpy

kernel32

GlobalSize GetStartupInfoA GetSystemTimeAsFileTime SetFileTime ReadFile GetTempFileNameA CreateProcessA OpenProcess GetCurrentThread lstrcpynA QueryPerformanceFrequency QueryPerformanceCounter GetTickCount HeapFree HeapAlloc HeapDestroy HeapCreate MapViewOfFile UnmapViewOfFile CreateFileMappingA GetFileSize WriteFile SetFilePointer TlsFree LocalAlloc lstrlenA OpenEventA TerminateThread LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection ReleaseSemaphore CreateSemaphoreA SetUnhandledExceptionFilter GetCurrentProcess IsBadReadPtr TlsAlloc TlsSetValue TlsGetValue InterlockedIncrement SuspendThread GetThreadContext ResumeThread ReleaseMutex CreateMutexA GetSystemTime RaiseException GetTempPathA GetWindowsDirectoryA LoadLibraryExA Sleep InterlockedExchange ExitProcess GetLastError FreeLibrary GetModuleHandleA CreateDirectoryA CreateFileA FindFirstFileA FindNextFileA GetFileAttributesA FileTimeToSystemTime FileTimeToLocalFileTime FindClose CloseHandle SetEvent GetCurrentThreadId GetProcAddress GetVersionExA LoadLibraryA GlobalUnlock GlobalLock SystemTimeToFileTime GetVolumeInformationA GetTimeZoneInformation LocalFileTimeToFileTime GetCurrentProcessId MultiByteToWideChar GetACP GetModuleFileNameA GetCommandLineA CreateEventA GetDiskFreeSpaceA GlobalFree CreateThread GetDriveTypeA WideCharToMultiByte MoveFileA SetLastError RemoveDirectoryA DeleteFileA SetFileAttributesA WaitForSingleObject FindCloseChangeNotification FindNextChangeNotification WaitForMultipleObjects LocalFree FormatMessageA FindFirstChangeNotificationA ResetEvent

gdi32

CreateCompatibleDC CreateCompatibleBitmap GetTextExtentPoint32A CreatePen CreateSolidBrush ExtTextOutA Rectangle RoundRect LineTo MoveToEx BitBlt DeleteDC GetTextExtentExPointA SaveDC RestoreDC GetObjectA CreateFontIndirectA DeleteObject SetTextColor SetBkColor SetBkMode GetDeviceCaps GetStockObject SelectObject

ole32

CLSIDFromString CoTaskMemAlloc CoGetCurrentProcess CoInitializeSecurity CoDisconnectObject CoUninitialize CoInitializeEx StringFromCLSID CoTaskMemFree CoRegisterClassObject CoRegisterPSClsid CoGetObject CoGetClassObject CoCreateInstance OleUninitialize CoInitialize OleInitialize

oleaut32

BSTR_UserUnmarshal BSTR_UserMarshal BSTR_UserSize SysStringByteLen SysAllocStringLen LPSAFEARRAY_UserSize LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserUnmarshal SysAllocStringByteLen BSTR_UserFree SysFreeString LPSAFEARRAY_UserFree

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_923e05ac5144dedf0349443302964995_elex_emotet_glassworm_wannacry

PE Signature issue

rpcrt4

mpr

comctl32

winmm

shlwapi

version

msvcrt

kernel32

gdi32

ole32

oleaut32

generic