2026-08-27_eceb2e59d75cf52d01dd8a2a95862668_elex_vidar_wannacry

General

Target
2026-08-27_eceb2e59d75cf52d01dd8a2a95862668_elex_vidar_wannacry
Size 16.5MB
Sample260828-c8v1rasfpg
SHA256 1661f590f46659b034fb420c36468ce56c5b8614a514112a165d950574ab39e2
MD5 eceb2e59d75cf52d01dd8a2a95862668
SHA1 6367fefb428b745840de77e9e59a62bbae037abe
SHA512 426879a83f90cc65c4573fa4103a9aa58b5fbe8e50fb04722fe559b37e336b1c86738f34de241d7ae767b715970fd78d5d4f70034d7f155bab37fb7b8dfb1282
SSDEEP 49152:3M+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+ETqatgq+ESM+P:hK7K7K7K777K7K7K7K7K7K7K7K7F
TLSH
T13B072909F98344B2D92B11B04CCBD3BF8A30BE258B128EEBF64DD75F6933B915428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_eceb2e59d75cf52d01dd8a2a95862668_elex_vidar_wannacry

SHA256 1661f590f46659b034fb420c36468ce56c5b8614a514112a165d950574ab39e2
MD5 eceb2e59d75cf52d01dd8a2a95862668
SHA1 6367fefb428b745840de77e9e59a62bbae037abe
SHA512 426879a83f90cc65c4573fa4103a9aa58b5fbe8e50fb04722fe559b37e336b1c86738f34de241d7ae767b715970fd78d5d4f70034d7f155bab37fb7b8dfb1282
SSDEEP 49152:3M+ES+ETqatgq+ESM+ES+ETqatgE+ES+Ek+ES+ES+E2+ESM+ES+ETqatgq+ESM+P:hK7K7K7K777K7K7K7K7K7K7K7K7F
TLSH
T13B072909F98344B2D92B11B04CCBD3BF8A30BE258B128EEBF64DD75F6933B915428655
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

89021

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths