2026-08-30_f1238d5b0f0cefa8cad1347d1ed6dc31_elex_wannacry

General

Target
2026-08-30_f1238d5b0f0cefa8cad1347d1ed6dc31_elex_wannacry
Size 264KB
Sample260831-bf23xssgpg
SHA256 4b3433eec61797ef627934989562b593c67288503c7a91d991b00afc917cbd63
MD5 f1238d5b0f0cefa8cad1347d1ed6dc31
SHA1 c1cac8b1fefbc18326c4866c4e11d3e40f7b47a1
SHA512 57f2b9c666bef8c532e7d231d7a7d61df786e34ff91103d8fbc2d7f35133aec906ffbaef43a1683b79981eb8553d6fc9f4533c56cf81cb538efb9cbdce9fe48f
SSDEEP 768:C7D3denLA+w5PbLE9mZ7mYrPSLN4bhgF37DDv47:CP3deLvw5PboEymE6kc
TLSH
T15C447D7FF3A21DB9C0E508363A5769E76678BD301524B903EF88084F5DB1AEAA530317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables built or packed with MPress PE compressor 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MPress

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_f1238d5b0f0cefa8cad1347d1ed6dc31_elex_wannacry

File Explorer

2026-08-30_f1238d5b0f0cefa8cad1347d1ed6dc31_elex_wannacry

.exe 264KB

2026-08-30_f1238d5b0f0cefa8cad1347d1ed6dc31_elex_wannacry

IMPHASH a49b08e8509276db8757650efa9d71e5
SHA256 4b3433eec61797ef627934989562b593c67288503c7a91d991b00afc917cbd63
MD5 f1238d5b0f0cefa8cad1347d1ed6dc31
SHA1 c1cac8b1fefbc18326c4866c4e11d3e40f7b47a1
SHA512 57f2b9c666bef8c532e7d231d7a7d61df786e34ff91103d8fbc2d7f35133aec906ffbaef43a1683b79981eb8553d6fc9f4533c56cf81cb538efb9cbdce9fe48f
SSDEEP 768:C7D3denLA+w5PbLE9mZ7mYrPSLN4bhgF37DDv47:CP3deLvw5PboEymE6kc
TLSH
T15C447D7FF3A21DB9C0E508363A5769E76678BD301524B903EF88084F5DB1AEAA530317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables built or packed with MPress PE compressor
UPX dump on OEP (original entry point)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

178200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

GetModuleFileNameA SetErrorMode CreateMutexA GetStartupInfoA GetModuleHandleA LocalFree GetLastError ExitProcess GetTickCount lstrcmpA lstrcpynA GetLogicalDriveStringsA GetDriveTypeA lstrlenA lstrcatA lstrcpyA LoadLibraryA GetProcAddress GetVolumeInformationA GetTempFileNameA GetTempPathA MoveFileExA Sleep CreateProcessA CloseHandle Process32Next Process32First CreateToolhelp32Snapshot CreateThread GlobalAlloc SetFileAttributesA

msvcrt

__p__fmode __set_app_type ??1type_info@@UAE@XZ _controlfp _strdup _unlink fread __p__commode _adjust_fdiv __setusermatherr sprintf atoi fclose ftell fseek fopen toupper _strcmpi strcpy calloc _except_handler3 malloc fwrite fputs strlen strcat rand strstr strrchr strcmp memset strtok free __CxxFrameHandler _EH_prolog srand __argv __argc _CxxThrowException ??3@YAXPAX@Z _exit _XcptFilter exit _acmdln __getmainargs _initterm

oleaut32

GetErrorInfo

user32

wsprintfA IsCharAlphaNumericA

ws2_32

WSAStartup gethostbyname htons connect recv shutdown accept listen bind socket send closesocket WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-30_f1238d5b0f0cefa8cad1347d1ed6dc31_elex_wannacry

kernel32

msvcrt

oleaut32

user32

ws2_32

generic