2026-10-03_fce6947e08d104f6fe645f1b44246fce_elex_wannacry

resource	yara_rule
sample	INDICATOR_EXE_Packed_MPress

resource
2026-10-03_fce6947e08d104f6fe645f1b44246fce_elex_wannacry

IMPHASH e602ae382884293b806fc7d0182b13c4
SHA256 c4f8a57b9822a2f81dda3373bc2a8b84e1252f7aa2788954812d8fb0097e9f38
MD5 fce6947e08d104f6fe645f1b44246fce
SHA1 73fddbae6d5bb7465be7cc37a90c8c8da99f2fa0
SHA512 76a6d85fee27679ee373c38c930fd9f5205623c071328ad2ff02c433813ff4bec0997ec32cbe0a329cbdfad2a77ea17c9a3301625728d294977faa0b0ba78b8b
SSDEEP 1536:FvDaJ8JyCzk5zLcbsDLUwKJup4X+v3tx:ZmJnzgbs33KJup4uv3tx
TLSH
T122C36C0376A8E8A2D4A204311264BB7B4BBA5C72054E5A67E7C07C1B3C7AA5BD11DF1F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables built or packed with MPress PE compressor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

VirtualProtect GetStartupInfoA GetModuleHandleA CreateToolhelp32Snapshot Process32First Process32Next lstrcmpiA CopyFileA GetCurrentThreadId ExpandEnvironmentStringsA InitializeCriticalSection DeleteCriticalSection VirtualFree LeaveCriticalSection Sleep EnterCriticalSection VirtualAlloc CreateEventA CloseHandle WaitForSingleObject ResetEvent lstrcpyA SetEvent InterlockedExchange CancelIo WriteFile SetFilePointer CreateFileA GetFileSize ReadFile GetWindowsDirectoryA GetFileAttributesA CreateProcessA lstrlenA TerminateThread lstrcatA GetTickCount GetLastError GetCurrentProcess HeapAlloc GetProcessHeap VirtualProtect GetProcAddress LoadLibraryA IsBadReadPtr HeapFree FreeLibrary GetDiskFreeSpaceExA GetDriveTypeA GlobalMemoryStatusEx GetSystemInfo GetVersionExA WinExec GetModuleFileNameA DeleteFileA DuplicateHandle OpenProcess CreateDirectoryA GetLocalTime OpenEventA ExitProcess

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit _beginthreadex _access sprintf _except_handler3 free realloc malloc memcmp ??2@YAPAXI@Z memset __CxxFrameHandler _ftol memmove ??3@YAXPAX@Z

user32

OpenInputDesktop GetThreadDesktop GetUserObjectInformationA SetThreadDesktop OpenDesktopA PostThreadMessageA GetInputState GetMessageA ExitWindowsEx wsprintfA CloseDesktop

advapi32

RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyA StartServiceCtrlDispatcherA CloseServiceHandle StartServiceA OpenServiceA UnlockServiceDatabase ChangeServiceConfig2A LockServiceDatabase CreateServiceA OpenSCManagerA

shell32

ShellExecuteA

ws2_32

connect htons gethostbyname socket closesocket ntohs recv select send gethostname getsockname WSAIoctl WSACleanup WSAStartup setsockopt

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle

.MPRESS1

SHA256 23c2d405a9a739d4be9063c781c87f3994290602297d4cb95a331d314005a772
MD5 ad1d38f5ce33d6f5a8d15a801fbab28d
SHA1 092a78399ae57140682461b6111a2eb8fe2749cb
SHA512 22b4378d368504edae67139b2ad509d4c4ea7f1891ffd92bc1eca88c26dd0197dbcec589d3010c2d9c15ba8a584f047d7345f54eb0975295dd506c29d76d2f9c
SSDEEP 768:glwJJRohvyCkxakpA6sgWVqPmYcnbPfsk9kLyl1azBK4jRmpEtpWX1X+v:gaJ8JyCzk5zLcbsDLUwKJup4X+v
TLSH
T199233A027AA5E862D591447212687B6B47BE4CB3058E5A67F3C07C1B3C7AA9BD01DF0F
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables built or packed with MPress PE compressor

.MPRESS2

SHA256 40138b9244ef8641c17e0eaf70a35830d4371c11ab20008c8061858338fa601d
MD5 23b82b7f806aa20b4b39de6adb296af6
SHA1 eda3e73180b053042eed06225cbd7dbef885c64a
SHA512 7cb42560a2a24929b4ee9a0d939949a138a56adbfd2ff6d15002b8cc4374bb59a12128f14a5aa36f87ffe8e7fa7f9163f7799f6f2e363d953543accce58820ed
TLSH
T16A81C3C2D2EE5688C97D943B112D780F6460A91E3000E6FA9BD4213BB442F399EBD396
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/1033/GROUP_ICON/103

SHA256 3b1176ee292fcf401e2cd56d5696a9c3eba5b68b12270d40dda9e363ed47045e
MD5 0bcf38b5ea9f4824a1e7b284f1e36994
SHA1 95903c98bd6b26b6db96ea14b97d0fc3ce379bba
SHA512 2068a34f77fa92694eabeaca903e107f2d7ecd5cef13dbd2415a9d408798fd313a12b6699a62fb014ae922876eb58f0a93fc783eb510c283f234db5faa84cb29
MD5 SHA1 SHA512

Detects executables built or packed with MPress PE compressor

.rsrc/1033/ICON/1.ico

SHA256 e64928613131e6f5ddae9f04a7cffc494e287fef6520309a9649aa35717adf38
MD5 0a0113f2183f67d361e07d3e3914541d
SHA1 63367a0a89f0fe33b8d9e3474e9ff09ea6586f44
SHA512 4f16cc153a2705f90c05eabe918dede70f68fccbf28636034cebdf62f640e9d988751451637b305a0e99b532a236fabe76d424c9a739bff5eeee25037b3e9e49
TLSH
T16E01C24A3015B52DC54917328CABAAB5ACFF1C21BD20451BF1E0BB5F6A722253643D3C
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/1033/MANIFEST/1

SHA256 e07d7fa88eac47bf707d9cabd85df18a4696a209750a5e6ad1401b0dc2db31bf
MD5 98e3e14528b61fe20c6bcac5aff75e8e
SHA1 a190daa7d40786b8a07e804c640f220502a887b2
SHA512 a9858c9a7e8120d540604e48a034df22ed50153456e827f6b2ce1479ff21f5d799a1ce2e4187182d6756bc4b93d2494620f2835a2d35bd989249ea7dcb1088d7
TLSH
T153111481C054E926E75202E33E75F55D15BE632B08CC46EDC8C2DA7EA74B7CA87521A2
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/2052/version.txt

SHA256 7b49519e48560c6347b6020f5409c8b23451b50b48e561706552f842b1d26348
MD5 63e8d814d646a5e590d8f156421b8bcf
SHA1 2d97566992a53175ab247be41478f513a1def74f
SHA512 fcd19b84477a534c48d38a9babf3867c96c15722eeb2a9f4a8310ded678da5863b9cd6d45cf02952af80e2e6fe22df4779a7a09e387cea1bed21d0cdff19c525
TLSH
T15721DF0696F72659B0B76A894FDACC3603577D00483DA26E99CC3E5E0FD34049921BF7
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

Sharing

General

Malware Config

Signatures

File Explorer