2026-10-06_e89943c34019f42aa13c7ea424e0da24_elex_wannacry

resource	yara_rule
sample	INDICATOR_EXE_Packed_MPress

resource
2026-10-06_e89943c34019f42aa13c7ea424e0da24_elex_wannacry

IMPHASH e602ae382884293b806fc7d0182b13c4
SHA256 05f3c17c07337d38355abf70a1bbf33181f5ccb762b0522b99b9b236b3e8f768
MD5 e89943c34019f42aa13c7ea424e0da24
SHA1 f537ab33131d2819abf4a03a7fe6e55d15507f99
SHA512 34b587036cd6f74131769e673be282e5c2ec1ec25dd4acab8c8fd81c588564fc5bbd3a420c5d9cdba6baf7b20c7821ef9111dbb2fb875feda70cfcbb967925a9
SSDEEP 1536:dvDaJ8JyCzk5zLcbsDLUwK9up4X+v3tx:RmJnzgbs33K9up4uv3tx
TLSH
T1E6C36B0376A8E8A2D4A204311264BB7B4BBA5C72054E5A67E7C07C1B3C7AA5BD11DF1F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables built or packed with MPress PE compressor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

VirtualProtect GetStartupInfoA GetModuleHandleA CreateToolhelp32Snapshot Process32First Process32Next lstrcmpiA CopyFileA GetCurrentThreadId ExpandEnvironmentStringsA InitializeCriticalSection DeleteCriticalSection VirtualFree LeaveCriticalSection Sleep EnterCriticalSection VirtualAlloc CreateEventA CloseHandle WaitForSingleObject ResetEvent lstrcpyA SetEvent InterlockedExchange CancelIo WriteFile SetFilePointer CreateFileA GetFileSize ReadFile GetWindowsDirectoryA GetFileAttributesA CreateProcessA lstrlenA TerminateThread lstrcatA GetTickCount GetLastError GetCurrentProcess HeapAlloc GetProcessHeap VirtualProtect GetProcAddress LoadLibraryA IsBadReadPtr HeapFree FreeLibrary GetDiskFreeSpaceExA GetDriveTypeA GlobalMemoryStatusEx GetSystemInfo GetVersionExA WinExec GetModuleFileNameA DeleteFileA DuplicateHandle OpenProcess CreateDirectoryA GetLocalTime OpenEventA ExitProcess

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit _beginthreadex _access sprintf _except_handler3 free realloc malloc memcmp ??2@YAPAXI@Z memset __CxxFrameHandler _ftol memmove ??3@YAXPAX@Z

user32

OpenInputDesktop GetThreadDesktop GetUserObjectInformationA SetThreadDesktop OpenDesktopA PostThreadMessageA GetInputState GetMessageA ExitWindowsEx wsprintfA CloseDesktop

advapi32

RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyA StartServiceCtrlDispatcherA CloseServiceHandle StartServiceA OpenServiceA UnlockServiceDatabase ChangeServiceConfig2A LockServiceDatabase CreateServiceA OpenSCManagerA

shell32

ShellExecuteA

ws2_32

connect htons gethostbyname socket closesocket ntohs recv select send gethostname getsockname WSAIoctl WSACleanup WSAStartup setsockopt

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle

.MPRESS1

SHA256 743c6b7737913809f02046fcc76a7d044806fb3a7e4b48fc4810f0102f02d5d7
MD5 67a58d991bfba86e16d20b73d4820142
SHA1 748000f4bd999fcf3498f2506ca66adabb5e8e56
SHA512 461410d3c4bf62e83328d010d7b1f16f6b2e1f47778cb868cdfdee4bbbed75175947284a5bcba641fa62125a602e85f7c67662715a13ca4b42969b63317a60c2
SSDEEP 768:glwJJRohvyCkxakpA6sgWVqPmYcnbPfsk9kLyl1azBK4jRypEtpWX1X+v:gaJ8JyCzk5zLcbsDLUwK9up4X+v
TLSH
T1D2233A027AA5E862D59144711268BB6B47BE4CB3058E5A67F3C07C1B3C7AA9BD01DF0F
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables built or packed with MPress PE compressor

.MPRESS2

SHA256 40138b9244ef8641c17e0eaf70a35830d4371c11ab20008c8061858338fa601d
MD5 23b82b7f806aa20b4b39de6adb296af6
SHA1 eda3e73180b053042eed06225cbd7dbef885c64a
SHA512 7cb42560a2a24929b4ee9a0d939949a138a56adbfd2ff6d15002b8cc4374bb59a12128f14a5aa36f87ffe8e7fa7f9163f7799f6f2e363d953543accce58820ed
TLSH
T16A81C3C2D2EE5688C97D943B112D780F6460A91E3000E6FA9BD4213BB442F399EBD396
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/1033/GROUP_ICON/103

SHA256 3b1176ee292fcf401e2cd56d5696a9c3eba5b68b12270d40dda9e363ed47045e
MD5 0bcf38b5ea9f4824a1e7b284f1e36994
SHA1 95903c98bd6b26b6db96ea14b97d0fc3ce379bba
SHA512 2068a34f77fa92694eabeaca903e107f2d7ecd5cef13dbd2415a9d408798fd313a12b6699a62fb014ae922876eb58f0a93fc783eb510c283f234db5faa84cb29
MD5 SHA1 SHA512

Detects executables built or packed with MPress PE compressor

.rsrc/1033/ICON/1.ico

SHA256 e64928613131e6f5ddae9f04a7cffc494e287fef6520309a9649aa35717adf38
MD5 0a0113f2183f67d361e07d3e3914541d
SHA1 63367a0a89f0fe33b8d9e3474e9ff09ea6586f44
SHA512 4f16cc153a2705f90c05eabe918dede70f68fccbf28636034cebdf62f640e9d988751451637b305a0e99b532a236fabe76d424c9a739bff5eeee25037b3e9e49
TLSH
T16E01C24A3015B52DC54917328CABAAB5ACFF1C21BD20451BF1E0BB5F6A722253643D3C
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/1033/MANIFEST/1

SHA256 e07d7fa88eac47bf707d9cabd85df18a4696a209750a5e6ad1401b0dc2db31bf
MD5 98e3e14528b61fe20c6bcac5aff75e8e
SHA1 a190daa7d40786b8a07e804c640f220502a887b2
SHA512 a9858c9a7e8120d540604e48a034df22ed50153456e827f6b2ce1479ff21f5d799a1ce2e4187182d6756bc4b93d2494620f2835a2d35bd989249ea7dcb1088d7
TLSH
T153111481C054E926E75202E33E75F55D15BE632B08CC46EDC8C2DA7EA74B7CA87521A2
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/2052/version.txt

SHA256 7b49519e48560c6347b6020f5409c8b23451b50b48e561706552f842b1d26348
MD5 63e8d814d646a5e590d8f156421b8bcf
SHA1 2d97566992a53175ab247be41478f513a1def74f
SHA512 fcd19b84477a534c48d38a9babf3867c96c15722eeb2a9f4a8310ded678da5863b9cd6d45cf02952af80e2e6fe22df4779a7a09e387cea1bed21d0cdff19c525
TLSH
T15721DF0696F72659B0B76A894FDACC3603577D00483DA26E99CC3E5E0FD34049921BF7
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

Sharing

General

Malware Config

Signatures

File Explorer