2026-10-08_5b850b5aef4c7abd3013ec564db2888c_elex_wannacry

resource	yara_rule
sample	INDICATOR_EXE_Packed_MPress

resource
2026-10-08_5b850b5aef4c7abd3013ec564db2888c_elex_wannacry

IMPHASH e602ae382884293b806fc7d0182b13c4
SHA256 1cec8de28e109e528f8e09ec7d21a888268568ab94e712ea6046f3a4de4b008d
MD5 5b850b5aef4c7abd3013ec564db2888c
SHA1 8cb23ae83037a5526c9784f38885d06bc76667ff
SHA512 acd61b25b97715fb1c80c3399df35872946c85f735846520d47646f229f0321e744396d807126ee6630cc4ad35373e43310d19907e5179abd9752126f05ac653
SSDEEP 1536:zvDaJ8JyCzk5zLcbsDLUwKBup4X+v3tx:7mJnzgbs33KBup4uv3tx
TLSH
T134C36B0376A8E8A2D4A204311664BB7B4BBA5C72054E5A67E7C07C1B3C7AA4BD11DF1F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables built or packed with MPress PE compressor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

VirtualProtect GetStartupInfoA GetModuleHandleA CreateToolhelp32Snapshot Process32First Process32Next lstrcmpiA CopyFileA GetCurrentThreadId ExpandEnvironmentStringsA InitializeCriticalSection DeleteCriticalSection VirtualFree LeaveCriticalSection Sleep EnterCriticalSection VirtualAlloc CreateEventA CloseHandle WaitForSingleObject ResetEvent lstrcpyA SetEvent InterlockedExchange CancelIo WriteFile SetFilePointer CreateFileA GetFileSize ReadFile GetWindowsDirectoryA GetFileAttributesA CreateProcessA lstrlenA TerminateThread lstrcatA GetTickCount GetLastError GetCurrentProcess HeapAlloc GetProcessHeap VirtualProtect GetProcAddress LoadLibraryA IsBadReadPtr HeapFree FreeLibrary GetDiskFreeSpaceExA GetDriveTypeA GlobalMemoryStatusEx GetSystemInfo GetVersionExA WinExec GetModuleFileNameA DeleteFileA DuplicateHandle OpenProcess CreateDirectoryA GetLocalTime OpenEventA ExitProcess

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit _beginthreadex _access sprintf _except_handler3 free realloc malloc memcmp ??2@YAPAXI@Z memset __CxxFrameHandler _ftol memmove ??3@YAXPAX@Z

user32

OpenInputDesktop GetThreadDesktop GetUserObjectInformationA SetThreadDesktop OpenDesktopA PostThreadMessageA GetInputState GetMessageA ExitWindowsEx wsprintfA CloseDesktop

advapi32

RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyA StartServiceCtrlDispatcherA CloseServiceHandle StartServiceA OpenServiceA UnlockServiceDatabase ChangeServiceConfig2A LockServiceDatabase CreateServiceA OpenSCManagerA

shell32

ShellExecuteA

ws2_32

connect htons gethostbyname socket closesocket ntohs recv select send gethostname getsockname WSAIoctl WSACleanup WSAStartup setsockopt

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle

.MPRESS1

SHA256 8f9153b3c8337b33699768357d2f18f6815b8430c6e466542c36ffc0043aec74
MD5 e760e08822c93c7feb11c82032a34a11
SHA1 711e4c6fca3ee5c9df1d9432a1ab274923bdba53
SHA512 6d1ae472bbd6f796300ece708613036e7fdda0e7121336092c6c6183f07918f0944e9576a0a4c080a5e3ac5fcbca046bd9fb81741afc4582e0d94a453de9134c
SSDEEP 768:glwJJRohvyCkxakpA6sgWVqPmYcnbPfsk9kLyl1azBK4jR2pEtpWX1X+v:gaJ8JyCzk5zLcbsDLUwKBup4X+v
TLSH
T155233A027AA5E862D591447112687B6B47BE4CB3058E5A67F3C07C1B3C7AA9BD01DF0F
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables built or packed with MPress PE compressor

.MPRESS2

SHA256 40138b9244ef8641c17e0eaf70a35830d4371c11ab20008c8061858338fa601d
MD5 23b82b7f806aa20b4b39de6adb296af6
SHA1 eda3e73180b053042eed06225cbd7dbef885c64a
SHA512 7cb42560a2a24929b4ee9a0d939949a138a56adbfd2ff6d15002b8cc4374bb59a12128f14a5aa36f87ffe8e7fa7f9163f7799f6f2e363d953543accce58820ed
TLSH
T16A81C3C2D2EE5688C97D943B112D780F6460A91E3000E6FA9BD4213BB442F399EBD396
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/1033/GROUP_ICON/103

SHA256 3b1176ee292fcf401e2cd56d5696a9c3eba5b68b12270d40dda9e363ed47045e
MD5 0bcf38b5ea9f4824a1e7b284f1e36994
SHA1 95903c98bd6b26b6db96ea14b97d0fc3ce379bba
SHA512 2068a34f77fa92694eabeaca903e107f2d7ecd5cef13dbd2415a9d408798fd313a12b6699a62fb014ae922876eb58f0a93fc783eb510c283f234db5faa84cb29
MD5 SHA1 SHA512

Detects executables built or packed with MPress PE compressor

.rsrc/1033/ICON/1.ico

SHA256 e64928613131e6f5ddae9f04a7cffc494e287fef6520309a9649aa35717adf38
MD5 0a0113f2183f67d361e07d3e3914541d
SHA1 63367a0a89f0fe33b8d9e3474e9ff09ea6586f44
SHA512 4f16cc153a2705f90c05eabe918dede70f68fccbf28636034cebdf62f640e9d988751451637b305a0e99b532a236fabe76d424c9a739bff5eeee25037b3e9e49
TLSH
T16E01C24A3015B52DC54917328CABAAB5ACFF1C21BD20451BF1E0BB5F6A722253643D3C
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/1033/MANIFEST/1

SHA256 e07d7fa88eac47bf707d9cabd85df18a4696a209750a5e6ad1401b0dc2db31bf
MD5 98e3e14528b61fe20c6bcac5aff75e8e
SHA1 a190daa7d40786b8a07e804c640f220502a887b2
SHA512 a9858c9a7e8120d540604e48a034df22ed50153456e827f6b2ce1479ff21f5d799a1ce2e4187182d6756bc4b93d2494620f2835a2d35bd989249ea7dcb1088d7
TLSH
T153111481C054E926E75202E33E75F55D15BE632B08CC46EDC8C2DA7EA74B7CA87521A2
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/2052/version.txt

SHA256 7b49519e48560c6347b6020f5409c8b23451b50b48e561706552f842b1d26348
MD5 63e8d814d646a5e590d8f156421b8bcf
SHA1 2d97566992a53175ab247be41478f513a1def74f
SHA512 fcd19b84477a534c48d38a9babf3867c96c15722eeb2a9f4a8310ded678da5863b9cd6d45cf02952af80e2e6fe22df4779a7a09e387cea1bed21d0cdff19c525
TLSH
T15721DF0696F72659B0B76A894FDACC3603577D00483DA26E99CC3E5E0FD34049921BF7
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

Sharing

General

Malware Config

Signatures

File Explorer