2026-10-10_b68a8feccd34bd467b6062744bb20727_elex_wannacry

resource	yara_rule
sample	INDICATOR_EXE_Packed_MPress

resource
2026-10-10_b68a8feccd34bd467b6062744bb20727_elex_wannacry

IMPHASH e602ae382884293b806fc7d0182b13c4
SHA256 cc692180aa1456fd8b1c41ffcbed9e3183f2b8e7150f4d9542b7b0d97ef5555b
MD5 b68a8feccd34bd467b6062744bb20727
SHA1 7ece97b9ba94af6c9371a7b14bc320a7e683dc89
SHA512 8c9f430fbd32219a8e8c9087b8eb327d6bc5c99743d860dfe792670446104a4ff4f8c8bd122cf4fc86efe7bb5b607f5aafa596cf6a6029db1df4da29cfe8331b
SSDEEP 1536:AvDaJ8JyCzk5zLcbsDLUwKhup4X+v3tx:EmJnzgbs33Khup4uv3tx
TLSH
T1EBC36C0376A8E8A2D4A204311264BB7B4BBA5C73054E5A67E7C07C1B3C7AA5BD11DF1F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables built or packed with MPress PE compressor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

VirtualProtect GetStartupInfoA GetModuleHandleA CreateToolhelp32Snapshot Process32First Process32Next lstrcmpiA CopyFileA GetCurrentThreadId ExpandEnvironmentStringsA InitializeCriticalSection DeleteCriticalSection VirtualFree LeaveCriticalSection Sleep EnterCriticalSection VirtualAlloc CreateEventA CloseHandle WaitForSingleObject ResetEvent lstrcpyA SetEvent InterlockedExchange CancelIo WriteFile SetFilePointer CreateFileA GetFileSize ReadFile GetWindowsDirectoryA GetFileAttributesA CreateProcessA lstrlenA TerminateThread lstrcatA GetTickCount GetLastError GetCurrentProcess HeapAlloc GetProcessHeap VirtualProtect GetProcAddress LoadLibraryA IsBadReadPtr HeapFree FreeLibrary GetDiskFreeSpaceExA GetDriveTypeA GlobalMemoryStatusEx GetSystemInfo GetVersionExA WinExec GetModuleFileNameA DeleteFileA DuplicateHandle OpenProcess CreateDirectoryA GetLocalTime OpenEventA ExitProcess

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit _beginthreadex _access sprintf _except_handler3 free realloc malloc memcmp ??2@YAPAXI@Z memset __CxxFrameHandler _ftol memmove ??3@YAXPAX@Z

user32

OpenInputDesktop GetThreadDesktop GetUserObjectInformationA SetThreadDesktop OpenDesktopA PostThreadMessageA GetInputState GetMessageA ExitWindowsEx wsprintfA CloseDesktop

advapi32

RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyA StartServiceCtrlDispatcherA CloseServiceHandle StartServiceA OpenServiceA UnlockServiceDatabase ChangeServiceConfig2A LockServiceDatabase CreateServiceA OpenSCManagerA

shell32

ShellExecuteA

ws2_32

connect htons gethostbyname socket closesocket ntohs recv select send gethostname getsockname WSAIoctl WSACleanup WSAStartup setsockopt

wininet

InternetOpenA InternetOpenUrlA InternetCloseHandle

.MPRESS1

SHA256 0d88ba8fee0039629223f986944733efa48e8f41a876fb3fc230cb30251853da
MD5 2ffdeab3162e548c5d2beba38261b314
SHA1 5e0bd805a6e863ccd95936ac2980c0d3625dd45c
SHA512 b720b262f621a046977cca36ed7557d4bd4afebdbd548a6869b47ff751fd6fd130adc12544f21f76eefe2f15ef459a462bb17ba6eefa413c5a489a022d5d4505
SSDEEP 768:glwJJRohvyCkxakpA6sgWVqPmYcnbPfsk9kLyl1azBK4jR2pEtpWX1X+v:gaJ8JyCzk5zLcbsDLUwKhup4X+v
TLSH
T124234A023AA5E862D591447112687B6B47BE4CB3058E5A67F3C07C1B3C7AA9BD01DF0F
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables built or packed with MPress PE compressor

.MPRESS2

SHA256 40138b9244ef8641c17e0eaf70a35830d4371c11ab20008c8061858338fa601d
MD5 23b82b7f806aa20b4b39de6adb296af6
SHA1 eda3e73180b053042eed06225cbd7dbef885c64a
SHA512 7cb42560a2a24929b4ee9a0d939949a138a56adbfd2ff6d15002b8cc4374bb59a12128f14a5aa36f87ffe8e7fa7f9163f7799f6f2e363d953543accce58820ed
TLSH
T16A81C3C2D2EE5688C97D943B112D780F6460A91E3000E6FA9BD4213BB442F399EBD396
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/1033/GROUP_ICON/103

SHA256 3b1176ee292fcf401e2cd56d5696a9c3eba5b68b12270d40dda9e363ed47045e
MD5 0bcf38b5ea9f4824a1e7b284f1e36994
SHA1 95903c98bd6b26b6db96ea14b97d0fc3ce379bba
SHA512 2068a34f77fa92694eabeaca903e107f2d7ecd5cef13dbd2415a9d408798fd313a12b6699a62fb014ae922876eb58f0a93fc783eb510c283f234db5faa84cb29
MD5 SHA1 SHA512

Detects executables built or packed with MPress PE compressor

.rsrc/1033/ICON/1.ico

SHA256 e64928613131e6f5ddae9f04a7cffc494e287fef6520309a9649aa35717adf38
MD5 0a0113f2183f67d361e07d3e3914541d
SHA1 63367a0a89f0fe33b8d9e3474e9ff09ea6586f44
SHA512 4f16cc153a2705f90c05eabe918dede70f68fccbf28636034cebdf62f640e9d988751451637b305a0e99b532a236fabe76d424c9a739bff5eeee25037b3e9e49
TLSH
T16E01C24A3015B52DC54917328CABAAB5ACFF1C21BD20451BF1E0BB5F6A722253643D3C
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/1033/MANIFEST/1

SHA256 e07d7fa88eac47bf707d9cabd85df18a4696a209750a5e6ad1401b0dc2db31bf
MD5 98e3e14528b61fe20c6bcac5aff75e8e
SHA1 a190daa7d40786b8a07e804c640f220502a887b2
SHA512 a9858c9a7e8120d540604e48a034df22ed50153456e827f6b2ce1479ff21f5d799a1ce2e4187182d6756bc4b93d2494620f2835a2d35bd989249ea7dcb1088d7
TLSH
T153111481C054E926E75202E33E75F55D15BE632B08CC46EDC8C2DA7EA74B7CA87521A2
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/2052/version.txt

SHA256 7b49519e48560c6347b6020f5409c8b23451b50b48e561706552f842b1d26348
MD5 63e8d814d646a5e590d8f156421b8bcf
SHA1 2d97566992a53175ab247be41478f513a1def74f
SHA512 fcd19b84477a534c48d38a9babf3867c96c15722eeb2a9f4a8310ded678da5863b9cd6d45cf02952af80e2e6fe22df4779a7a09e387cea1bed21d0cdff19c525
TLSH
T15721DF0696F72659B0B76A894FDACC3603577D00483DA26E99CC3E5E0FD34049921BF7
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

Sharing

General

Malware Config

Signatures

File Explorer