2026-10-10_b90a6566f84cca9d9b07f805271ce655_elex_wannacry

resource	yara_rule
sample	INDICATOR_EXE_Packed_MPress

resource
2026-10-10_b90a6566f84cca9d9b07f805271ce655_elex_wannacry

SHA256 389798f22dca6d24ea3ba1805ed2669aa2373c9ec27cfdc3b67d36568272a194
MD5 b90a6566f84cca9d9b07f805271ce655
SHA1 f5edb1d2af7058823fa71f73473990117b9f7c82
SHA512 4051e2f669a7a49f4795994d581622d716e8b3f12d1c91cc3ddb368addf57495fa4b319ba1538177520768bc83ea29bd5bcf10cfa83f71f3f0ffeaa0052c63fd
SSDEEP 768:+lwJJRohvyCkxakpA6sgWVqPmYcnbPfsk9kLyl1azBK4jRJcYkjqEtpWX1X+vf7o:+aJ8JyCzk5zLcbsDLUwKlpp4X+vjW
TLSH
T18C336D0266E9EC62D0A204311664BB6B4BBB5C76044E8677E7C07D1B3CBAA5BD01DF1F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables built or packed with MPress PE compressor
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

.MPRESS1

SHA256 7e1e38fd93611c4437cd74881d9a5e3d331e2c70360e9b62e414c609b0ed6b73
MD5 970af3c78e4cc0048c70af770119adfe
SHA1 6b18062c82b8b03a4d9cb035058abd947b1cc7c0
SHA512 ad88fa9a48cf26f04db8b7673087d0eae88c9227f511e2ca62de245c21349d31e75dbd4be509ba9faee30b66c7809addf1b256f058f3e9cab82cccf0fb5d4135
SSDEEP 768:glwJJRohvyCkxakpA6sgWVqPmYcnbPfsk9kLyl1azBK4jRJcYkjqEtpWX1X+v:gaJ8JyCzk5zLcbsDLUwKlpp4X+v
TLSH
T127134B066AA5F862C4A144711268BB6B4BBF4C73058E5967E3C07D1B3CBA99BD01DF0F
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables built or packed with MPress PE compressor

.MPRESS2

SHA256 0b5229e37c26d4e14dfe08767197b30f2d58dfc8d7dbd06fa92e11a24e60b123
MD5 4d1bedaabd80c576aafa1e535d23e6ee
SHA1 48d5a25ca7017014c1ce444e2e34fb7f41062738
SHA512 77506764f53bb601a225056f2c817d4eee11627c19f5aa7690866fe60a32e204bc234e1ae445d0658f7fbed89a43611435809afd7507d23d5248c4f39f7610b8
TLSH
T1A671E5C6C1EE5784C97D543B042E781F6860A91E3000D6FA9BC4213BB402F359E7D396
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.imports

SHA256 2e31919792a674200d47cb74f75676260a21c0c5855999d3ee0080f3707e277b
MD5 cc6495c2a91b6528b2b94c48b2ff4db5
SHA1 c68482ef8b513349e2f3fbe7ec64fb40c300dc8b
SHA512 3e55b83c3a31254962fb28344b8cb783397aa74f2eb026ea06734b1a6b01c7390d2b1695cf0ada0c791cf637290c33cad44074a028fb89f9116a87e8236276ba
TLSH
T1C25171C76BEC1CD4E08E273D1982DAA38CA1FA64467DA83404C0D19F09DE55A562C327
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/1033/GROUP_ICON/103

SHA256 3b1176ee292fcf401e2cd56d5696a9c3eba5b68b12270d40dda9e363ed47045e
MD5 0bcf38b5ea9f4824a1e7b284f1e36994
SHA1 95903c98bd6b26b6db96ea14b97d0fc3ce379bba
SHA512 2068a34f77fa92694eabeaca903e107f2d7ecd5cef13dbd2415a9d408798fd313a12b6699a62fb014ae922876eb58f0a93fc783eb510c283f234db5faa84cb29
MD5 SHA1 SHA512

Detects executables built or packed with MPress PE compressor

.rsrc/1033/ICON/1.ico

SHA256 e64928613131e6f5ddae9f04a7cffc494e287fef6520309a9649aa35717adf38
MD5 0a0113f2183f67d361e07d3e3914541d
SHA1 63367a0a89f0fe33b8d9e3474e9ff09ea6586f44
SHA512 4f16cc153a2705f90c05eabe918dede70f68fccbf28636034cebdf62f640e9d988751451637b305a0e99b532a236fabe76d424c9a739bff5eeee25037b3e9e49
TLSH
T16E01C24A3015B52DC54917328CABAAB5ACFF1C21BD20451BF1E0BB5F6A722253643D3C
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/1033/MANIFEST/1

SHA256 e07d7fa88eac47bf707d9cabd85df18a4696a209750a5e6ad1401b0dc2db31bf
MD5 98e3e14528b61fe20c6bcac5aff75e8e
SHA1 a190daa7d40786b8a07e804c640f220502a887b2
SHA512 a9858c9a7e8120d540604e48a034df22ed50153456e827f6b2ce1479ff21f5d799a1ce2e4187182d6756bc4b93d2494620f2835a2d35bd989249ea7dcb1088d7
TLSH
T153111481C054E926E75202E33E75F55D15BE632B08CC46EDC8C2DA7EA74B7CA87521A2
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

.rsrc/2052/version.txt

SHA256 7b49519e48560c6347b6020f5409c8b23451b50b48e561706552f842b1d26348
MD5 63e8d814d646a5e590d8f156421b8bcf
SHA1 2d97566992a53175ab247be41478f513a1def74f
SHA512 fcd19b84477a534c48d38a9babf3867c96c15722eeb2a9f4a8310ded678da5863b9cd6d45cf02952af80e2e6fe22df4779a7a09e387cea1bed21d0cdff19c525
TLSH
T15721DF0696F72659B0B76A894FDACC3603577D00483DA26E99CC3E5E0FD34049921BF7
MD5 SHA1 SHA512 TLSH

Detects executables built or packed with MPress PE compressor

Sharing

General

Malware Config

Signatures

File Explorer