2026-10-22_fc6b84ff7c1e1d4a7d90243f9b162e08_amadey_elex_smoke-loader_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_fc6b84ff7c1e1d4a7d90243f9b162e08_amadey_elex_smoke-loader_wannacry
Size 798KB
Sample261023-arssysbh97
SHA256 1fa1965a94c48c1c9425d8d1f5b3af48b36563daef18e7208a5d06cdf137f0fc
MD5 fc6b84ff7c1e1d4a7d90243f9b162e08
SHA1 7036e2bc18e888745f6d9e1cb7819e7df3da11f4
SHA512 a85fe6e293515e37c81091beb860f3eec9b4df8e73c99be365d6c45a5ef8cc23acca2b7fefc6cc827b0e22b87e49251309ea6f6206e4c6e27151fffb9979b93d
SSDEEP 12288:h6RUB+J6ca5pz8fTzQk9kT+Vz5fW5OXG4kbKbtLpm1Ew:h1kaaP9kT85u2GNKbtLpwb
TLSH
T130051825BBF844B6F0B3D5BE9AB69719D67278115B20C7CB13114A6E4E33AC48D39332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_fc6b84ff7c1e1d4a7d90243f9b162e08_amadey_elex_smoke-loader_wannacry

File Explorer

2026-10-22_fc6b84ff7c1e1d4a7d90243f9b162e08_amadey_elex_smoke-loader_wannacry

.exe 798KB

2026-10-22_fc6b84ff7c1e1d4a7d90243f9b162e08_amadey_elex_smoke-loader_wannacry

IMPHASH 61c2c81b6359458a4e8e1d9381b64a30
SHA256 1fa1965a94c48c1c9425d8d1f5b3af48b36563daef18e7208a5d06cdf137f0fc
MD5 fc6b84ff7c1e1d4a7d90243f9b162e08
SHA1 7036e2bc18e888745f6d9e1cb7819e7df3da11f4
SHA512 a85fe6e293515e37c81091beb860f3eec9b4df8e73c99be365d6c45a5ef8cc23acca2b7fefc6cc827b0e22b87e49251309ea6f6206e4c6e27151fffb9979b93d
SSDEEP 12288:h6RUB+J6ca5pz8fTzQk9kT+Vz5fW5OXG4kbKbtLpm1Ew:h1kaaP9kT85u2GNKbtLpwb
TLSH
T130051825BBF844B6F0B3D5BE9AB69719D67278115B20C7CB13114A6E4E33AC48D39332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

106019

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

WFServicesReg.pdb

advapi32

CheckTokenMembership AllocateAndInitializeSid FreeSid

kernel32

SizeofResource LockResource LoadResource FindResourceW FindResourceExW VerifyVersionInfoW VerSetConditionMask lstrlenW GetConsoleWindow WideCharToMultiByte HeapSetInformation RaiseException GetLastError ExpandEnvironmentStringsW CloseHandle WaitForSingleObject CreateProcessW GetEnvironmentVariableW GetFileAttributesW CopyFileW GetTempFileNameW GetTempPathW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetVersionExA InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetOEMCP LCMapStringA MultiByteToWideChar LCMapStringW VirtualAlloc Sleep LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers CreateFileA

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

VarBstrCat VarBstrCmp GetErrorInfo SysFreeString VariantClear VariantCopy SysAllocString SysAllocStringByteLen SysStringByteLen SysStringLen SysAllocStringLen VariantInit

user32

UnregisterClassA ShowWindow

shell32

SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_fc6b84ff7c1e1d4a7d90243f9b162e08_amadey_elex_smoke-loader_wannacry

advapi32

kernel32

ole32

oleaut32

user32

shell32

generic