2026-11-10_a42551bd480a6bb7d3b897f03eb9183e_elex_strictor_wannacry

General

Target
2026-11-10_a42551bd480a6bb7d3b897f03eb9183e_elex_strictor_wannacry
Size 1.4MB
Sample261110-grf8gsty8k
SHA256 43295a5c7c27f62bb4c5c24977ba1bbad5f967bf56aab19dbaee34747623eee0
MD5 a42551bd480a6bb7d3b897f03eb9183e
SHA1 883f9a3b57836d0abecdd5e016ad465f8a81f188
SHA512 059f899fe486fb6c967455a63040000c6449a6488931b6f8171587e06bad49b6a3a6c84f42dd9f3c351ed1272da94631532268641a24798c28ad6b007cc38873
SSDEEP 24576:pSVpFsuYj+kbzR2pZ499xyeQ6uzPPMQ5OsHMNYpPazStXoG35zzer:SFZYeiLxPQ6u4sOEvazaoGle
TLSH
T1AC652206F7E08CAAE0668534066B87952D7ABC718A708F0B56C4791F9E72787FCE0357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
sample	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
sample	MailPassView

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_a42551bd480a6bb7d3b897f03eb9183e_elex_strictor_wannacry

File Explorer

2026-11-10_a42551bd480a6bb7d3b897f03eb9183e_elex_strictor_wannacry

.exe 1.4MB

2026-11-10_a42551bd480a6bb7d3b897f03eb9183e_elex_strictor_wannacry

IMPHASH a38b1c78d52d9269e7862344e885a7c0
SHA256 43295a5c7c27f62bb4c5c24977ba1bbad5f967bf56aab19dbaee34747623eee0
MD5 a42551bd480a6bb7d3b897f03eb9183e
SHA1 883f9a3b57836d0abecdd5e016ad465f8a81f188
SHA512 059f899fe486fb6c967455a63040000c6449a6488931b6f8171587e06bad49b6a3a6c84f42dd9f3c351ed1272da94631532268641a24798c28ad6b007cc38873
SSDEEP 24576:pSVpFsuYj+kbzR2pZ499xyeQ6uzPPMQ5OsHMNYpPazStXoG35zzer:SFZYeiLxPQ6u4sOEvazaoGle
TLSH
T1AC652206F7E08CAAE0668534066B87952D7ABC718A708F0B56C4791F9E72787FCE0357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
NirSoft MailPassView

Password recovery tool for various email clients
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaFreeVar __vbaAryMove __vbaLenBstr __vbaStrVarMove __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord621 __vbaFreeObjList __vbaGetFxStr4 ord516 _adj_fprem1 __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 ord666 __vbaAryVar __vbaAryDestruct __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaBoolVarNull _CIsin __vbaChkstk ord526 __vbaFileClose __vbaGenerateBoundsError ord529 __vbaStrCmp __vbaVarTstEq __vbaPutOwner3 __vbaObjVar DllFunctionCall ord670 _adj_fpatan __vbaFixstrConstruct __vbaRedim ord600 _CIsqrt __vbaExceptHandler ord711 __vbaStrToUnicode ord712 __vbaPrintFile _adj_fprem _adj_fdivr_m64 __vbaI2Str ord608 ord530 ord716 __vbaFPException __vbaUbound ord533 __vbaStrVarVal __vbaVarCat __vbaLsetFixstrFree __vbaI2Var _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr ord648 __vbaVar2Vec __vbaNew2 ord570 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaVarNot __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaVarCmpEq ord610 __vbaStrToAnsi __vbaVarDup ord612 ord616 __vbaFpI4 __vbaVarCopy __vbaLateMemCallLd _CIatan __vbaStrMove __vbaAryCopy ord619 _allmul _CItan _CIexp __vbaFreeObj __vbaFreeStr

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-10_a42551bd480a6bb7d3b897f03eb9183e_elex_strictor_wannacry

msvbvm60

generic