waski | 2026-11-13_ee95e1589d03093514796be681151a5e_elex_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-13_ee95e1589d03093514796be681151a5e_elex_wannacry
Size 27KB
Sample261113-yy2ansfs7m
SHA256 e51d316b2cbd0a182cceedef467090532fdbe3eb6acaaeb2f03b4393a8376fbc
MD5 ee95e1589d03093514796be681151a5e
SHA1 b03027d72d0366ab579ce19b7817fbefbaef1d92
SHA512 fc18df1ab97560b48b908edd2b982b26b8e769606c286a3a9cf5f92cbbf24dde607ee027ab381b0da1fdf30a23977a736fc5e0270714cd5de3789496af8c7f25
SSDEEP 192:qL5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qm/+jjGi+ehlPXe3PSHT:qtWckBeEd6ml1pcg743Gi+CW6H7s9Pje
TLSH
T190C251346FD51D73E3BBD7B285F7C1F6A970B0277A035A1E8046DB481823B12AD91A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

downloader waski

Malware Config

Signatures

Family: Waski
Waski is a trojan downloader written in C++.
downloader waski

Detects Waski payload 1 IoCs

resource	yara_rule
sample	family_waski

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-13_ee95e1589d03093514796be681151a5e_elex_wannacry

File Explorer

2026-11-13_ee95e1589d03093514796be681151a5e_elex_wannacry

.exe 27KB

2026-11-13_ee95e1589d03093514796be681151a5e_elex_wannacry

IMPHASH e888bacad07828bd73cc2b7f53a693e4
SHA256 e51d316b2cbd0a182cceedef467090532fdbe3eb6acaaeb2f03b4393a8376fbc
MD5 ee95e1589d03093514796be681151a5e
SHA1 b03027d72d0366ab579ce19b7817fbefbaef1d92
SHA512 fc18df1ab97560b48b908edd2b982b26b8e769606c286a3a9cf5f92cbbf24dde607ee027ab381b0da1fdf30a23977a736fc5e0270714cd5de3789496af8c7f25
SSDEEP 192:qL5WckBezHYQRPK6k7TjHwCl1oynzc2Fjmf2mrETLLC0qm/+jjGi+ehlPXe3PSHT:qtWckBeEd6ml1pcg743Gi+CW6H7s9Pje
TLSH
T190C251346FD51D73E3BBD7B285F7C1F6A970B0277A035A1E8046DB481823B12AD91A8D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Waski payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.poly

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pf199

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.code2

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.gp4663

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.init

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xdata2

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.gp1519

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text3

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.gp4131

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tx1454

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

2026-11-13_ee95e1589d03093514796be681151a5e_elex_wannacry

user32

kernel32

gdi32

msvcrt

generic