Hostile ^92% _unknown Download

2026-02-09_edc12ec0b127b7b422ca4ec20ddf7a54_elex_wannacry

Wannacry ransomware indicators

Binary contains XOR-encoded critical API tableObfuscated module scan resolves PE exports

SHA-256adaeec71ca4ef7e8315b7f74d8dbfcf5655f4cafc28939c354396e64630f076f

MaleculeO₂(As₃C)H₈(F₅CmCrDsMgOs₃PoU)Md₂(Bi₅Si)

Evidence

x86 reads PE export names and count 0x3d0–0x650

⋯12 more rows
0x4908945fc81e1ffff000003c1b918000000.E..............
0x4a003c14181c1f0000000c38b70608b45fc..A........p`.E.
0x4b083c02003f08b3e83ee0c8b06037dfc89.. ...>......}..
⋯26 more rows

XOR-decoded WinINet HTTP APIs 0x825–0xb15

⋯3 more rows
0x8557c304000a1c841400050ff1580304000|[email protected]@.P...0@.
0x8658b35683040005757578d55e452ffd685[email protected]...
0x875c074288b3d6c304000538b1d70304000.t([email protected]@.
⋯9 more rows
0x915ff40c315558bec83ec108b15f3304000[email protected]@.
0x9258b4508e844fbffff2bc28b08fec980f9.E..D...+.......
0x9354c75f5fec580fd5b75ee53e848fbffffLu.....[u.S.H...
⋯13 more rows
0xa150a414000e8a107000057ff3510304000[email protected]@.
0xa25e8effeffffb940000000ba5c16400068......@....\[email protected]
0xa35cc41400051684307000052ffd0b81400[email protected].....
0xa450000beae114000bf5c164000b9420700.....@..\[email protected]..
0xa5500e86407000090bab050385a9412187e..d......P8Z...~
0xa65431da0e84d52f6f182ae8230c2314a23C...MR.....0.1J#
0xa758e919c12dee3d3872e5ffdf494879821........._.....!
0xa85b0514d29aae3e84584d7cd844d69eae0.QM)...E....Mi..
⋯9 more rows

x86 helper loop rewinds repeating XOR key 0x1099–0x1289

⋯5 more rows
0x10e996868a26d523183ea0e6b51bc5d2c58d...&.#.>........
0x10f93f1eedf59e96c478b031482aa3f8b816?......x.1H*....
0x1109dedace86623499f19396843fdf24512c....b4.....?.$Q,
0x1119aabcaf12c9dbcf872171fee9c881843f........!q.....?
⋯8 more rows
0x11a930387507c4c4894591e89107ccc391c408u....E........
0x11b9758b0632c1c38bd8575353e8b1f2ffffu..2....WSS.....
0x11c985c074074975f45b5b5fc35b2bf353eb..t.Iu.[[_.[+.S.
0x11d9f3904dc40707aaaac407cc3091ffc338..M........0...8
⋯11 more rows

Get module handle ANSI 0x2fcc–0x30ec

⋯3 more rows
0x2ffc0000000000000150bd00680032000e00.......P..h.2...
0x300c01000000ffff80004f004b0000000000........O.K.....
0x301c00000000000000000000000000000000................
0x302c00000000000000000000000000000000................
0x303c00000000000000000000000000000000................
0x304c00000000000000000000000000000000................
0x305c00000000000000000000000000000000................
0x306c00000000000000000000000000000000................
0x307c00000000000000000000000000000000................
⋯7 more rows

Startup-folder executable path reference 0x4628–0x4768

0x4628320064003200660034003600350036002.d.2.f.4.6.5.6.
0x4638360036003800340039006300360032006.6.8.4.9.c.6.2.
0x4648310034006200370034006600380066001.4.b.7.4.f.8.f.
0x465830003500650064003800000043003a000.5.e.d.8...C.:.
0x46685c0044006f00630075006d0065006e00\.D.o.c.u.m.e.n.
0x467874007300200061006e00640020005300t.s. .a.n.d. .S.
0x468865007400740069006e00670073005c00e.t.t.i.n.g.s.\.
0x469841006c006c0020005500730065007200A.l.l. .U.s.e.r.
0x46a873005c00530074006100720074002000s.\.S.t.a.r.t. .
0x46b84d0065006e0075005c00500072006f00M.e.n.u.\.P.r.o.
0x46c86700720061006d0073005c0053007400g.r.a.m.s.\.S.t.
0x46d8610072007400750070005c0074003700a.r.t.u.p.\.t.7.
0x46e84b006100770034007400700043002e00K.a.w.4.t.p.C...
0x46f8650078006500000043003a005c004700e.x.e...C.:.\.G.
0x470833004b0032005f004600730035002e003.K.2._.F.s.5...
0x4718650078006500000043003a005c003300e.x.e...C.:.\.3.
0x4728350034003200390064003900340064005.4.2.9.d.9.4.d.
0x473861006400650036003400350065006300a.d.e.6.4.5.e.c.
0x474863003200370036006400360032003800c.2.7.6.d.6.2.8.
0x4758300033003000650031003700310033000.3.0.e.1.7.1.3.
0x4768630063003600310064              c.c.6.1.d       