Hostile ^92% Download

2026-09-26_9834d83ff1d2e6316c3c9ebf150ffc5f_elex_wannacry

Wannacry ransomware indicators

Binary contains XOR-encoded critical API tableObfuscated module scan resolves PE exports

SHA-256eaec7abaf8d8b6ed4a93f14a1cce283a36926a0abbbc88ffe041aa0cc4681b0b

URLhttps://tria.ge/api/v0/samples/260926-wrvs7syepf/sample

MaleculeO₂(As₃C)H₈(F₅CmCrDsMgOs₃PoU)Md₂(Bi₅Si)

Evidence

x86 reads PE export names and count 0x3d0–0x650

⋯15 more rows
0x4c0000003c1b91800000003c14181c1f000...........A....
0x4d00000c38b70608b45fc83c02003f08b3e....p`.E... ...>
0x4e083ee0c8b06037dfc8945f483ee1433d2......}..E....3.
⋯23 more rows

x86 module backscan with adjusted MZ comparison 0x875–0x9f5

⋯3 more rows
0x8a57c304000a1b841400050ff1580304000|[email protected]@.P...0@.
0x8b58b35683040005757578d55e452ffd685[email protected]...
0x8c5c074288b3d6c304000538b1d70304000.t([email protected]@.
⋯4 more rows
0x915c0085745ff502183526868558bec83ec..WE.P!.RhhU....
0x925108b15473140008b4508e866fbffff2b[email protected]...+
0x935c28b08fec980f94c75f5fec580fd5b75.......Lu.....[u
0x945ee53e86afbffff415657416639087556.S.j...AVWAf9.uV
⋯11 more rows

XOR-decoded WinINet HTTP APIs 0xa37–0xd27

⋯5 more rows
0xa87a107000057ff3510304000e889feffff....W.5.0@......
0xa97b940000000bac916400068bc41400051.@[email protected]@.Q
0xaa7682f07000052ffd0b814000000bec811h/...R..........
0xab74000bfc9164000b92e070000e8640700@[email protected]..
0xac700907a0f0bef3009aae22437950667a8..z...0...$7..g.
0xad7ff38f14f3815f07d6a9d4913296648aa.8.O8..}j.I.)fH.
0xae76b7508cbf233f459110fe10f0a9a4337ku...3.Y......C7
0xaf75b121ff05f6b0ba8c424e0591d12e669[..._k...$.Y...i
⋯11 more rows
0xbb71a18fe6a4aef783748516cb2576804a8...jJ.x7HQl.Wh..
0xbc7f62ff95f240efd6c6e9c4352285644b0./._$..ln.CR(VD.
0xbd7526902dc9d33fc477435fc7b6e9d5e37Ri...3.Gt5.{n.^7
0xbe75d6e5dbb555067e1dd23f5591a19e64c]n].UPg..#.Y...L
0xbf764815e374a557ade737313d8fc27f545d.^7JUz.ss...'.E
0xc072619e37a6e9c4405296843aa5e7509cd&..zn.D.)hC.^u..
0xc17c706e54e0605dd7f7f865f3c7e2164b0...N......_<~!d.
0xc274f6215c6d623c34e0033e27b62805e05Ob...#.N.3.{b.^.
0xc37296959aa4b5402c6d705f55a0119e17b)iY.KT.....Z...{
0xc475cef78265d517cab5e751ee1dd31ff7c\.x&]Q|.^u...1.|
0xc577435fc7b6e9d5e375d7348bf5f410ec4t5.{n.^7]sH._A..
0xc67d65791581c19fe6338dd1e36454d2d8d.W.X...c8..6EM-.
0xc7753620bc4f62ff5480108f7580bed65d9Sb.../.H...X..e.
0xc87c5a2e92eb25a93fb4c229cd421741b4a.....Z..L"..!t.J
⋯10 more rows

x86 helper loop rewinds repeating XOR key 0x1107–0x12f7

⋯5 more rows
0x11570418f37b6e9c1036465643b2546603cd...{n..6FVC.Tf..
0x1167c157e44e0c08bd250b8e402245484ebf.W.N...%..@"EHN.
0x11774f6e08c69c7d905b151ff96e6c865e35On...}.[...nl.^5
0x1187044d4cbc5e6b0bc1dd30be481b119220.ML.^k...0.H... 
⋯8 more rows
0x12178b8b29405215830083200b2150304015..)@R.... .!P0@.
0x12278b0632c1c38bd8575353e86df2ffff85..2....WSS.m....
0x1237c074074975f45b5b5fc35b2bf353ebf3.t.Iu.[[_.[+.S..
0x124790297515070b830b8be800de520b4575.)u.........R.Eu
⋯11 more rows

Random-named executable in root directory 0x31c0–0x3470

⋯3 more rows
0x31f000000000000000000000000000000000................
0x320043003a005c0055007300650072007300C.:.\.U.s.e.r.s.
0x32105c0054006f0073006800690062006100\.T.o.s.h.i.b.a.
0x32205c004100700070004400610074006100\.A.p.p.D.a.t.a.
0x32305c004c006f00630061006c005c005400\.L.o.c.a.l.\.T.
0x324065006d0070005c00540065006d007000e.m.p.\.T.e.m.p.
0x325031005f0056006f006900630065004d001._.V.o.i.c.e.M.
0x3260610069006c002e007a00690070005c00a.i.l...z.i.p.\.
0x327056006f006900630065004d0061006900V.o.i.c.e.M.a.i.
0x32806c002e00650078006500000043003a00l...e.x.e...C.:.
0x32905c003300650030007200490032003800\.3.e.0.r.I.2.8.
0x32a036002e00650078006500000043003a006...e.x.e...C.:.
0x32b05c0055007a00300058004d0043006d00\.U.z.0.X.M.C.m.
0x32c04c002e00650078006500000043003a00L...e.x.e...C.:.
0x32d05c006e004d0053006f00700033003500\.n.M.S.o.p.3.5.
0x32e074002e00650078006500000043003a00t...e.x.e...C.:.
0x32f05c00480073006d006200580039005600\.H.s.m.b.X.9.V.
0x330066002e00650078006500000043003a00f...e.x.e...C.:.
0x33105c00580054006d004800330032006d00\.X.T.m.H.3.2.m.
0x33204e002e00650078006500000043003a00N...e.x.e...C.:.
0x33305c0043003300490048006e0031003700\.C.3.I.H.n.1.7.
0x334031002e00650078006500000043003a001...e.x.e...C.:.
0x33505c00760061006b003200370052004200\.v.a.k.2.7.R.B.
0x336079002e00650078006500000043003a00y...e.x.e...C.:.
0x33705c006100630068005f006d0031007000\.a.c.h._.m.1.p.
0x338051002e00650078006500000043003a00Q...e.x.e...C.:.
0x33905c0045004a00780052005f004d007a00\.E.J.x.R._.M.z.
0x33a031002e00650078006500000043003a001...e.x.e...C.:.
0x33b05c005500480076006600470046005400\.U.H.v.f.G.F.T.
0x33c07a002e00650078006500000043003a00z...e.x.e...C.:.
0x33d05c00610056004d007300440075004400\.a.V.M.s.D.u.D.
0x33e032002e00650078006500000043003a002...e.x.e...C.:.
0x33f05c003000580042004400330036006900\.0.X.B.D.3.6.i.
0x34004b002e00650078006500000043003a00K...e.x.e...C.:.
0x34105c00760069007200750073002e006500\.v.i.r.u.s...e.
0x342078006500000043003a005c0065006400x.e...C.:.\.e.d.
0x343064006600620063006100310064003000d.f.b.c.a.1.d.0.
0x3440320037003300650034006300340032002.7.3.e.4.c.4.2.
0x3450310037003500630064006100350063001.7.5.c.d.a.5.c.
0x3460310035006100370038006100330037001.5.a.7.8.a.3.7.
0x3470300066003500390033006300340064000.f.5.9.3.c.4.d.