2026-06-01_b411283cd59f101940d1514b40d36515_elex_emotet_floxif_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-01_b411283cd59f101940d1514b40d36515_elex_emotet_floxif_stop
Size 1.3MB
Sample260601-pfsfdads4m
SHA256 bb6f837052c87c0a7ea831a3f6db68929a569c10176576198ec274066f668947
MD5 b411283cd59f101940d1514b40d36515
SHA1 e68e234b790677fd230b35679afdef3f800ca618
SHA512 e4b9ac62d319b12e391a3e9c02e8e47149255f40204a86c8db506845e63207052ea29f63f0b1d2efacd28ee600b9548e8e2534f915023ba38a863f3aff4521d2
SSDEEP 12288:InLmULJbMAlpo7nqVwQuvPr1wrAHdYiUSFKdYikoKrUIMBjvrEH7V:SHPtunRQfImrEH7V
TLSH
T1D3554C4A686E4D34FB62E2374488243314DA6D39A11018D6E79FB6A0C5BFF319119FBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-01_b411283cd59f101940d1514b40d36515_elex_emotet_floxif_stop

File Explorer

2026-06-01_b411283cd59f101940d1514b40d36515_elex_emotet_floxif_stop

.exe 1.3MB

2026-06-01_b411283cd59f101940d1514b40d36515_elex_emotet_floxif_stop

IMPHASH 6045ea30056bfbd69ab2c119e34e1ef2
SHA256 bb6f837052c87c0a7ea831a3f6db68929a569c10176576198ec274066f668947
MD5 b411283cd59f101940d1514b40d36515
SHA1 e68e234b790677fd230b35679afdef3f800ca618
SHA512 e4b9ac62d319b12e391a3e9c02e8e47149255f40204a86c8db506845e63207052ea29f63f0b1d2efacd28ee600b9548e8e2534f915023ba38a863f3aff4521d2
SSDEEP 12288:InLmULJbMAlpo7nqVwQuvPr1wrAHdYiUSFKdYikoKrUIMBjvrEH7V:SHPtunRQfImrEH7V
TLSH
T1D3554C4A686E4D34FB62E2374488243314DA6D39A11018D6E79FB6A0C5BFF319119FBF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1a:be:7d:34:a5:5b:ab:55:ad:a1:7a:3e:b1:9f:9e:14:b9:05:2a:43

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Chains

Jun 18, 2013

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Serial Number

29:66:2a:74:5c:40:15:70:38:f2:78:9d:69:05:e9:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 21, 2012 - Aug 23, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

87048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\docuworks800\jp\source\setup\release\Setup32.pdb

kernel32

GetCPInfo GetOEMCP SetErrorMode HeapFree VirtualAlloc HeapReAlloc HeapAlloc GetCommandLineA GetProcessHeap GetStartupInfoA RtlUnwind ExitProcess RaiseException HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP IsValidCodePage LCMapStringW HeapDestroy HeapCreate VirtualFree GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers ReadFile GetThreadLocale InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc WritePrivateProfileStringA GlobalFlags EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection InterlockedDecrement GetModuleFileNameW FreeResource GlobalGetAtomNameA GlobalFindAtomA lstrcmpW GetCurrentProcessId GlobalAddAtomA SetLastError GlobalFree GlobalUnlock FormatMessageA LocalFree MulDiv GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA LoadLibraryA GlobalLock lstrcmpA GlobalAlloc FreeLibrary GetVersion InterlockedExchange CompareStringA MultiByteToWideChar Sleep GetTickCount GetModuleFileNameA GetSystemDirectoryA GetLocalTime GetTempPathA GetPrivateProfileStringA CloseHandle WriteFile SetFilePointer CreateFileA CreateDirectoryA FindResourceA ExpandEnvironmentStringsA LoadResource GetFileAttributesA LockResource FindClose SizeofResource FindFirstFileA GetCurrentProcess WideCharToMultiByte GetModuleHandleA GetProcAddress lstrcmpiA GetLastError CreateMutexA lstrlenA GetExitCodeProcess WaitForSingleObject LCMapStringA GetVersionExA

user32

EndPaint BeginPaint GrayStringA DrawTextExA DrawTextA TabbedTextOutA LoadCursorA GetDC ReleaseDC GetSysColorBrush ClientToScreen GetDesktopWindow CreateDialogIndirectParamA GetNextDlgTabItem EndDialog RegisterWindowMessageA LoadIconA WinHelpA GetCapture GetClassLongA GetClassNameA SetPropA GetPropA RemovePropA GetForegroundWindow SetActiveWindow GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetMenu CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx CopyRect PtInRect DefWindowProcA CallWindowProcA SystemParametersInfoA IsIconic GetWindowPlacement GetWindowTextA SetWindowPos SetFocus ShowWindow MoveWindow SetWindowLongA GetDlgCtrlID IsWindow SetWindowTextA IsDialogMessageA SendDlgItemMessageA MessageBoxA ExitWindowsEx GetSystemMetrics UpdateWindow SendMessageA GetWindowRect GetDlgItem GetWindow GetWindowThreadProcessId GetWindowLongA GetLastActivePopup IsWindowEnabled SetCursor SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage UnregisterClassA DestroyMenu EnableWindow LoadImageA CheckMenuItem EnableMenuItem GetMenuState ModifyMenuA GetParent GetFocus LoadBitmapA GetMenuCheckMarkDimensions SetMenuItemBitmaps PostQuitMessage PostMessageA DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState PeekMessageA GetCursorPos ValidateRect GetMenuItemID GetMenuItemCount GetSubMenu GetClientRect

gdi32

DeleteDC GetStockObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible GetObjectA SetMapMode RestoreDC SaveDC DeleteObject SetBkColor SetTextColor GetClipBox GetDeviceCaps CreateBitmap

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegQueryValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyA RegCreateKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSetValueExA RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExA

shlwapi

PathFindExtensionA PathFindFileNameA PathIsRelativeA

oleaut32

VariantClear VariantChangeType VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_b411283cd59f101940d1514b40d36515_elex_emotet_floxif_stop

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

generic