2026-07-09_5188955feadef205e3373434701f9828_elex_emotet_floxif_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_5188955feadef205e3373434701f9828_elex_emotet_floxif_stop
Size 1.3MB
Sample260709-r71beact9k
SHA256 e49d189998ad4f46c309fc0e3dfe3f08efa0bd7f2d8f5641534b252cb94e71dd
MD5 5188955feadef205e3373434701f9828
SHA1 ce7bb9c05bc5ddef44e34d004600409be1f3b8d4
SHA512 f2cf1f0f9e721c811fa98bdf5b637ed7338b10afba40300571c2b2356861072cc354cb3ffa30768cd5dfbb61ce60f446b4700fe902fe086bf50fe4199f56701f
SSDEEP 12288:InYXLOMAlpo7nqVwQuvPr1wrAHdYiUSFKdYikoKrUIMBjvrEH7WF:SDPtunRQfImrEH7WF
TLSH
T1A6554C4A686E4D34FB62E13740882533149A6D39A11018D6E7DFB6A0C5BFF319219FBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-09_5188955feadef205e3373434701f9828_elex_emotet_floxif_stop

File Explorer

2026-07-09_5188955feadef205e3373434701f9828_elex_emotet_floxif_stop

.exe 1.3MB

2026-07-09_5188955feadef205e3373434701f9828_elex_emotet_floxif_stop

IMPHASH 6045ea30056bfbd69ab2c119e34e1ef2
SHA256 e49d189998ad4f46c309fc0e3dfe3f08efa0bd7f2d8f5641534b252cb94e71dd
MD5 5188955feadef205e3373434701f9828
SHA1 ce7bb9c05bc5ddef44e34d004600409be1f3b8d4
SHA512 f2cf1f0f9e721c811fa98bdf5b637ed7338b10afba40300571c2b2356861072cc354cb3ffa30768cd5dfbb61ce60f446b4700fe902fe086bf50fe4199f56701f
SSDEEP 12288:InYXLOMAlpo7nqVwQuvPr1wrAHdYiUSFKdYikoKrUIMBjvrEH7WF:SDPtunRQfImrEH7WF
TLSH
T1A6554C4A686E4D34FB62E13740882533149A6D39A11018D6E7DFB6A0C5BFF319219FBF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fb:4b:f5:b0:d7:a7:28:2a:59:0b:38:15:39:bf:5d:13:d9:b3:04:7a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Chains

Jun 18, 2013

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Serial Number

29:66:2a:74:5c:40:15:70:38:f2:78:9d:69:05:e9:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 21, 2012 - Aug 23, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

87048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\docuworks800\jp\source\setup\release\Setup32.pdb

kernel32

GetCPInfo GetOEMCP SetErrorMode HeapFree VirtualAlloc HeapReAlloc HeapAlloc GetCommandLineA GetProcessHeap GetStartupInfoA RtlUnwind ExitProcess RaiseException HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP IsValidCodePage LCMapStringW HeapDestroy HeapCreate VirtualFree GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers ReadFile GetThreadLocale InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc WritePrivateProfileStringA GlobalFlags EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection InterlockedDecrement GetModuleFileNameW FreeResource GlobalGetAtomNameA GlobalFindAtomA lstrcmpW GetCurrentProcessId GlobalAddAtomA SetLastError GlobalFree GlobalUnlock FormatMessageA LocalFree MulDiv GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA LoadLibraryA GlobalLock lstrcmpA GlobalAlloc FreeLibrary GetVersion InterlockedExchange CompareStringA MultiByteToWideChar Sleep GetTickCount GetModuleFileNameA GetSystemDirectoryA GetLocalTime GetTempPathA GetPrivateProfileStringA CloseHandle WriteFile SetFilePointer CreateFileA CreateDirectoryA FindResourceA ExpandEnvironmentStringsA LoadResource GetFileAttributesA LockResource FindClose SizeofResource FindFirstFileA GetCurrentProcess WideCharToMultiByte GetModuleHandleA GetProcAddress lstrcmpiA GetLastError CreateMutexA lstrlenA GetExitCodeProcess WaitForSingleObject LCMapStringA GetVersionExA

user32

EndPaint BeginPaint GrayStringA DrawTextExA DrawTextA TabbedTextOutA LoadCursorA GetDC ReleaseDC GetSysColorBrush ClientToScreen GetDesktopWindow CreateDialogIndirectParamA GetNextDlgTabItem EndDialog RegisterWindowMessageA LoadIconA WinHelpA GetCapture GetClassLongA GetClassNameA SetPropA GetPropA RemovePropA GetForegroundWindow SetActiveWindow GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetMenu CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx CopyRect PtInRect DefWindowProcA CallWindowProcA SystemParametersInfoA IsIconic GetWindowPlacement GetWindowTextA SetWindowPos SetFocus ShowWindow MoveWindow SetWindowLongA GetDlgCtrlID IsWindow SetWindowTextA IsDialogMessageA SendDlgItemMessageA MessageBoxA ExitWindowsEx GetSystemMetrics UpdateWindow SendMessageA GetWindowRect GetDlgItem GetWindow GetWindowThreadProcessId GetWindowLongA GetLastActivePopup IsWindowEnabled SetCursor SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage UnregisterClassA DestroyMenu EnableWindow LoadImageA CheckMenuItem EnableMenuItem GetMenuState ModifyMenuA GetParent GetFocus LoadBitmapA GetMenuCheckMarkDimensions SetMenuItemBitmaps PostQuitMessage PostMessageA DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState PeekMessageA GetCursorPos ValidateRect GetMenuItemID GetMenuItemCount GetSubMenu GetClientRect

gdi32

DeleteDC GetStockObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible GetObjectA SetMapMode RestoreDC SaveDC DeleteObject SetBkColor SetTextColor GetClipBox GetDeviceCaps CreateBitmap

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegQueryValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyA RegCreateKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSetValueExA RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExA

shlwapi

PathFindExtensionA PathFindFileNameA PathIsRelativeA

oleaut32

VariantClear VariantChangeType VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_5188955feadef205e3373434701f9828_elex_emotet_floxif_stop

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

generic