2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia
Size 1.8MB
Sample260716-mc7psaat7m
SHA256 72d88e46e3d32433746dd2c9894a672db8c45d6fb45e2c8b86d42833016e2e74
MD5 23b4e2cbbd372f9ae0de2a7874db7427
SHA1 297cfc3f97ff21797df1447e9fd360c3ae0b64c7
SHA512 70367f1e917b3f58b6c5a7424ae59cb0bb594f2e8752d0c9d1c5849bdc4d3719da8645fefe52bf42f910bbf74d683d98c2c980139cbf296f511883f3e69f0634
SSDEEP 49152:m/UA9Qkz7nQiLtQMT0MwSyNbtZ3ZjQMkA1z0oVvxtJW:8UA3z7nQAo93W
TLSH
T1F2854C1296CC2826C27108332F5A7256EEE695732B1401D736CD76BF1FB68C21C6F66B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia

File Explorer

2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia

.exe 1.8MB

2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia

IMPHASH d693f0c4a9bfe29cf66c36618bfc5e9e
SHA256 72d88e46e3d32433746dd2c9894a672db8c45d6fb45e2c8b86d42833016e2e74
MD5 23b4e2cbbd372f9ae0de2a7874db7427
SHA1 297cfc3f97ff21797df1447e9fd360c3ae0b64c7
SHA512 70367f1e917b3f58b6c5a7424ae59cb0bb594f2e8752d0c9d1c5849bdc4d3719da8645fefe52bf42f910bbf74d683d98c2c980139cbf296f511883f3e69f0634
SSDEEP 49152:m/UA9Qkz7nQiLtQMT0MwSyNbtZ3ZjQMkA1z0oVvxtJW:8UA3z7nQAo93W
TLSH
T1F2854C1296CC2826C27108332F5A7256EEE695732B1401D736CD76BF1FB68C21C6F66B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

416877

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\jenkins\workspace\Win-NokiaSuite-3.8-BackStage\Output\Release\NPlatform\NokiaMTranscodeServer.pdb

wmvcore

WMIsContentProtected

kernel32

LeaveCriticalSection RaiseException EnterCriticalSection MultiByteToWideChar LoadLibraryExW GetModuleFileNameW InterlockedIncrement QueryPerformanceCounter QueryPerformanceFrequency GetTickCount lstrcmpiW CloseHandle CreateSemaphoreW WaitForSingleObject ReleaseSemaphore GetCurrentProcessId WaitForMultipleObjects SetEvent GetCommandLineW CreateEventW CreateThread GetModuleHandleW GetProcAddress lstrlenW FreeLibrary InitializeCriticalSectionAndSpinCount GetLastError DeleteCriticalSection Sleep InterlockedDecrement FindResourceExW FindResourceW LoadResource LockResource SizeofResource InterlockedCompareExchange GetCurrentThreadId GetFileSize FlushFileBuffers SetEndOfFile IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID InterlockedExchange LoadLibraryW WriteConsoleW SetStdHandle GetSystemTimeAsFileTime SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW IsProcessorFeaturePresent HeapCreate ExitProcess GetStdHandle lstrlenA WideCharToMultiByte LocalFree HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc FormatMessageW OutputDebugStringW SetThreadPriority CreateMutexW ReleaseMutex ResetEvent ExpandEnvironmentStringsW FindClose FindFirstFileW GetTempPathW CreateDirectoryW FindNextFileW RemoveDirectoryW MoveFileW DeleteFileW CreateFileW InitializeCriticalSection ReadFile SetFilePointer WriteFile GetShortPathNameW GetLongPathNameW GetFileTime FileTimeToSystemTime OpenProcess TerminateProcess GetLocalTime GetLocaleInfoW DecodePointer EncodePointer VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapSetInformation GetStartupInfoW RtlUnwind SetFileAttributesW GetFileAttributesW GetConsoleCP GetConsoleMode GetFileType GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent

user32

DispatchMessageW GetMessageW TranslateMessage LoadStringW PostThreadMessageW CharUpperW CharNextW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW IsTextUnicode RegQueryValueExW ReportEventW RegisterEventSourceW DeregisterEventSource InitializeSecurityDescriptor SetSecurityDescriptorDacl RegDeleteValueW

ole32

StringFromCLSID CoGetClassObject OleRun CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoInitializeEx ProgIDFromCLSID CoAddRefServerProcess CoReleaseServerProcess CoResumeClassObjects CoRegisterClassObject CoRevokeClassObject StringFromGUID2 CoCreateInstance CoUninitialize

oleaut32

SafeArrayGetLBound SafeArrayGetUBound SafeArrayCreateVectorEx SysAllocStringLen UnRegisterTypeLi RegisterTypeLi LoadTypeLi LoadRegTypeLi SysStringLen CreateErrorInfo SetErrorInfo VariantCopy VarUI4FromStr SysAllocStringByteLen SysStringByteLen VariantInit VariantChangeType SysAllocString SysFreeString VariantClear GetErrorInfo SystemTimeToVariantTime SafeArrayGetElement SafeArrayGetVartype SafeArrayPutElement

psapi

EnumProcesses GetModuleBaseNameW EnumProcessModules

shell32

SHGetSpecialFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_23b4e2cbbd372f9ae0de2a7874db7427_elex_mafia

wmvcore

kernel32

user32

advapi32

ole32

oleaut32

psapi

shell32

generic