2026-07-18_103a6e7e569c159a312d56ce162485d4_elex_emotet_floxif_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_103a6e7e569c159a312d56ce162485d4_elex_emotet_floxif_stop
Size 395KB
Sample260718-vebdcsgs3r
SHA256 4be73a6df5968bc916eb1f3bf7dc4f15ea8c5dd00e00d5edbdc6db5390fc28d5
MD5 103a6e7e569c159a312d56ce162485d4
SHA1 e70e55b77fa8bf396b38e76602e02e7e7a247687
SHA512 ee4888487d415ffb88036bf492a83fdefc881ebdd6b714e788d4a9ac236bb4fceb59a48185e0952ae8674ea8f059bc9f8746d64b811a10e8998ad4773cae004f
SSDEEP 6144:12cWekU1lldgynIi8VKqGn6gL+jYH3gFViBV+UdvrEFp7hKyP:1plHnIi8V5syYH+ViBjvrEH79P
TLSH
T11784BE0137E1C7FAD0A311336A56D799A7F6BD295C764247B7C03B0DEE386528B2831A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-18_103a6e7e569c159a312d56ce162485d4_elex_emotet_floxif_stop

File Explorer

2026-07-18_103a6e7e569c159a312d56ce162485d4_elex_emotet_floxif_stop

.exe 395KB

2026-07-18_103a6e7e569c159a312d56ce162485d4_elex_emotet_floxif_stop

IMPHASH 29fcd848fd80dc93f5e1f58db519f247
SHA256 4be73a6df5968bc916eb1f3bf7dc4f15ea8c5dd00e00d5edbdc6db5390fc28d5
MD5 103a6e7e569c159a312d56ce162485d4
SHA1 e70e55b77fa8bf396b38e76602e02e7e7a247687
SHA512 ee4888487d415ffb88036bf492a83fdefc881ebdd6b714e788d4a9ac236bb4fceb59a48185e0952ae8674ea8f059bc9f8746d64b811a10e8998ad4773cae004f
SSDEEP 6144:12cWekU1lldgynIi8VKqGn6gL+jYH3gFViBV+UdvrEFp7hKyP:1plHnIi8V5syYH+ViBjvrEH79P
TLSH
T11784BE0137E1C7FAD0A311336A56D799A7F6BD295C764247B7C03B0DEE386528B2831A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

86:97:9b:90:ea:21:c3:43:99:f4:07:52:a6:dd:74:86:4c:98:30:f1:b0:16:ea:8e:35:82:dc:1f:83:09:12:72

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ZerodaySecurity Co.\,Ltd.,OU=IT Team,O=ZerodaySecurity Co.\,Ltd.,L=Gwangjin-gu,ST=SEOUL,C=KR

Chains

Dec 28, 2017

CN=ZerodaySecurity Co.\,Ltd.,OU=IT Team,O=ZerodaySecurity Co.\,Ltd.,L=Gwangjin-gu,ST=SEOUL,C=KR

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

PE Signature issue

Digest

60:3f:77:01:a0:2a:6c:5a:45:59:ca:ca:47:89:d5:19:ab:31:49:bd

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ZerodaySecurity Co.\,Ltd.,OU=IT Team,O=ZerodaySecurity Co.\,Ltd.,L=Gwangjin-gu,ST=SEOUL,C=KR

Chains

Dec 28, 2017

CN=ZerodaySecurity Co.\,Ltd.,OU=IT Team,O=ZerodaySecurity Co.\,Ltd.,L=Gwangjin-gu,ST=SEOUL,C=KR

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=ZerodaySecurity Co.\,Ltd.,OU=IT Team,O=ZerodaySecurity Co.\,Ltd.,L=Gwangjin-gu,ST=SEOUL,C=KR

Serial Number

f3:61:a4:86:5f:ef:4f:66:f0:52:c0:b5:76:5a:ee

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 5, 2016 - Jan 4, 2020

Subject

Serial Number

61:1f:b0:a4:00:00:00:00:00:1d

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

128322

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\ZeroDay\Project\TouchEn_WebExe\TEWebPolicy\release\TEWebPolicy.pdb

kernel32

SetErrorMode GetTickCount FileTimeToLocalFileTime GetFileAttributesA GetFileTime HeapFree VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapAlloc HeapReAlloc GetCommandLineA GetProcessHeap GetStartupInfoA RaiseException RtlUnwind ExitThread CreateThread HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapDestroy HeapCreate VirtualFree GetStdHandle GetACP IsValidCodePage FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA FileTimeToSystemTime CreateFileA GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetOEMCP GetCPInfo GetThreadLocale GlobalFlags InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedDecrement GetModuleFileNameW GetCurrentProcessId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA lstrcmpW CreateEventA SuspendThread SetEvent WaitForSingleObject ResumeThread SetThreadPriority WritePrivateProfileStringA FreeResource GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA LoadLibraryExA lstrcmpA GetModuleHandleA GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageA LocalFree MulDiv SetLastError FindResourceA ExitProcess LoadResource LockResource SizeofResource GetModuleFileNameA GetProcAddress LoadLibraryA WinExec Sleep OutputDebugStringA CloseHandle OpenProcess Process32Next ProcessIdToSessionId WTSGetActiveConsoleSessionId Process32First CreateToolhelp32Snapshot GetVersionExA CreateMutexA FreeLibrary OpenMutexA lstrlenA CompareStringA GetLastError MultiByteToWideChar CompareStringW InterlockedExchange WideCharToMultiByte GetVersion

user32

PostThreadMessageA InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableA CharNextA LoadCursorA GetSysColorBrush DestroyMenu EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA GetDesktopWindow CreateDialogIndirectParamA GetNextDlgTabItem EndDialog GetWindowThreadProcessId SetCursor RegisterWindowMessageA WinHelpA IsChild GetCapture GetClassLongA GetClassNameA SetPropA GetPropA RemovePropA GetForegroundWindow GetLastActivePopup SetActiveWindow GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos SetForegroundWindow UpdateWindow GetMenu MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx EqualRect CopyRect PtInRect DefWindowProcA CallWindowProcA OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect GetWindowTextA SetFocus IsWindowEnabled ShowWindow MoveWindow SetWindowLongA GetDlgCtrlID IsWindow SetWindowTextA GetWindowLongA IsDialogMessageA SendDlgItemMessageA GetDlgItem SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState PeekMessageA GetCursorPos ValidateRect SetMenuItemBitmaps RegisterClipboardFormatA UnregisterClassA GetMenuCheckMarkDimensions LoadBitmapA MessageBeep GetNextDlgGroupItem ReleaseCapture MapWindowPoints SetCapture GetFocus ModifyMenuA EnableMenuItem CheckMenuItem GetWindow SetWindowContextHelpId GetParent MapDialogRect SetWindowPos PostMessageA GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu AppendMenuA EnableWindow PostQuitMessage DrawIcon GetSystemMenu GetClientRect GetSystemMetrics LoadIconA SendMessageA IsIconic SetTimer wsprintfA WaitForInputIdle CharUpperA GetSysColor

gdi32

GetStockObject RectVisible GetBkColor GetTextColor CreateRectRgnIndirect GetMapMode PtVisible GetWindowExtEx GetViewportExtEx DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA GetRgnBox GetDeviceCaps DeleteObject SetMapMode RestoreDC SaveDC GetObjectA SetBkColor SetTextColor GetClipBox CreateBitmap TextOutA

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegQueryValueExA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegSetValueExA RegCreateKeyExA RegOpenKeyExA OpenProcessToken RegOpenKeyA RegCloseKey CreateProcessAsUserA AdjustTokenPrivileges SetTokenInformation DuplicateTokenEx LookupPrivilegeValueA

comctl32

InitCommonControlsEx

shlwapi

PathFindExtensionA PathStripToRootA PathFindFileNameA PathIsUNCA

oledlg

ord8

ole32

CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID OleInitialize CoTaskMemAlloc CoTaskMemFree CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter

oleaut32

VariantCopy SysAllocString SafeArrayDestroy SystemTimeToVariantTime VariantTimeToSystemTime OleCreateFontIndirect SysAllocStringByteLen SysStringLen VariantInit VariantChangeType VariantClear SysAllocStringLen SysFreeString

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_103a6e7e569c159a312d56ce162485d4_elex_emotet_floxif_stop

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

shlwapi

oledlg

ole32

oleaut32

userenv

generic