2026-07-20_403bd2e12f077691e50b06075cf7bb15_elex_hijackloader_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_403bd2e12f077691e50b06075cf7bb15_elex_hijackloader_maze
Size 1.9MB
Sample260720-jpdexsdt8v
SHA256 674283f33e110203d2639518af403912739ad8c8ef8a0aa305f997992717a8e7
MD5 403bd2e12f077691e50b06075cf7bb15
SHA1 a00ae79f1b5613d799bbcfbc5bd6633f22a4609e
SHA512 83f32855aa14d346e4f883c3c91e8fa27cc1d74e4a58b9e1825cfa4062a3740f949c1234b55dcd331132b072f0e5f129e0009ff517e2e8822b4723d0776b7581
SSDEEP 49152:1kDBelYZCtAMwyBjl1S0UyfC3q1IwxmGhAPmC:GDBN4vC3q1IwVAPV
TLSH
T170955B22B8408135EAA612B7C6FCFA30459DDE20472952D793EC3D1B3BB06D36B35697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_403bd2e12f077691e50b06075cf7bb15_elex_hijackloader_maze

File Explorer

2026-07-20_403bd2e12f077691e50b06075cf7bb15_elex_hijackloader_maze

.exe 1.9MB

2026-07-20_403bd2e12f077691e50b06075cf7bb15_elex_hijackloader_maze

IMPHASH ef5caf34866bddeeb300bf2c6c9e30bb
SHA256 674283f33e110203d2639518af403912739ad8c8ef8a0aa305f997992717a8e7
MD5 403bd2e12f077691e50b06075cf7bb15
SHA1 a00ae79f1b5613d799bbcfbc5bd6633f22a4609e
SHA512 83f32855aa14d346e4f883c3c91e8fa27cc1d74e4a58b9e1825cfa4062a3740f949c1234b55dcd331132b072f0e5f129e0009ff517e2e8822b4723d0776b7581
SSDEEP 49152:1kDBelYZCtAMwyBjl1S0UyfC3q1IwxmGhAPmC:GDBN4vC3q1IwVAPV
TLSH
T170955B22B8408135EAA612B7C6FCFA30459DDE20472952D793EC3D1B3BB06D36B35697
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8e:a2:e7:99:20:89:9f:77:50:30:72:51:50:8b:7a:7b:4c:d7:ac:21:2c:52:09:f9:14:e4:30:a6:bc:14:e0:07

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=9144030008867405X2,CN=深圳市脸萌科技有限公司,O=深圳市脸萌科技有限公司,L=深圳市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6b7b1e59cb3e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Feb 14, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:62:c5:a6:48:d4:d6:fc:92:9f:f7:3f:16:f9:88:2d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 10, 2022 - Dec 3, 2025

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

918295

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Admin\VideoFusion-win\install\VideofusionInstaller\build\Release\FeedbackTool.pdb

powrprof

PowerDeterminePlatformRole

setupapi

CM_Get_Device_IDW SetupDiEnumDeviceInfo SetupDiGetClassDevsW

kernel32

GetTickCount CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime ProcessIdToSessionId GetCommandLineW GetDiskFreeSpaceExW GetVolumeInformationW QueryDosDeviceW GetTempPathW GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetVersion GetSystemDirectoryW LocalAlloc lstrcmpW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW CopyFileW MoveFileExW WTSGetActiveConsoleSessionId InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent CreateEventW CreateThread MoveFileW InitializeCriticalSectionAndSpinCount GetCurrentThreadId LoadLibraryExW lstrcmpiW GetEnvironmentVariableW lstrlenW GetProcessId GetModuleHandleA GetTempFileNameW GetLogicalDriveStringsW GetVolumePathNameW ReplaceFileW SetCurrentDirectoryW GetFileAttributesExW GetNativeSystemInfo CreateMutexW FormatMessageA OutputDebugStringA ReleaseMutex RegisterWaitForSingleObject UnregisterWaitEx FindFirstFileExW SystemTimeToTzSpecificLocalTime QueryPerformanceCounter GetSystemTimeAsFileTime TzSpecificLocalTimeToSystemTime QueryPerformanceFrequency SetEndOfFile SetFilePointerEx UnlockFile LockFile GetLocalTime GetFileSizeEx DuplicateHandle Sleep SetThreadPriority GetThreadPriority IsDebuggerPresent GetUserDefaultLangID TryEnterCriticalSection GetModuleHandleExW TlsGetValue TlsSetValue TlsAlloc TlsFree SetInformationJobObject GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort WaitForMultipleObjects GlobalMemoryStatusEx RtlCaptureStackBackTrace QueueUserWorkItem GetModuleHandleExA GetProcessHeaps HeapSetInformation HeapUnlock HeapLock HeapWalk GetProcessIoCounters VirtualQueryEx GetProcessTimes GetSystemInfo GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW WriteConsoleW GetTimeZoneInformation FreeEnvironmentStringsW GetEnvironmentStringsW FatalAppExitA ReadConsoleW CreateSemaphoreW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetStdHandle GetStringTypeW GetCPInfo GetFileInformationByHandle GetOEMCP GetACP IsValidCodePage AreFileApisANSI ExitProcess GetConsoleMode GetConsoleCP GetFileType SetStdHandle SetConsoleCtrlHandler IsProcessorFeaturePresent VirtualQuery VirtualProtect DeleteCriticalSection InitializeCriticalSectionEx SystemTimeToFileTime SetFileTime SetFilePointer LocalFileTimeToFileTime GetCurrentDirectoryW GetCurrentThread GetCurrentProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot LoadLibraryW FreeLibrary GetWindowsDirectoryW OpenProcess WaitForSingleObject LocalFree GetProcAddress GetModuleHandleW GetVersionExW DeviceIoControl SetLastError SetFileAttributesW GetLongPathNameW GetFullPathNameW ExpandEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar CloseHandle WriteFile ReadFile GetFileSize CreateFileW FindResourceW SizeofResource LockResource LoadResource GetModuleFileNameW FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW EnumSystemLocalesW GetDriveTypeW GetFullPathNameA SetEnvironmentVariableA DecodePointer FlushFileBuffers LoadLibraryExA VirtualAlloc RtlUnwind EncodePointer OutputDebugStringW

user32

EnumWindows GetWindowLongW CharUpperW GetWindowTextLengthW GetWindowTextW GetClassNameW GetWindowThreadProcessId DefWindowProcW DestroyWindow UnregisterClassW GetDesktopWindow GetDC PostMessageW SetTimer PostQuitMessage KillTimer WaitMessage GetQueueStatus TranslateMessage RegisterClassExW CallMsgFilterW PeekMessageW MsgWaitForMultipleObjectsEx CreateWindowExW DispatchMessageW GetKeyState IsWindowEnabled FindWindowW SystemParametersInfoW IsWindow GetSystemMetrics CharNextW ExitWindowsEx

gdi32

DeleteObject GetDeviceCaps

advapi32

GetTraceEnableLevel UnregisterTraceGuids TraceEvent GetTraceLoggerHandle GetTraceEnableFlags SystemFunction036 RegNotifyChangeKeyValue RegEnumValueW ConvertSidToStringSidW RegDeleteValueW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW RegOpenCurrentUser RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl IsValidSecurityDescriptor InitializeSecurityDescriptor ImpersonateLoggedOnUser FreeSid EqualSid DuplicateToken AllocateAndInitializeSid AddAccessAllowedAce AccessCheck LookupPrivilegeValueW RevertToSelf ImpersonateSelf AdjustTokenPrivileges OpenThreadToken SetThreadToken ConvertStringSidToSidW LookupAccountSidW SetTokenInformation GetTokenInformation DuplicateTokenEx OpenProcessToken CreateProcessAsUserW SetNamedSecurityInfoW GetNamedSecurityInfoW IsValidSid InitializeSid InitializeAcl GetSidSubAuthority GetSidLengthRequired GetLengthSid GetAclInformation GetAce CopySid AddAce RegisterTraceGuidsW

shell32

ShellExecuteExW SHGetFolderPathA SHGetFolderPathW SHGetKnownFolderPath ShellExecuteW SHFileOperationW CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree PropVariantClear CoCreateInstance

oleaut32

SysAllocString SysFreeString VarUI4FromStr SysStringLen

shlwapi

StrToIntW SHStrDupW StrChrW StrCmpNW SHSetValueW StrCmpNIW StrRChrW StrCmpIW StrCpyNW SHGetValueW PathRemoveFileSpecW PathIsDirectoryW PathGetDriveNumberW PathFindExtensionW PathAddBackslashW PathFileExistsW PathAppendW

comctl32

InitCommonControlsEx

userenv

LoadUserProfileW UnloadUserProfile CreateEnvironmentBlock DestroyEnvironmentBlock

mpr

WNetGetResourceInformationW

psapi

EnumProcesses GetModuleFileNameExW GetProcessImageFileNameW GetMappedFileNameW QueryWorkingSet GetProcessMemoryInfo EnumProcessModules

netapi32

NetApiBufferFree NetGetJoinInformation

winmm

timeGetTime timeBeginPeriod timeEndPeriod

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

11KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

485KB

Virtual Size

485KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_403bd2e12f077691e50b06075cf7bb15_elex_hijackloader_maze

PE Signature issue

powrprof

setupapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

userenv

mpr

psapi

netapi32

winmm

generic