2026-08-08_1fab2c44543da2d8b1cb7f86757e6416_elex_floxif_hijackloader_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_1fab2c44543da2d8b1cb7f86757e6416_elex_floxif_hijackloader_wannacry
Size 2.5MB
Sample260808-1262fadr5x
SHA256 daa928ecd77fff5a1a8b32c685de37c651cc34a7a5446c3ad7fc23f05e1da65b
MD5 1fab2c44543da2d8b1cb7f86757e6416
SHA1 14209b477483da7eaa924aad72fcc6417a452bf8
SHA512 f0e53627172eeaf591ac5e4349ae80896424b16013181edb4cd2b2cfed361d1470a42daa4e49c1571dbeb18447b316cbd468c81411d6d41ee4e68f8cd8acdaa8
SSDEEP 49152:pflRgZAAC0oj5fu9jSo8Hv0SAlh+P5Zq0RnaKqspm/Ef4:LRLAgjQco8MJWZqkawm/Ew
TLSH
T1ECC5229A67A586FDD8A47FB87A57691B54F13E0D2C3BFB824F10B4021F7E2A33189105
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_1fab2c44543da2d8b1cb7f86757e6416_elex_floxif_hijackloader_wannacry

File Explorer

2026-08-08_1fab2c44543da2d8b1cb7f86757e6416_elex_floxif_hijackloader_wannacry

.exe 2.5MB

2026-08-08_1fab2c44543da2d8b1cb7f86757e6416_elex_floxif_hijackloader_wannacry

IMPHASH 4ba3ea0d6362a841ec66a1fc0a1b874f
SHA256 daa928ecd77fff5a1a8b32c685de37c651cc34a7a5446c3ad7fc23f05e1da65b
MD5 1fab2c44543da2d8b1cb7f86757e6416
SHA1 14209b477483da7eaa924aad72fcc6417a452bf8
SHA512 f0e53627172eeaf591ac5e4349ae80896424b16013181edb4cd2b2cfed361d1470a42daa4e49c1571dbeb18447b316cbd468c81411d6d41ee4e68f8cd8acdaa8
SSDEEP 49152:pflRgZAAC0oj5fu9jSo8Hv0SAlh+P5Zq0RnaKqspm/Ef4:LRLAgjQco8MJWZqkawm/Ew
TLSH
T1ECC5229A67A586FDD8A47FB87A57691B54F13E0D2C3BFB824F10B4021F7E2A33189105
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8f:04:e1:22:b4:99:a8:d5:02:c0:4e:41:3e:d3:04:5c:bb:53:26:27:22:94:32:77:05:df:31:58:8a:bf:96:07

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=5738119,CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 7, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

07:8a:a6:13:e0:e5:d5:ab:31:96:67:b9:3d:2b:96:73

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2024 - May 8, 2027

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

105324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysAllocStringLen VariantClear SysStringLen

user32

DialogBoxParamW SetWindowLongW GetWindowLongW GetDlgItem SetTimer LoadStringW CharUpperW DestroyWindow EndDialog PostMessageW SetWindowTextW ShowWindow MessageBoxW SendMessageW LoadIconW KillTimer

shell32

ShellExecuteExW

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ?terminate@@YAXXZ ??1type_info@@UAE@XZ _except_handler3 _beginthreadex memset wcsstr free malloc memcpy _CxxThrowException _purecall memmove memcmp wcscmp __CxxFrameHandler

kernel32

GetStartupInfoA InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW ResetEvent SetEvent CreateEventW GetVersion VirtualFree VirtualAlloc Sleep GetStdHandle GlobalMemoryStatus GetSystemInfo GetCurrentProcess GetProcessAffinityMask SetEndOfFile WriteFile ReadFile SetFilePointer GetFileSize GetFileInformationByHandle GetFileAttributesW GetModuleHandleA FindNextFileW FindFirstFileW FindClose GetCurrentThreadId GetTickCount GetCurrentProcessId GetCurrentDirectoryW SetCurrentDirectoryW SetLastError DeleteFileW CreateDirectoryW GetModuleHandleW GetProcAddress RemoveDirectoryW SetFileAttributesW CreateFileW SetFileTime GetSystemDirectoryW GetTempPathW FormatMessageW LocalFree GetModuleFileNameW LoadLibraryExW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError GetVersionExW GetCommandLineW CreateProcessW CloseHandle WaitForSingleObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_1fab2c44543da2d8b1cb7f86757e6416_elex_floxif_hijackloader_wannacry

PE Signature issue

oleaut32

user32

shell32

msvcrt

kernel32

generic