2026-08-13_4352654062162a48fb9ca8c656774ae7_elex_floxif_maze_smoke-loader_stealc

General

Target
2026-08-13_4352654062162a48fb9ca8c656774ae7_elex_floxif_maze_smoke-loader_stealc
Size 810KB
Sample260813-stqqgsshrc
SHA256 89fca4d9dfb931b8066cfccd6b5a83a9a4966f169d5f2d1b43d235201be2de45
MD5 4352654062162a48fb9ca8c656774ae7
SHA1 688c40c1d828aebe587117b608953f96b7af1e6c
SHA512 010f8eb373dab37c1af6530f79b7c2e6a7dc0b4ba91838206c0df0874f46f3b136d419df331544125e163a2a4c028aacd0ea1ea6a6bb3fa0fbc318873909e7d4
SSDEEP 12288:9OC1YI/ejn2SoSd3o5aUX7jzbBjvrEH70k9:9O+YFbaRjzhrEH70k9
TLSH
T13F054B5A7660FBE6CF10623EA4F6CA7054627DFBC93E0B9A2ACDFD2D1536241043B509
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-13_4352654062162a48fb9ca8c656774ae7_elex_floxif_maze_smoke-loader_stealc

File Explorer

2026-08-13_4352654062162a48fb9ca8c656774ae7_elex_floxif_maze_smoke-loader_stealc

.exe 810KB

2026-08-13_4352654062162a48fb9ca8c656774ae7_elex_floxif_maze_smoke-loader_stealc

IMPHASH 011c882d8d6e71b19cf14a243c41eade
SHA256 89fca4d9dfb931b8066cfccd6b5a83a9a4966f169d5f2d1b43d235201be2de45
MD5 4352654062162a48fb9ca8c656774ae7
SHA1 688c40c1d828aebe587117b608953f96b7af1e6c
SHA512 010f8eb373dab37c1af6530f79b7c2e6a7dc0b4ba91838206c0df0874f46f3b136d419df331544125e163a2a4c028aacd0ea1ea6a6bb3fa0fbc318873909e7d4
SSDEEP 12288:9OC1YI/ejn2SoSd3o5aUX7jzbBjvrEH70k9:9O+YFbaRjzhrEH70k9
TLSH
T13F054B5A7660FBE6CF10623EA4F6CA7054627DFBC93E0B9A2ACDFD2D1536241043B509
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

88:43:b4:95:6a:5a:a3:88:88:7e:67:f7:c9:b6:40:8a:93:8d:aa:e3:93:63:77:fd:60:ec:14:ed:f6:ea:7f:03

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,STREET=Floor 10\, 49\, Daewangpangyo-ro 644beon-gil\, Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 4, 2019

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,STREET=Floor 10\, 49\, Daewangpangyo-ro 644beon-gil\, Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

PE Signature issue

Digest

f1:39:92:e5:4c:b4:2d:d6:de:85:65:6b:37:04:40:8b:a9:19:6d:5b

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,STREET=Floor 10\, 49\, Daewangpangyo-ro 644beon-gil\, Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 4, 2019

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,STREET=Floor 10\, 49\, Daewangpangyo-ro 644beon-gil\, Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

SERIALNUMBER=110111-0725064,CN=HANCOM. INC\,,O=HANCOM. INC\,,STREET=Floor 10\, 49\, Daewangpangyo-ro 644beon-gil\, Bundang-gu,L=Seongnam-si,ST=Gyeonggi-do,C=KR,1.3.6.1.4.1.311.60.2.1.3=#13024b52,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

1f:1e:4a:7a:b0:a7:f5:4a:1f:d6:08:07

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 30, 2018 - Aug 30, 2021

Subject

CN=GlobalSign TSA for Advanced - G2

Serial Number

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

1

Major OS version

5

Entry point

33161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\GitRepository\install\HOffice110\Install_2020\Install\Release\Install.pdb

kernel32

GetModuleFileNameW SetEndOfFile CreateFileW OutputDebugStringW ReadConsoleW WriteConsoleW SetStdHandle LoadLibraryExW HeapReAlloc GetOEMCP GetACP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte MultiByteToWideChar GetStringTypeW IsDebuggerPresent IsProcessorFeaturePresent GetLastError HeapFree RaiseException RtlUnwind GetCommandLineW GetCPInfo HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW HeapSize GetProcessHeap CloseHandle FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode GetStdHandle GetFileType ReadFile SetFilePointerEx GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId

user32

LoadStringW LoadIconW LoadCursorW EndPaint BeginPaint SetActiveWindow EndDialog DialogBoxParamW DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW UpdateWindow

shell32

ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_4352654062162a48fb9ca8c656774ae7_elex_floxif_maze_smoke-loader_stealc

PE Signature issue

PE Signature issue

kernel32

user32

shell32

generic