2026-08-14_81097032cdaee2ec95ab2cc0c8e37e2c_elex_floxif_mafia_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_81097032cdaee2ec95ab2cc0c8e37e2c_elex_floxif_mafia_tofsee
Size 519KB
Sample260814-ej1aaatze1
SHA256 2fcedaf72b1d183a3c828c90a4c78cbef8faf1e2ef95374986b5f9748ee21312
MD5 81097032cdaee2ec95ab2cc0c8e37e2c
SHA1 5080a016719045e1e43e177921d010a485225f63
SHA512 9181f6523aea1df8ac19cfce205ce29d775125909cce3e54b81ca81b8e70be09d29ce581a7f25afadef9debbca680ea6a76c59257ad5cde7167b63282c90c448
SSDEEP 12288:TqyRLu5aCWoevfZ1PUxHmA7QGbdQ94c54e08MGHxBjvrEH7D:T3GeAxHmA7QGUF54e08MGPrEH7D
TLSH
T139B48D2072D0D276E5E21270BE7DDB3A1879B869173501CBB3E00DAE2EB95D15B3172B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-14_81097032cdaee2ec95ab2cc0c8e37e2c_elex_floxif_mafia_tofsee

File Explorer

2026-08-14_81097032cdaee2ec95ab2cc0c8e37e2c_elex_floxif_mafia_tofsee

.exe 519KB

2026-08-14_81097032cdaee2ec95ab2cc0c8e37e2c_elex_floxif_mafia_tofsee

IMPHASH b8086f6290816fb617f882601f009ecd
SHA256 2fcedaf72b1d183a3c828c90a4c78cbef8faf1e2ef95374986b5f9748ee21312
MD5 81097032cdaee2ec95ab2cc0c8e37e2c
SHA1 5080a016719045e1e43e177921d010a485225f63
SHA512 9181f6523aea1df8ac19cfce205ce29d775125909cce3e54b81ca81b8e70be09d29ce581a7f25afadef9debbca680ea6a76c59257ad5cde7167b63282c90c448
SSDEEP 12288:TqyRLu5aCWoevfZ1PUxHmA7QGbdQ94c54e08MGHxBjvrEH7D:T3GeAxHmA7QGUF54e08MGPrEH7D
TLSH
T139B48D2072D0D276E5E21270BE7DDB3A1879B869173501CBB3E00DAE2EB95D15B3172B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0f:29:c9:2f:ae:8b:a8:77:09:3e:3a:f9:a9:fb:3a:2e:09:a8:bc:39

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Helge Klein GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Helge Klein GmbH,L=Köln,ST=Nordrhein-Westfalen,C=DE

Chains

Sep 10, 2012

CN=Helge Klein GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Helge Klein GmbH,L=Köln,ST=Nordrhein-Westfalen,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Helge Klein GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Helge Klein GmbH,L=Köln,ST=Nordrhein-Westfalen,C=DE

Serial Number

27:a9:04:54:92:bc:c8:64:10:a5:a3:0b:f5:34:1a:e8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 8, 2012 - Mar 8, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

224433

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Daten\Helge\Programmierung\SetACL3\Source\SetACL.exe\Win32\Release\SetACL.pdb

secur32

GetUserNameExW

version

VerQueryValueW

activeds

ord13

kernel32

FindClose CreateFileW InterlockedIncrement WideCharToMultiByte InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep GetCommandLineW HeapSetInformation RtlUnwind RaiseException GetCPInfo LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError FindFirstFileW IsProcessorFeaturePresent HeapCreate GetStdHandle GetLocaleInfoW ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc CompareStringW SetEnvironmentVariableW SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle WriteConsoleW SetEndOfFile ReadFile SetEvent ResetEvent ReleaseMutex CreateEventW CreateMutexW FindNextFileW MoveFileExW WriteFile SetFilePointerEx GetFileSizeEx GetCurrentThreadId GetLocalTime WaitForSingleObject CreateThread CompareFileTime LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FreeLibrary LocalFree FormatMessageW LoadLibraryExW InterlockedDecrement LoadLibraryW GetModuleFileNameW GetVersionExW GetComputerNameW FreeResource GetUserDefaultLangID LockResource LoadResource FindResourceW HeapFree GetProcessHeap HeapAlloc CloseHandle GetCurrentProcess GetProcAddress GetLastError GetModuleHandleW CreateDirectoryW GetFileAttributesW DeleteFileW

user32

LoadStringW

advapi32

LookupAccountNameW ConvertSidToStringSidW LookupAccountSidW MapGenericMask GetSecurityDescriptorLength AddAccessAllowedAce AddAce InitializeAcl IsValidAcl DeleteAce MakeSelfRelativeSD SetSecurityDescriptorSacl SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetNamedSecurityInfoW SetSecurityInfo IsValidSecurityDescriptor GetNamedSecurityInfoW GetKernelObjectSecurity ConvertStringSidToSidW EqualSid GetAce GetAclInformation ConvertSecurityDescriptorToStringSecurityDescriptorW GetSecurityDescriptorControl SetEntriesInAclW RegCreateKeyExW MakeAbsoluteSD ConvertStringSecurityDescriptorToSecurityDescriptorW ReportEventW DeregisterEventSource RegisterEventSourceW RegCloseKey RegOpenKeyExW RegConnectRegistryW RegEnumKeyExW CopySid GetLengthSid IsValidSid GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

ole32

CoCreateInstance CoInitialize CoInitializeSecurity CoUninitialize CoSetProxyBlanket CoQueryProxyBlanket

oleaut32

SysAllocStringLen SafeArrayGetUBound SafeArrayGetLBound VariantClear VariantInit SysStringByteLen SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate SysAllocString SysFreeString SysAllocStringByteLen

netapi32

DsGetDcNameW NetShareSetInfo NetApiBufferFree NetDfsGetClientInfo NetShareGetInfo

mpr

WNetCloseEnum WNetEnumResourceW WNetOpenEnumW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_81097032cdaee2ec95ab2cc0c8e37e2c_elex_floxif_mafia_tofsee

PE Signature issue

secur32

version

activeds

kernel32

user32

advapi32

ole32

oleaut32

netapi32

mpr

generic