2026-08-21_c97df535237c15f4e2497cbefb5d1cc7_elex_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_c97df535237c15f4e2497cbefb5d1cc7_elex_stop
Size 230KB
Sample260821-l5ghmaxflc
SHA256 568299032de7817febd864ad8a967eee28870c24025dfacfc9fff4c169f31d33
MD5 c97df535237c15f4e2497cbefb5d1cc7
SHA1 fed56adf03c0ba6ff310cec8eebaab2c53f346f9
SHA512 b27587535608bdfde5c9b2df67134b47da7d57947dba6b05739cc42d06e2ca92ff08e9d853983f448786edf4eac7508eec954d6906e2b64dd3d8ace73d9427be
SSDEEP 3072:lBRad1RPutM0gFQX4Am9AMZaeG/o1NWfLhY59cMvORsAg9sf9Vf5fZDH:l0utM0SI4Am9t++AfLhY7cIArVpBH
TLSH
T1A4346C117750C432E59305B68ABEC7BE997AB8311B5A50C3F3D40E7D9F607E2BA3124A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-08-21_c97df535237c15f4e2497cbefb5d1cc7_elex_stop

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-21_c97df535237c15f4e2497cbefb5d1cc7_elex_stop

File Explorer

2026-08-21_c97df535237c15f4e2497cbefb5d1cc7_elex_stop

.exe 230KB

2026-08-21_c97df535237c15f4e2497cbefb5d1cc7_elex_stop

IMPHASH 8298d686477a37226fc2c7f53787013e
SHA256 568299032de7817febd864ad8a967eee28870c24025dfacfc9fff4c169f31d33
MD5 c97df535237c15f4e2497cbefb5d1cc7
SHA1 fed56adf03c0ba6ff310cec8eebaab2c53f346f9
SHA512 b27587535608bdfde5c9b2df67134b47da7d57947dba6b05739cc42d06e2ca92ff08e9d853983f448786edf4eac7508eec954d6906e2b64dd3d8ace73d9427be
SSDEEP 3072:lBRad1RPutM0gFQX4Am9AMZaeG/o1NWfLhY59cMvORsAg9sf9Vf5fZDH:l0utM0SI4Am9t++AfLhY7cIArVpBH
TLSH
T1A4346C117750C432E59305B68ABEC7BE997AB8311B5A50C3F3D40E7D9F607E2BA3124A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

af:38:d1:d2:8b:9d:9a:d1:9e:9c:42:b6:7f:f7:a7:53:0a:47:9d:e5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=SHANGHAI FENGHAN NETWORK INFORMATION TECHNOLOGY STUDIO,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=SHANGHAI FENGHAN NETWORK INFORMATION TECHNOLOGY STUDIO,L=Shanghai,ST=Shanghai,C=CN

Chains

Aug 24, 2015

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 5, 2015 - Dec 31, 2015

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

Serial Number

69:4e:2e:0e:ce:ca:0c:14:10:ec:75:53:24:f4:d4:46

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Apr 7, 2014

Timespan

Apr 7, 2014 - Apr 6, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

78290

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathFileExistsW

kernel32

GetCurrentThreadId CreateFileW GetModuleFileNameW GetProcAddress LoadLibraryW WriteProcessMemory VirtualProtect SetUnhandledExceptionFilter CreateDirectoryW MultiByteToWideChar WideCharToMultiByte GetTickCount GetWindowsDirectoryW CreateProcessW GetExitCodeProcess WaitForSingleObject GetLastError Process32NextW Process32FirstW CreateToolhelp32Snapshot GetCurrentProcessId GlobalAlloc OpenProcess MoveFileExW CopyFileW DeleteFileW GetTempPathW LocalFree FormatMessageW ReadFile GetFileSize lstrcpyW CreateMutexW ReleaseMutex CompareStringW CompareStringA GetProcessHeap SetEndOfFile CreateFileA WriteConsoleW GetCurrentProcess CloseHandle FreeLibrary GetVersionExW FindResourceW LoadResource LockResource SizeofResource SetEnvironmentVariableA GlobalFree IsDebuggerPresent GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle RtlUnwind RaiseException TerminateProcess UnhandledExceptionFilter GetModuleHandleA GetSystemTimeAsFileTime MoveFileW InterlockedIncrement InterlockedDecrement GetStartupInfoW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapFree HeapAlloc Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation LCMapStringW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter VirtualAlloc HeapReAlloc SetFilePointer LoadLibraryA InitializeCriticalSectionAndSpinCount GetLocaleInfoW LCMapStringA

user32

FindWindowW GetDesktopWindow GetWindowRect SystemParametersInfoW CharLowerBuffW

advapi32

RegSetValueExW OpenProcessToken InitializeSecurityDescriptor SetSecurityDescriptorDacl DuplicateTokenEx CreateProcessAsUserW RegOpenKeyExW RegQueryValueExW RegCloseKey RegCreateKeyExA

shell32

ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_c97df535237c15f4e2497cbefb5d1cc7_elex_stop

PE Signature issue

shlwapi

kernel32

user32

advapi32

shell32

generic