2026-09-16_a0eeba8f5d39b7408428aa4d92288970_elex_floxif_hijackloader_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_a0eeba8f5d39b7408428aa4d92288970_elex_floxif_hijackloader_wannacry
Size 10.0MB
Sample260916-xbl2ssce49
SHA256 d3572b0ea056a7699511a3b8228a460435aed6636d7edaaaafc06044c6559dde
MD5 a0eeba8f5d39b7408428aa4d92288970
SHA1 0ef595ded91f3e3ca82aeb5a8c953593336ee7cf
SHA512 33cbba2e797c3a0f97aa5fd42a12e1f4eb5965f97ce3f79b1712c0ede4e725b335c2717f0a1f0a7b122a797812a00dafc81944798eb14c9787a9153ae3cab9c3
SSDEEP 196608:uddhRkwrklyX8vEj8yRBQwp9A2glmQ5joZ+7PWEGT+21d/281SONxQhZual5y4ca:WdDhV8i8ygwp9fglmSjtODd/2UtjQHue
TLSH
T185B6335036C09BF9F30E0933A5147861A2E19198896FA9FB877456349E7FB0583BF07B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_a0eeba8f5d39b7408428aa4d92288970_elex_floxif_hijackloader_wannacry

File Explorer

2026-09-16_a0eeba8f5d39b7408428aa4d92288970_elex_floxif_hijackloader_wannacry

.exe 10.0MB

2026-09-16_a0eeba8f5d39b7408428aa4d92288970_elex_floxif_hijackloader_wannacry

IMPHASH 12f12d364f5f6a801e52c9dce28d1965
SHA256 d3572b0ea056a7699511a3b8228a460435aed6636d7edaaaafc06044c6559dde
MD5 a0eeba8f5d39b7408428aa4d92288970
SHA1 0ef595ded91f3e3ca82aeb5a8c953593336ee7cf
SHA512 33cbba2e797c3a0f97aa5fd42a12e1f4eb5965f97ce3f79b1712c0ede4e725b335c2717f0a1f0a7b122a797812a00dafc81944798eb14c9787a9153ae3cab9c3
SSDEEP 196608:uddhRkwrklyX8vEj8yRBQwp9A2glmQ5joZ+7PWEGT+21d/281SONxQhZual5y4ca:WdDhV8i8ygwp9fglmSjtODd/2UtjQHue
TLSH
T185B6335036C09BF9F30E0933A5147861A2E19198896FA9FB877456349E7FB0583BF07B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

9c:bb:7a:e3:07:64:cb:a1:9f:13:6e:87:72:4a:7f:e2:e0:13:1b:69:10:79:0f:a9:a8:14:72:a3:8c:a5:72:0a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-0219471,CN=KOSCOM CORP.,O=KOSCOM CORP.,L=Yeongdeungpo-gu,ST=Seoul,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130553656f756c,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Feb 16, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

c6:82:48:fe:25:3f:1d:40:16:e9:dc:da:f2:41:ea:6d:38:b7:b7:48

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Feb 16, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0b:03:61:83:27:11:ba:d7:b7:c6:46:d1:52:b1:bd:9e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 18, 2023 - Jul 20, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

79676

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

VariantClear SysAllocString

user32

SendMessageA SetTimer KillTimer DialogBoxParamA SetWindowLongA GetWindowLongA SetWindowTextW SetWindowTextA LoadIconA LoadStringW LoadStringA CharUpperW CharUpperA DestroyWindow EndDialog PostMessageA ShowWindow MessageBoxW GetDlgItem DialogBoxParamW

shell32

ShellExecuteExA

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit ??1type_info@@UAE@XZ _except_handler3 _beginthreadex memcpy free malloc _CxxThrowException _purecall memmove __CxxFrameHandler memcmp

kernel32

GetCommandLineW GetStartupInfoA GetModuleHandleA InitializeCriticalSection ResetEvent SetEvent CreateEventA VirtualFree VirtualAlloc Sleep WaitForMultipleObjects GetStdHandle SetEndOfFile WriteFile ReadFile SetFilePointer GetFileSize CreateFileA FindNextFileA FindFirstFileW FindFirstFileA FindClose GetTempFileNameA GetTempPathA GetCurrentDirectoryA GetFullPathNameW GetFullPathNameA lstrlenA DeleteFileW DeleteFileA CreateDirectoryW CreateDirectoryA RemoveDirectoryW SetFileAttributesW RemoveDirectoryA SetFileAttributesA SetLastError CreateFileW SetFileTime GetWindowsDirectoryA FormatMessageW FormatMessageA LocalFree GetModuleFileNameW GetModuleFileNameA AreFileApisANSI GetLastError WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection WaitForSingleObject CloseHandle CreateProcessA SetCurrentDirectoryA GetVersionExA LeaveCriticalSection EnterCriticalSection

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_a0eeba8f5d39b7408428aa4d92288970_elex_floxif_hijackloader_wannacry

PE Signature issue

PE Signature issue

oleaut32

user32

shell32

msvcrt

kernel32

generic