2026-09-29_3f236eb12d69f09f5983b04c4248998c_elex_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_3f236eb12d69f09f5983b04c4248998c_elex_maze
Size 1.9MB
Sample260930-c4mtks1bqd
SHA256 9f00c8a9d827ec704b9bf30a26372c739bea9ff600716b0ec48424150f6e9087
MD5 3f236eb12d69f09f5983b04c4248998c
SHA1 9f76efacd3ac75417cb9dfc535790ad777801406
SHA512 f79cf5731fbd54c500d9f1c343b178b5d293721dfbad725e33988598b4398c2766599a1e3a26049c8617c30ad5120458af6f8d18ecaa3796661c45965dbc60c9
SSDEEP 24576:puBB6Tzwt+1fJ4yL/tNCJPXUQrP17LcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:NTzoEfJ4klKXn90kYej15VHW
TLSH
T14A95BE36D7B8B1DCF41809B8F920DC809374EEAE835CD4976561B586B9B7BC77234882
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_3f236eb12d69f09f5983b04c4248998c_elex_maze

File Explorer

2026-09-29_3f236eb12d69f09f5983b04c4248998c_elex_maze

.exe 1.9MB

2026-09-29_3f236eb12d69f09f5983b04c4248998c_elex_maze

IMPHASH e4e0c72aa5aa242f383b548b27453e9c
SHA256 9f00c8a9d827ec704b9bf30a26372c739bea9ff600716b0ec48424150f6e9087
MD5 3f236eb12d69f09f5983b04c4248998c
SHA1 9f76efacd3ac75417cb9dfc535790ad777801406
SHA512 f79cf5731fbd54c500d9f1c343b178b5d293721dfbad725e33988598b4398c2766599a1e3a26049c8617c30ad5120458af6f8d18ecaa3796661c45965dbc60c9
SSDEEP 24576:puBB6Tzwt+1fJ4yL/tNCJPXUQrP17LcvQ/asw4NdIeJkmUje1wUEyBUsyJP4jtk:NTzoEfJ4klKXn90kYej15VHW
TLSH
T14A95BE36D7B8B1DCF41809B8F920DC809374EEAE835CD4976561B586B9B7BC77234882
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74356

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\workspace\WINDOWSSRF_f1c8edf8-0669-4381-a8c2-e586414c7469\Source\output\bin\Release\Win32\SkinInstaller.pdb

winmm

timeGetTime

kernel32

WideCharToMultiByte WriteFile FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress QueryPerformanceCounter InterlockedCompareExchange GetSystemTimeAsFileTime SystemTimeToFileTime SetFilePointer OutputDebugStringA SetLastError ReleaseMutex CreateMutexW CreateProcessW GetTickCount GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW GetCurrentDirectoryW GetFileAttributesW ReadFile UnmapViewOfFile IsDebuggerPresent Sleep GetCurrentThreadId EnterCriticalSection GetVersionExW GetNativeSystemInfo GetModuleHandleW DuplicateHandle GetCurrentProcess InterlockedExchangeAdd SetFileTime SetUnhandledExceptionFilter TlsGetValue TlsSetValue CloseHandle GetFileAttributesA GetModuleFileNameA GetCurrentProcessId GetCommandLineW LocalFree MultiByteToWideChar CopyFileW CreateDirectoryW GetTempPathW GetPrivateProfileSectionNamesW WritePrivateProfileStringW WaitForSingleObject DeleteCriticalSection CreateFileW InitializeCriticalSectionAndSpinCount GetLastError DecodePointer LeaveCriticalSection DosDateTimeToFileTime GetFileType IsProcessorFeaturePresent EncodePointer OutputDebugStringW

user32

PostMessageW wsprintfW FindWindowW MessageBoxW

shell32

SHGetFolderPathW CommandLineToArgvW

msvcp120

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ?_Winerror_map@std@@YAPBDH@Z ?_Orphan_all@_Container_base0@std@@QAEXXZ ?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z ?good@ios_base@std@@QBE_NXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBE_JXZ ?width@ios_base@std@@QAE_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_BADOFF@std@@3_JB ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Orphan_all@_Container_base12@std@@QAEXXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ

msvcr120

wcsncpy wcsstr calloc _gmtime64 ??3@YAXPAX@Z _purecall ??2@YAPAXI@Z wcschr wcsncat memmove free ??_V@YAXPAX@Z _CxxThrowException __CxxFrameHandler3 memcpy memset strrchr malloc strncat abort realloc strlen wcslen ldiv wcscat_s wcsrchr __iob_func fflush fprintf _localtime64_s _time64 tolower _wfullpath _exit ?terminate@@YAXXZ _lock _unlock _calloc_crt __dllonexit _onexit ??1type_info@@UAE@XZ _XcptFilter __crtGetShowWindowMode _amsg_exit __getmainargs __set_app_type exit _cexit _ismbblead _configthreadlocale __setusermatherr _initterm_e _initterm _acmdln _fmode _commode _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _except1 _except_handler4_common __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s

imm32

ImmDisableIME

Name

.text

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

447KB

Virtual Size

447KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_3f236eb12d69f09f5983b04c4248998c_elex_maze

winmm

kernel32

user32

shell32

msvcp120

msvcr120

imm32

generic