2026-09-29_421159ae658fa347b34f6e06dce12e4c_elex_maze

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_421159ae658fa347b34f6e06dce12e4c_elex_maze
Size 1.5MB
Sample260930-cyabasvyft
SHA256 019ae4695ad5df8e682b6c050d28702de9a879b20729e618bad31280c5639d67
MD5 421159ae658fa347b34f6e06dce12e4c
SHA1 65c1dd197084094bab875d7db3c27415df959489
SHA512 5b5b75782febf039c314c054d3192488539f7124d932c60ec9c16dabb6694544c9aa478f8a03a3d7ed25931be3ad46354ab319be4f2e1143b8f2b9f08c3bd732
SSDEEP 24576:t9BJXrV5OTTE2joaKfJ4yL/tNCJPXUQrPkDwcvQ/asw4NdIeJkmUje1wUEyBUsyn:r2TE2jlKfJ4klKXnMDlkYej15VHW
TLSH
T18A7512219540C937DCF300F9D9EDA16C5228AB50235950E7F7C46D9AAFB95E33A30BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_421159ae658fa347b34f6e06dce12e4c_elex_maze

File Explorer

2026-09-29_421159ae658fa347b34f6e06dce12e4c_elex_maze

.exe 1.5MB

2026-09-29_421159ae658fa347b34f6e06dce12e4c_elex_maze

IMPHASH a9022dcfe29510e96e510914d2eea9f6
SHA256 019ae4695ad5df8e682b6c050d28702de9a879b20729e618bad31280c5639d67
MD5 421159ae658fa347b34f6e06dce12e4c
SHA1 65c1dd197084094bab875d7db3c27415df959489
SHA512 5b5b75782febf039c314c054d3192488539f7124d932c60ec9c16dabb6694544c9aa478f8a03a3d7ed25931be3ad46354ab319be4f2e1143b8f2b9f08c3bd732
SSDEEP 24576:t9BJXrV5OTTE2joaKfJ4yL/tNCJPXUQrPkDwcvQ/asw4NdIeJkmUje1wUEyBUsyn:r2TE2jlKfJ4klKXnMDlkYej15VHW
TLSH
T18A7512219540C937DCF300F9D9EDA16C5228AB50235950E7F7C46D9AAFB95E33A30BA2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

159985

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\jenkins\workspace\WINDOWSSRF_f1c8edf8-0669-4381-a8c2-e586414c7469\Source\output\bin\Release\Win32\iFlyPlatform.pdb

psapi

GetModuleFileNameExW

shlwapi

PathFindFileNameW PathRemoveExtensionW

winmm

timeGetTime

kernel32

ReleaseMutex GetFileAttributesW CreateDirectoryW CreateFileW OpenMutexW OpenEventW CreateMutexW CreateEventW CreateFileMappingW GetVersionExW LoadLibraryW FreeLibrary GetComputerNameW GetCurrentProcess CreateToolhelp32Snapshot OpenProcess CreateProcessW SizeofResource LockResource LoadResource FindResourceW FindResourceExW SetLastError GetModuleFileNameA GetFileAttributesA EnterCriticalSection LeaveCriticalSection MultiByteToWideChar WideCharToMultiByte GetLocalTime WriteFile GetModuleHandleA LoadLibraryA ResumeThread GetSystemTimeAsFileTime GetTickCount VirtualQueryEx QueryPerformanceCounter InterlockedCompareExchange InterlockedExchangeAdd SetFilePointer OutputDebugStringA GetNativeSystemInfo WaitForSingleObject IsDebuggerPresent GetSystemDirectoryW GetWindowsDirectoryW GetCurrentDirectoryW GetTempPathW MapViewOfFile UnmapViewOfFile TlsGetValue TlsSetValue Thread32Next SuspendThread OpenThread Thread32First IsProcessorFeaturePresent EncodePointer OutputDebugStringW ReadProcessMemory LoadLibraryExW GetThreadSelectorEntry GetThreadContext DecodePointer HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetProcAddress LocalFree GetCurrentThreadId SetEvent ResetEvent Sleep GetCurrentProcessId GetCommandLineW GetModuleHandleW GetModuleFileNameW CloseHandle SetUnhandledExceptionFilter

user32

CharNextW FindWindowW MessageBoxW CharUpperW PostThreadMessageW PostMessageW

advapi32

SetSecurityDescriptorDacl SetSecurityDescriptorSacl InitializeSecurityDescriptor GetSecurityDescriptorDacl GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW SetNamedSecurityInfoW SetEntriesInAclW BuildExplicitAccessWithNameW GetNamedSecurityInfoW RegQueryInfoKeyW RegOpenKeyExW RegDeleteKeyW RegCloseKey

shell32

SHGetFolderPathW CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize CoInitializeEx CoAddRefServerProcess CoReleaseServerProcess CoCreateInstance StringFromGUID2

oleaut32

SysAllocString SysFreeString LoadTypeLi RegisterTypeLi SysAllocStringLen UnRegisterTypeLi SysStringLen

msvcr120

fclose abort isspace realloc strlen wcslen __iob_func _exit memcmp _finite ldiv wcsrchr fflush fprintf _localtime64_s _time64 tolower _vsprintf_p _vscprintf_p floor _wfullpath strncmp _errno ?terminate@@YAXXZ _lock _unlock _calloc_crt __dllonexit _onexit ??1type_info@@UAE@XZ _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _XcptFilter __crtGetShowWindowMode _amsg_exit __wgetmainargs __set_app_type exit _cexit _configthreadlocale __setusermatherr _initterm_e _initterm _wcmdln _fmode _commode _except1 _except_handler4_common __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s fwrite fopen strncat _vscwprintf vswprintf_s strrchr memchr malloc wcsnlen _wcslwr_s memmove_s wcsncpy memcpy_s wmemcpy_s memset memcpy __CxxFrameHandler3 _CxxThrowException wcsncpy_s wcscpy_s wcscat_s strncpy memmove ??_U@YAPAXI@Z ??2@YAPAXI@Z _purecall ??_V@YAXPAX@Z free vsprintf_s sprintf _snprintf swprintf_s ??3@YAXPAX@Z

msvcp120

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_BADOFF@std@@3_JB ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?width@ios_base@std@@QAE_J_J@Z ?width@ios_base@std@@QBE_JXZ ?flags@ios_base@std@@QBEHXZ ?good@ios_base@std@@QBE_NXZ ?_Orphan_all@_Container_base12@std@@QAEXXZ ??1_Container_base12@std@@QAE@XZ ??0_Container_base12@std@@QAE@XZ ?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z ?_Orphan_all@_Container_base0@std@@QAEXXZ ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ

dbghelp

SymGetLineFromAddr SymFromAddr SymLoadModule64 SymUnloadModule64 SymSetOptions SymGetModuleBase MiniDumpWriteDump SymInitialize SymCleanup

Name

.text

Size

162KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=4, id=221, productName=VS2013 build 21005, version=21005,

count=12, id=223, productName=VS2013 build 21005, version=21005,

count=22, id=224, productName=VS2013 build 21005, version=21005,

count=8, id=225, productName=VS2013 build 21005, version=21005,

count=2, id=225, version=20806,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=185, version=30716,

count=6, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=257, version=27034,

count=505, id=1, productName=Unmarked objects,

count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=23, id=229, version=40629,

count=95, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,