2026-10-25_acf2be0e2a4623e0e6d646706cb684b3_elex_maze_metamorfo

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_acf2be0e2a4623e0e6d646706cb684b3_elex_maze_metamorfo
Size 1.1MB
Sample261026-tsjffse15w
SHA256 cef17f0fe1cd8b6126623f5e2a38b2046fdfb6cce30ef35d480259d266dface2
MD5 acf2be0e2a4623e0e6d646706cb684b3
SHA1 383f97ca43e355b3b3667dc0dbe39228caf10ad8
SHA512 3395a5975444d54f0dcf59f274773a7dac571615d71408a2d237a9d32b67bdabb470a5da23d4bbac70d26918d8e239058a780b230d209a9f76969af4b1f43add
SSDEEP 24576:RIUUKvAnq9TRgSZ9iF8FiDvvYpGRGV/QT7TLTWHYw90:5vcq9Tu7zQ8GtQTbTWHJ
TLSH
T13045F110FB01C176E59602B1AE79EB7A412DA6354B6655C7F3C42BAE2C206D31F32F87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_acf2be0e2a4623e0e6d646706cb684b3_elex_maze_metamorfo

File Explorer

2026-10-25_acf2be0e2a4623e0e6d646706cb684b3_elex_maze_metamorfo

.exe 1.1MB

2026-10-25_acf2be0e2a4623e0e6d646706cb684b3_elex_maze_metamorfo

IMPHASH 5afff36c96e38c2019cd1cc929959d9b
SHA256 cef17f0fe1cd8b6126623f5e2a38b2046fdfb6cce30ef35d480259d266dface2
MD5 acf2be0e2a4623e0e6d646706cb684b3
SHA1 383f97ca43e355b3b3667dc0dbe39228caf10ad8
SHA512 3395a5975444d54f0dcf59f274773a7dac571615d71408a2d237a9d32b67bdabb470a5da23d4bbac70d26918d8e239058a780b230d209a9f76969af4b1f43add
SSDEEP 24576:RIUUKvAnq9TRgSZ9iF8FiDvvYpGRGV/QT7TLTWHYw90:5vcq9Tu7zQ8GtQTbTWHJ
TLSH
T13045F110FB01C176E59602B1AE79EB7A412DA6354B6655C7F3C42BAE2C206D31F32F87
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

252135

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

I:\build\trunk_cn_9.0build\simulator\bin\bugreport.pdb

kernel32

MultiByteToWideChar GlobalAlloc GlobalLock GlobalUnlock FlushInstructionCache GetCurrentProcess ExitProcess SetLastError MulDiv lstrcmpW CreateProcessW GlobalMemoryStatus OpenProcess ReadProcessMemory SetEvent FindClose GetLocalTime GetSystemInfo GetDriveTypeW FindFirstFileW GetComputerNameA LoadLibraryW GetCurrentProcessId SetUnhandledExceptionFilter lstrlenW FindResourceW lstrcpynW GetVersionExW WideCharToMultiByte GetFileTime FileTimeToSystemTime OutputDebugStringW HeapAlloc HeapFree GetProcessHeap InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree EncodePointer QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetModuleFileNameW LoadLibraryExW lstrcmpiW SizeofResource LoadResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetLastError GetCurrentThreadId RaiseException GetProcAddress FreeLibrary InterlockedDecrement InterlockedIncrement DecodePointer CreateFileW CreateDirectoryW GetTempPathW CloseHandle SetFilePointer ReadFile WriteFile GetFileSize IsDebuggerPresent

user32

DestroyWindow CharNextW RegisterWindowMessageW SendMessageW CallWindowProcW RegisterClassExW GetClassInfoExW UnregisterClassW IsWindow IsChild ShowWindow MoveWindow SetWindowPos GetDlgItem SetDlgItemTextW GetDlgItemTextW CheckDlgButton IsDlgButtonChecked DefWindowProcW CreateWindowExW DestroyCursor PtInRect SetCursor DrawTextW CreateDialogParamW PeekMessageW DispatchMessageW TranslateMessage GetMessageW GetMonitorInfoW MonitorFromWindow IsDialogMessageW LoadImageW LoadCursorW GetWindow GetDlgCtrlID GetParent GetDesktopWindow SetWindowLongW GetWindowLongW FillRect GetSysColor MapWindowPoints ScreenToClient ClientToScreen GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC GetSystemMetrics DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus GetClassNameW

gdi32

SetBkMode GetTextExtentPoint32W CreateFontIndirectW GetObjectW SelectObject GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreateCompatibleDC SetTextColor BitBlt CreateCompatibleBitmap

advapi32

RegOpenKeyExW GetUserNameA RegSetValueExW RegQueryInfoKeyW RegCloseKey RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW

shell32

ShellExecuteW

ole32

CoTaskMemFree CoGetClassObject CLSIDFromString CLSIDFromProgID StringFromGUID2 OleInitialize OleUninitialize OleLockRunning CreateStreamOnHGlobal CoCreateInstance CoUninitialize CoInitialize CoTaskMemAlloc CoInitializeEx CoTaskMemRealloc

oleaut32

VariantInit VariantClear LoadTypeLi LoadRegTypeLi OleCreateFontIndirect SafeArrayDestroy VarUI4FromStr SysAllocString SysAllocStringLen SysFreeString SysStringLen SafeArrayCreate SafeArrayAccessData

comctl32

InitCommonControlsEx

msvcp120

?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Thrd_current ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Xtime_get_ticks ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z ?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z _Cnd_signal ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ ?_Release@_Pad@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?id@?$collate@D@std@@2V0locale@2@A ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ??_7facet@locale@std@@6B@ ??_7_Facet_base@std@@6B@ ?_Incref@facet@locale@std@@UAEXXZ ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Orphan_all@_Container_base0@std@@QAEXXZ ??0id@locale@std@@QAE@I@Z ?_Syserror_map@std@@YAPBDH@Z ?_Winerror_map@std@@YAPBDH@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ??Bid@locale@std@@QAEIXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Future_error_map@std@@YAPBDH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_BADOFF@std@@3_JB ?id@?$codecvt@DDH@std@@2V0locale@2@A _Cnd_init _Mtx_unlock _Mtx_lock _Mtx_destroy _Mtx_init ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??_7ios_base@std@@6B@ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ?uncaught_exception@std@@YA_NXZ _Mtx_current_owns _Cnd_timedwait ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_detach _Thrd_join _Thrd_equal ??0_Pad@std@@QAE@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ??1_Pad@std@@QAE@XZ _Cnd_destroy _Cnd_wait ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?_Throw_C_error@std@@YAXH@Z ?_Xbad_function_call@std@@YAXXZ _Getcoll _Strcoll _Strxfrm ??0_Locinfo@std@@QAE@PBD@Z ??1_Locinfo@std@@QAE@XZ ??0facet@locale@std@@IAE@I@Z ?classic@locale@std@@SAABV12@XZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?tolower@?$ctype@D@std@@QBEDD@Z

msvcr120

ungetc _lock_file _unlock_file ??0bad_cast@std@@QAE@PBD@Z ??0bad_cast@std@@QAE@ABV01@@Z ??0exception@std@@QAE@ABV01@@Z ??1bad_cast@std@@UAE@XZ isdigit isalnum ferror fopen fread _ftelli64 rand srand exit memchr atoll strtoull sscanf realloc isspace _gmtime64_s _mkgmtime64 atoi strncmp getenv _localtime64_s isalpha ?terminate@@YAXXZ _lock _unlock _calloc_crt __dllonexit _onexit _crt_debugger_hook __crtUnhandledException __crtTerminateProcess ??1type_info@@UAE@XZ _except_handler4_common _XcptFilter __crtGetShowWindowMode _amsg_exit __wgetmainargs __set_app_type _exit _cexit _configthreadlocale __setusermatherr _initterm_e _initterm _wcmdln _fmode _commode _except1 _vsnprintf_s __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s fwrite _fseeki64 fsetpos fputc fgetpos fgetc fflush fclose tolower _snwprintf _localtime64 strftime sprintf_s wcsftime wcsrchr strrchr _snprintf_s swprintf_s memmove_s _purecall wcsncpy_s memcpy_s _recalloc malloc free memset memcpy __CxxFrameHandler3 _CxxThrowException _time64 _snwprintf_s wcsstr wcsncat_s wcschr strstr strchr memmove ??_V@YAXPAX@Z _wcstoi64 wcstoul ??2@YAPAXI@Z ??3@YAXPAX@Z setvbuf

ws2_32

WSAStartup

psapi

GetProcessMemoryInfo

libcurl

curl_slist_append curl_slist_free_all curl_easy_strerror curl_easy_init curl_global_cleanup curl_easy_perform curl_easy_cleanup curl_easy_getinfo curl_easy_reset curl_easy_setopt curl_global_init

libeay32

ord333 ord323 ord270 ord2936 ord269 ord3109 ord3883 ord2925 ord962 ord2712 ord2630

generic

count=6, id=199, version=41118,

count=8, id=223, productName=VS2013 build 21005, version=21005,

count=21, id=224, productName=VS2013 build 21005, version=21005,

count=4, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=4, id=221, productName=VS2013 build 21005, version=21005,

count=12, id=225, productName=VS2013 build 21005, version=21005,

count=3, id=225, version=20806,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=551, id=1, productName=Unmarked objects,

count=146, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=20, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,