2026-10-26_b1633e154a6ca01e57a3618534e5387a_elex_floxif_hijackloader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_b1633e154a6ca01e57a3618534e5387a_elex_floxif_hijackloader_stop
Size 636KB
Sample261027-k1l2wadb39
SHA256 85764770663f7a16231af51e0c1e5aa4579b4132745075cf6006e055ed63a159
MD5 b1633e154a6ca01e57a3618534e5387a
SHA1 345601275e739f70758b45aa3559b6addb00b244
SHA512 7f8a713bc41595e38accd38ae289981936ad9ab038f1d1efe7daa9e0cfe1de77cfc9a789446ca6c7cc5ddeb19ca059d7c4d42fb223998bbc34e631a862f945fb
SSDEEP 12288:7aCEDSQBF9QpXKtp7Rnn8AU+jAea+JRriaBE2BvLTfIMBjvrEH7d:z+S6vuuF8AU+jA+1SuvLrImrEH7d
TLSH
T143D47D0133D992A6F8723EF0397D462679FEB8285B3899DF63905D1D2D30A80DE7531A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-26_b1633e154a6ca01e57a3618534e5387a_elex_floxif_hijackloader_stop

File Explorer

2026-10-26_b1633e154a6ca01e57a3618534e5387a_elex_floxif_hijackloader_stop

.exe 636KB

2026-10-26_b1633e154a6ca01e57a3618534e5387a_elex_floxif_hijackloader_stop

IMPHASH e79dbe7a97b588f76231bd8174ab6d91
SHA256 85764770663f7a16231af51e0c1e5aa4579b4132745075cf6006e055ed63a159
MD5 b1633e154a6ca01e57a3618534e5387a
SHA1 345601275e739f70758b45aa3559b6addb00b244
SHA512 7f8a713bc41595e38accd38ae289981936ad9ab038f1d1efe7daa9e0cfe1de77cfc9a789446ca6c7cc5ddeb19ca059d7c4d42fb223998bbc34e631a862f945fb
SSDEEP 12288:7aCEDSQBF9QpXKtp7Rnn8AU+jAea+JRriaBE2BvLTfIMBjvrEH7d:z+S6vuuF8AU+jA+1SuvLrImrEH7d
TLSH
T143D47D0133D992A6F8723EF0397D462679FEB8285B3899DF63905D1D2D30A80DE7531A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

46:61:f8:51:da:ab:ce:cd:cc:04:97:a0:e5:9a:00:91:6d:36:94:be:6a:a8:25:13:bd:e5:e3:7b:db:1c:15:90

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=KYOCERA Document Solutions Inc.,O=KYOCERA Document Solutions Inc.,L=Osaka,ST=Osaka,C=JP

Chains

Sep 12, 2022

CN=KYOCERA Document Solutions Inc.,O=KYOCERA Document Solutions Inc.,L=Osaka,ST=Osaka,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=KYOCERA Document Solutions Inc.,O=KYOCERA Document Solutions Inc.,L=Osaka,ST=Osaka,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=KYOCERA Document Solutions Inc.,O=KYOCERA Document Solutions Inc.,L=Osaka,ST=Osaka,C=JP

Serial Number

0a:b3:34:99:c5:a7:07:81:9d:a9:1e:40:18:8e:a3:59

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 10, 2021 - Nov 16, 2022

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

363576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VerSetConditionMask OutputDebugStringA GetLocalTime lstrcpyA OutputDebugStringW InterlockedDecrement WritePrivateProfileStringA GetPrivateProfileStringA GetWindowsDirectoryA GetShortPathNameA MoveFileExW GetTempFileNameW GetTimeZoneInformation GetSystemDirectoryA SetLastError GetModuleFileNameA HeapFree HeapAlloc GetProcessHeap LoadLibraryA lstrlenA SetEndOfFile InitializeCriticalSectionAndSpinCount VerifyVersionInfoW GetStringTypeW ExitThread GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle ExitProcess LCMapStringA GetStartupInfoA GetFileType GetStdHandle SetHandleCount LCMapStringW HeapReAlloc VirtualAlloc DeleteCriticalSection VirtualFree HeapCreate IsValidCodePage GetOEMCP GetCPInfo GetCurrentThreadId InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue IsDebuggerPresent SetUnhandledExceptionFilter SetFileTime GetFileAttributesW LocalFileTimeToFileTime SystemTimeToFileTime GetLocaleInfoA WideCharToMultiByte MultiByteToWideChar UnhandledExceptionFilter TerminateProcess GetStartupInfoW LeaveCriticalSection EnterCriticalSection GetConsoleMode GetConsoleCP RaiseException RtlUnwind GlobalAlloc GlobalFree OpenProcess FlushFileBuffers GetStringTypeA CreateThread CreateNamedPipeW DisconnectNamedPipe GetSystemWow64DirectoryW GetCurrentDirectoryW GetTempPathW GetLocaleInfoW GetModuleHandleA GetTickCount FormatMessageW lstrlenW LocalAlloc GetLastError GetFileInformationByHandle FileTimeToLocalFileTime CompareFileTime MoveFileW GetModuleHandleW LocalFree GetSystemWindowsDirectoryW CopyFileW SetFilePointer CreateFileA GetFileSize RemoveDirectoryW CreateProcessW GetExitCodeProcess GetFullPathNameW GetWindowsDirectoryW LoadLibraryW GetProcAddress FreeLibrary FindNextFileW CreateFileW CloseHandle ReadFile WriteFile GetModuleFileNameW GetCurrentProcess DeleteFileW CreateDirectoryW FindClose FindFirstFileW GetSystemDirectoryW GetACP GetVersionExW SetFileAttributesW Sleep HeapSize

user32

UpdateWindow wsprintfA SendMessageW GetWindowRect wsprintfW PostQuitMessage GetWindowLongW DefWindowProcW GetClientRect GetAncestor ShowWindow SetWindowLongW GetDC CreateWindowExW RegisterClassW LoadCursorW LoadIconW ReleaseDC DispatchMessageW DestroyWindow SendNotifyMessageW GetDesktopWindow PostMessageW GetWindowThreadProcessId TranslateMessage GetMessageW IsWindow SendMessageTimeoutW wvsprintfA GetDlgCtrlID GetClassNameA EnumWindows EnumChildWindows GetWindowTextW GetWindowTextA

gdi32

GetStockObject DeleteObject AddFontResourceW EnumFontFamiliesExW RemoveFontResourceW

winspool.drv

DeletePrinterConnectionW OpenPrinterW DeletePrinter ClosePrinter GetPrinterDriverDirectoryW DeleteMonitorW SetPrinterDataW EnumPrintersW AddMonitorW EnumPrinterDriversW AddPortW PrinterProperties DeletePortW GetPrinterW SetPrinterDataExW GetPrinterDataExW ord204 AddPrinterW SetPrinterW AddPrinterDriverW DeletePrinterDriverW DeletePrinterDriverExW EnumJobsW EnumMonitorsW AddPrinterConnectionW DocumentPropertiesW EnumPortsW

advapi32

RegQueryInfoKeyW QueryServiceStatus DeleteService CreateServiceW RegCreateKeyExW RegSetValueExW CryptReleaseContext RegOpenKeyExW RegQueryValueExW ControlService OpenServiceW QueryServiceConfigW StartServiceW OpenSCManagerW CloseServiceHandle RegConnectRegistryW RegCloseKey RegDeleteKeyW RegEnumValueW RegEnumKeyW RegDeleteValueW

shell32

SHGetSpecialFolderLocation SHGetSpecialFolderPathW SHGetPathFromIDListW SHGetMalloc SHChangeNotify

ole32

CoInitializeSecurity CoSetProxyBlanket CLSIDFromString CoInitializeEx CoUninitialize CoInitialize CoCreateInstance PropVariantClear

oleaut32

SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData VariantInit VariantClear SysFreeString SysAllocString

setupapi

SetupDiCreateDeviceInfoList SetupFindNextMatchLineW SetupIterateCabinetW SetupCopyOEMInfW SetupGetLineCountW SetupOpenInfFileW SetupCloseInfFile SetupGetLineByIndexW SetupOpenAppendInfFileW SetupGetIntField SetupFindFirstLineW SetupGetStringFieldW SetupDiRemoveDevice SetupDiGetINFClassW SetupDiGetDeviceRegistryPropertyW SetupDiCreateDeviceInfoW SetupDiCallClassInstaller SetupDiGetDeviceInstanceIdW SetupDiOpenDevRegKey SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsExW SetupDiSetDeviceRegistryPropertyW SetupDiDeleteDeviceInfo

crypt32

CertCloseStore CertAddCertificateContextToStore CertOpenStore CertGetNameStringW CertEnumCertificatesInStore CryptAcquireCertificatePrivateKey

mscms

GetColorDirectoryW

lz32

LZOpenFileW LZClose LZCopy

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_b1633e154a6ca01e57a3618534e5387a_elex_floxif_hijackloader_stop

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

setupapi

crypt32

mscms

lz32

version

generic