2026-10-30_ceb59f87b7d1384d515d439e9d23f70b_elex_floxif_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_ceb59f87b7d1384d515d439e9d23f70b_elex_floxif_mafia
Size 339KB
Sample261030-t2rs7afa34
SHA256 b89a90330c29f3361bcd329879ce60fe87329aa106732850d9867f2c8d12714c
MD5 ceb59f87b7d1384d515d439e9d23f70b
SHA1 1fdca8cf0ebb0f3b798b325d71e372eac20ddd14
SHA512 4dd8ad93b5a5b54c65a9c9226050a7b84f51bf4b2c9c41dccc10a6c797cf13cb07a6f5675f069cfab2799e68249bddf2d9e5f59e2a23559832da440c291fb28a
SSDEEP 6144:sUSQ/BVgIw841R4+qGA9HYpFOXDm3/ruhwIBV+UdvrEFp7hK1:sUSQ/BeIw824+fA9cFADfwIBjvrEH7q
TLSH
T19D74BE203390C7F6D1931034B5A987AA5AFABC3E0B6641C7E7943A7D4E7C6D3967430A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-30_ceb59f87b7d1384d515d439e9d23f70b_elex_floxif_mafia

File Explorer

2026-10-30_ceb59f87b7d1384d515d439e9d23f70b_elex_floxif_mafia

.exe 339KB

2026-10-30_ceb59f87b7d1384d515d439e9d23f70b_elex_floxif_mafia

IMPHASH 416333ed07e4ed6742e90b5c6a8f2c8d
SHA256 b89a90330c29f3361bcd329879ce60fe87329aa106732850d9867f2c8d12714c
MD5 ceb59f87b7d1384d515d439e9d23f70b
SHA1 1fdca8cf0ebb0f3b798b325d71e372eac20ddd14
SHA512 4dd8ad93b5a5b54c65a9c9226050a7b84f51bf4b2c9c41dccc10a6c797cf13cb07a6f5675f069cfab2799e68249bddf2d9e5f59e2a23559832da440c291fb28a
SSDEEP 6144:sUSQ/BVgIw841R4+qGA9HYpFOXDm3/ruhwIBV+UdvrEFp7hK1:sUSQ/BeIw824+fA9cFADfwIBjvrEH7q
TLSH
T19D74BE203390C7F6D1931034B5A987AA5AFABC3E0B6641C7E7943A7D4E7C6D3967430A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a4:fc:28:0b:7c:a4:c0:75:7e:68:2a:44:d7:fe:b3:88:0f:e4:83:b6:da:c0:d7:5a:31:22:bd:da:6d:ee:05:7a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Chains

Apr 2, 2020

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

39:4a:d6:b6:62:a5:a1:21:91:3e:71:d8:7a:35:4b:5c:70:41:6d:4a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Chains

Apr 2, 2020

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Serial Number

0a:9f:96:aa:bf:b5:da:c0:f2:9f:56:5d:33:ff:1a:f6

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 27, 2020 - Apr 11, 2022

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Wondershare Technology Co.\,Ltd,OU=RD,O=Wondershare Technology Co.\,Ltd,L=拉萨市,ST=西藏自治区,C=CN

Serial Number

07:bc:d7:f9:30:84:77:c3:84:6b:c9:54:78:fa:65:68

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 27, 2020 - Apr 11, 2022

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

84773

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jenkins\workspace\DFAppFoundation\drfonetoolkit\ModuleUpgrade\SharpUpgrade\Release\InstallAssistService.pdb

kernel32

MultiByteToWideChar WideCharToMultiByte GetModuleFileNameW Sleep WTSGetActiveConsoleSessionId OpenProcess GetCurrentThread GetCurrentProcess CloseHandle QueueUserWorkItem CreateEventW GetLastError SetEvent WaitForSingleObject CompareStringW GetProcessHeap SetEndOfFile CreateFileW CreateFileA WriteConsoleW SetStdHandle LoadLibraryW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapSize GetLocaleInfoW GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation FlushFileBuffers GetConsoleMode GetConsoleCP WriteFile SetFilePointer ReadFile InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapAlloc GetFileAttributesA CreateDirectoryA GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime GetCommandLineW HeapSetInformation RaiseException GetCPInfo RtlUnwind LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW HeapCreate ExitProcess SetEnvironmentVariableA

advapi32

GetTokenInformation ControlService QueryServiceStatus StartServiceW ChangeServiceConfig2W OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle CreateServiceW ReportEventW RegisterServiceCtrlHandlerW SetServiceStatus DeregisterEventSource StartServiceCtrlDispatcherW RegisterEventSourceW FreeSid AllocateAndInitializeSid OpenProcessToken OpenThreadToken EqualSid CreateProcessAsUserW SetTokenInformation DuplicateTokenEx

ole32

CoUninitialize CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

wtsapi32

WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

ws2_32

sendto bind socket closesocket setsockopt getsockname ntohs WSAStartup recvfrom htons htonl inet_addr

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_ceb59f87b7d1384d515d439e9d23f70b_elex_floxif_mafia

PE Signature issue

PE Signature issue

kernel32

advapi32

ole32

oleaut32

wtsapi32

userenv

ws2_32

generic