2026-11-01_caba65efa9375d8487befd92c7e259de_elex_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_caba65efa9375d8487befd92c7e259de_elex_stop
Size 11.0MB
Sample261102-kmfb6sty9k
SHA256 f700b7a7ace14717b78ffb328540ea01e2fe75b09c1c573014a3de83bbb171a9
MD5 caba65efa9375d8487befd92c7e259de
SHA1 501cdd65fcbcf6328f932ab72cfd913b078b5832
SHA512 0db14f48001f030f9c8d3259139889e6c9e7f4c8c4ce4eb68c39b7089bdee92ff972709ebb0fb72cba5d81acb544de2a18f391a38cc842ffbcd64b675c929fe0
SSDEEP 196608:onxCfr91JP/l5iwnbF3OoPNlqkUBg6FSLuEzB:onxCfLZ/5nbF3O6NlqkUBgBP
TLSH
T1AAC68D21FBDAC0B5EA87B1B946AFB32E5256E7881B2409D3D1143E0BDDA07F15E361C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_caba65efa9375d8487befd92c7e259de_elex_stop

File Explorer

2026-11-01_caba65efa9375d8487befd92c7e259de_elex_stop

.exe 11.0MB

2026-11-01_caba65efa9375d8487befd92c7e259de_elex_stop

IMPHASH d3a0e2ce263915eb6eab704932dcebb1
SHA256 f700b7a7ace14717b78ffb328540ea01e2fe75b09c1c573014a3de83bbb171a9
MD5 caba65efa9375d8487befd92c7e259de
SHA1 501cdd65fcbcf6328f932ab72cfd913b078b5832
SHA512 0db14f48001f030f9c8d3259139889e6c9e7f4c8c4ce4eb68c39b7089bdee92ff972709ebb0fb72cba5d81acb544de2a18f391a38cc842ffbcd64b675c929fe0
SSDEEP 196608:onxCfr91JP/l5iwnbF3OoPNlqkUBg6FSLuEzB:onxCfLZ/5nbF3O6NlqkUBgBP
TLSH
T1AAC68D21FBDAC0B5EA87B1B946AFB32E5256E7881B2409D3D1143E0BDDA07F15E361C1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9961318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\vss-od\Silkroad\Client\Out\SRO_Client.pdb

gdi32

CreateFontIndirectA SetTextColor SetBkMode SetPixel GetPixel SetDIBColorTable CreateCompatibleDC RealizePalette SelectPalette SetPaletteEntries GetTextMetricsA CreateDIBSection CreateFontA GetDeviceGammaRamp GetTextExtentPoint32W GetTextExtentPoint32A GetStockObject GetDIBits GetObjectA SetBkColor CreateSolidBrush RemoveFontResourceA AddFontResourceA BitBlt DeleteObject SetDeviceGammaRamp SelectObject CreatePalette GetGlyphOutlineW DeleteDC

advapi32

GetUserNameA OpenProcessToken GetTokenInformation EqualSid RegCloseKey RegSetValueExA RegCreateKeyExA FreeSid RegOpenKeyExA RegOpenKeyA RegQueryValueExA AllocateAndInitializeSid

user32

CloseClipboard GetClipboardData OpenClipboard IsClipboardFormatAvailable CreateWindowExA IsCharAlphaW IsCharAlphaNumericW SetCursorPos ScreenToClient GetCursorPos GetActiveWindow SetRect PostMessageA GetWindowThreadProcessId EndDialog SetWindowPos MessageBoxA GetWindowRect HideCaret GetKeyState SendMessageA GetWindow IsWindow FindWindowA SetFocus CallNextHookEx SetCursor GetWindowTextA wsprintfA DefWindowProcA PostQuitMessage ChangeDisplaySettingsA SystemParametersInfoA EnumDisplaySettingsA ClipCursor GetClassLongA ShowCaret SetMenu DestroyAcceleratorTable LoadMenuA RegisterClassA DestroyMenu GetIconInfo EnableWindow CheckRadioButton SetWindowTextA AppendMenuA CreatePopupMenu CreateMenu CharNextExA CallWindowProcA UnhookWindowsHookEx SetWindowLongA GetWindowLongA SetWindowsHookExA PtInRect AdjustWindowRect GetClientRect GetDesktopWindow RegisterClassExA LoadCursorA DestroyWindow LoadIconA ShowWindow DispatchMessageA TranslateMessage TranslateAcceleratorA GetMessageA PeekMessageA RegisterHotKey LoadAcceleratorsA SetForegroundWindow LoadStringA MoveWindow GetKeyboardLayout GetFocus GetMenu IsDlgButtonChecked GetDC ReleaseDC UpdateWindow MessageBoxW CharNextA CharNextW DialogBoxParamA GetSystemMetrics GetDlgItem SetWindowTextW

imm32

ImmGetCandidateWindow ImmSetConversionStatus ImmGetConversionStatus ImmNotifyIME ImmSetCandidateWindow ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmGetProperty ImmAssociateContext

kernel32

LCMapStringA GetTimeZoneInformation IsValidCodePage GetOEMCP GetCPInfo HeapSize LCMapStringW HeapCreate HeapDestroy HeapReAlloc VirtualAlloc VirtualFree FatalAppExitA SetHandleCount GetFileType GetConsoleCP GetConsoleMode SetConsoleCtrlHandler FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetStdHandle InterlockedExchange Sleep CloseHandle WriteFile CreateFileW ReadFile GetFileSize CreateFileA lstrlenA GetLastError InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetFilePointer WideCharToMultiByte InterlockedIncrement InterlockedDecrement ResetEvent CreateEventA DeleteFileA CreateDirectoryA SetCurrentDirectoryA MultiByteToWideChar SetEvent WaitForSingleObject CreateThread OutputDebugStringA GetTickCount GetModuleFileNameA VirtualQuery lstrcmpW GetACP GetVersion GlobalUnlock GlobalLock Beep GetProcAddress GetModuleHandleA CreateMutexA WinExec GetCurrentProcess GetCurrentProcessId GetLocalTime SetUnhandledExceptionFilter CompareStringA FindClose FindFirstFileA FileTimeToSystemTime FileTimeToLocalFileTime GetFileTime GetSystemDirectoryA FindNextFileA SetFileAttributesA GetCommandLineA FreeLibrary LoadLibraryA GetLocaleInfoA GetThreadLocale GetVersionExA lstrcmpA GetSystemInfo IsProcessorFeaturePresent MapViewOfFile CreateFileMappingA UnmapViewOfFile LockResource LoadResource SizeofResource FindResourceA FindResourceW GetFullPathNameA lstrcmpiA HeapAlloc GetProcessHeap HeapFree GetCurrentThread TlsFree TlsSetValue TlsAlloc TlsGetValue IsDebuggerPresent TerminateProcess GetStartupInfoA UnhandledExceptionFilter ExitProcess GetSystemTimeAsFileTime RaiseException RtlUnwind GlobalFree GlobalAlloc GlobalMemoryStatus SetLastError Process32First Process32Next CreateToolhelp32Snapshot Module32First Module32Next CopyFileA GetFileAttributesA GetCurrentDirectoryA QueryPerformanceCounter GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetLocaleInfoW SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile CompareStringW SetEnvironmentVariableA TerminateThread SetThreadPriority ExitThread lstrcpyA lstrcatA GetExitCodeThread VirtualProtect GetSystemDefaultLangID _lwrite QueryPerformanceFrequency MulDiv lstrcpynA ResumeThread GetWindowsDirectoryA SuspendThread CreateIoCompletionPort PostQueuedCompletionStatus GetQueuedCompletionStatus FlushViewOfFile ReleaseSemaphore SleepEx FlushInstructionCache GetCurrentThreadId

shell32

ShellExecuteW ShellExecuteA SHGetSpecialFolderPathA ExtractIconExA

wininet

InternetCloseHandle InternetGetLastResponseInfoA FtpSetCurrentDirectoryA FtpCreateDirectoryA FtpRemoveDirectoryA FtpDeleteFileA FtpRenameFileA InternetOpenA FtpOpenFileA FtpGetFileA FtpGetCurrentDirectoryA InternetFindNextFileA FtpFindFirstFileA DeleteUrlCacheEntry FtpPutFileA InternetCrackUrlA InternetConnectA InternetWriteFile

urlmon

URLDownloadToFileA

ws2_32

inet_ntoa WSAGetOverlappedResult gethostname WSAResetEvent WSAWaitForMultipleEvents gethostbyaddr ntohs inet_addr WSACleanup closesocket bind htonl htons socket WSACloseEvent WSARecvFrom WSASendTo WSAStartup getsockname select WSAGetLastError connect ioctlsocket send WSACreateEvent recvfrom gethostbyname sendto accept getpeername getsockopt WSASend listen WSASocketA shutdown WSAIoctl WSARecv setsockopt WSASetEvent

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

ddraw

DirectDrawCreateEx

iphlpapi

GetAdaptersInfo GetTcpTable

winmm

timeGetTime mmioAscend mmioRead mmioDescend mmioGetInfo mmioCreateChunk mmioSeek mmioSetInfo mmioAdvance mmioWrite mmioClose mmioOpenA timeSetEvent timeKillEvent

d3d9

Direct3DCreate9

ole32

CoCreateGuid CoUninitialize CoInitialize

dsound

ord11

generic

count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=36, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=126, version=50327,

count=67, id=125, productName=VS2005 build 50727, version=50727,

count=236, id=109, productName=VS2005 build 50727, version=50727,

count=21, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=98, id=114, version=50727,

count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=28, version=9178,

count=9, id=95, version=2067,

count=6, id=18, version=8444,

count=110, id=29, version=9178,

count=6, id=25, version=9210,

count=27, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=391, id=1, productName=Unmarked objects,

count=762, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=122, productName=VS2005 build 50727, version=50727,

count=1, id=124, productName=VS2005 build 50727, version=50727,

count=1, id=120, productName=VS2005 build 50727, version=50727,