2026-11-07_b1f00999c7c661002379f4a309519af5_elex_glassworm_hawkeye_maze

General

Target
2026-11-07_b1f00999c7c661002379f4a309519af5_elex_glassworm_hawkeye_maze
Size 1.3MB
Sample261107-m2579abs5w
SHA256 3f09790d5556e559674cb0aab39d47980aaadc2cf6551d38993d1d587c27c417
MD5 b1f00999c7c661002379f4a309519af5
SHA1 c7579afaba2c8687d486fdb20f6147954b85bea2
SHA512 c2e8781fbe49de867d9f7e3c2f6e57e371a73f0d31da425546a00422f290f76e1c5a5cba4666065a65d5c1b8a3654fc7531a7a2d437065680279803605fa389d
SSDEEP 24576:k0PimyBXnBMfH0fHtxt8CxpRSRwyu+FZY9Q7NVtlrVMeb3wEn0JlL:kxxMfUfNxeCL8flZNrVMejhn0JlL
TLSH
T1D355E0113A81E439F5A30576DEB5D629427DBC520B6221C7B3C87B2E4E34AE1BE39713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_b1f00999c7c661002379f4a309519af5_elex_glassworm_hawkeye_maze

File Explorer

2026-11-07_b1f00999c7c661002379f4a309519af5_elex_glassworm_hawkeye_maze

.exe 1.3MB

2026-11-07_b1f00999c7c661002379f4a309519af5_elex_glassworm_hawkeye_maze

IMPHASH b4707d7c70ea35e3b62b5604bb07f62a
SHA256 3f09790d5556e559674cb0aab39d47980aaadc2cf6551d38993d1d587c27c417
MD5 b1f00999c7c661002379f4a309519af5
SHA1 c7579afaba2c8687d486fdb20f6147954b85bea2
SHA512 c2e8781fbe49de867d9f7e3c2f6e57e371a73f0d31da425546a00422f290f76e1c5a5cba4666065a65d5c1b8a3654fc7531a7a2d437065680279803605fa389d
SSDEEP 24576:k0PimyBXnBMfH0fHtxt8CxpRSRwyu+FZY9Q7NVtlrVMeb3wEn0JlL:kxxMfUfNxeCL8flZNrVMejhn0JlL
TLSH
T1D355E0113A81E439F5A30576DEB5D629427DBC520B6221C7B3C87B2E4E34AE1BE39713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

91880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\build_9.0\trunk_cn_9.0_app崩溃提示\simulator\bin\ldtool.pdb

kernel32

DeleteFileW FindClose RemoveDirectoryW GetModuleFileNameW GetTempPathW LoadLibraryW GetProcAddress FreeLibrary ReadFile WriteFile MultiByteToWideChar WideCharToMultiByte WaitForSingleObject GetStdHandle TerminateProcess GetCurrentProcess GetModuleHandleW GetModuleHandleA GetStartupInfoW CreateEventW SetEvent GetLocalTime GetVersionExW QueryPerformanceCounter OutputDebugStringW GetProcessHeap HeapAlloc HeapFree SetLastError EncodePointer DecodePointer DeleteCriticalSection RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent ExitProcess GetModuleHandleExW HeapSize GetCurrentThread GetFileType GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreW IsValidCodePage GetACP GetOEMCP GetCPInfo GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers LoadLibraryExW HeapReAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW SetStdHandle WriteConsoleW ReadConsoleW SetEndOfFile CreateTimerQueue ExitThread CreateThread GetExitCodeThread DuplicateHandle InitializeCriticalSection WaitForSingleObjectEx SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread VirtualAlloc VirtualFree VirtualProtect ReleaseSemaphore InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx GetLastError GetTickCount CloseHandle CreateFileW GetCurrentThreadId LeaveCriticalSection UnhandledExceptionFilter EnterCriticalSection FindNextFileW FindFirstFileW GetCommandLineW Sleep

user32

LoadStringW KillTimer SetWindowLongW CreateWindowExW DestroyWindow DefWindowProcW

shlwapi

PathFileExistsW

shell32

ShellExecuteW SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_b1f00999c7c661002379f4a309519af5_elex_glassworm_hawkeye_maze

kernel32

user32

shlwapi

shell32

generic