2026-11-11_76f19cc6ab73c24a446193678ddb9649_elex_floxif_manuscrypt_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_76f19cc6ab73c24a446193678ddb9649_elex_floxif_manuscrypt_rhadamanthys_stop
Size 1.0MB
Sample261113-lrtk2aat3n
SHA256 430501070b9f25c55a5a94e6d93a194a99f6bea54236fac5ce861153cb77d88e
MD5 76f19cc6ab73c24a446193678ddb9649
SHA1 dff9363c040dbe4f349e321dfac5966d11faab16
SHA512 d932711bf848a7e6efff00ed980ce04d8ef8dd511fcd41b7997041b2deb043c51d90327d7f01967abfae77188be196ef595818261cf7336a1fcebdab7551f20c
SSDEEP 6144:+gnjITvY/73Yi8QUFvpLdJIO6MsubRuQM2NAxvQhKnmyc45tP/iY4eMB73BV+Udl:+gSVJQ0AxvSlvN3BjvrEH79C
TLSH
T17F35A6667A08D2D7F71C987AE48C876253601DBACF561031F0E9BABF113EAB05E5523C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-11_76f19cc6ab73c24a446193678ddb9649_elex_floxif_manuscrypt_rhadamanthys_stop

File Explorer

2026-11-11_76f19cc6ab73c24a446193678ddb9649_elex_floxif_manuscrypt_rhadamanthys_stop

.exe 1.0MB

2026-11-11_76f19cc6ab73c24a446193678ddb9649_elex_floxif_manuscrypt_rhadamanthys_stop

IMPHASH 7307c67e7fd68bb30c4e259dc662e0d3
SHA256 430501070b9f25c55a5a94e6d93a194a99f6bea54236fac5ce861153cb77d88e
MD5 76f19cc6ab73c24a446193678ddb9649
SHA1 dff9363c040dbe4f349e321dfac5966d11faab16
SHA512 d932711bf848a7e6efff00ed980ce04d8ef8dd511fcd41b7997041b2deb043c51d90327d7f01967abfae77188be196ef595818261cf7336a1fcebdab7551f20c
SSDEEP 6144:+gnjITvY/73Yi8QUFvpLdJIO6MsubRuQM2NAxvQhKnmyc45tP/iY4eMB73BV+Udl:+gSVJQ0AxvSlvN3BjvrEH79C
TLSH
T17F35A6667A08D2D7F71C987AE48C876253601DBACF561031F0E9BABF113EAB05E5523C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a6:9f:26:5e:20:a3:13:00:da:84:fd:a6:ad:17:f7:e1:28:21:b3:6e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Chains

Jan 26, 2015

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Serial Number

29:c1:5b:3f:aa:cd:52:6a:4e:67:bd:3c:4e:7e:3f:f2

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 25, 2012 - Sep 20, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

29890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

U:\develop\global\Release\bin\common\x86\Setup.pdb

gdiplus

GdiplusShutdown GdiplusStartup

kernel32

LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadResource SizeofResource lstrcmpiW LoadLibraryExW GetModuleFileNameW GetModuleHandleW FindResourceW SetCurrentDirectoryW MultiByteToWideChar SetFilePointerEx SetStdHandle EnterCriticalSection GetConsoleCP FlushFileBuffers GetLastError GetCurrentThreadId RaiseException GetProcAddress FreeLibrary InterlockedDecrement InterlockedIncrement WriteConsoleW CloseHandle GetStringTypeW LCMapStringW WideCharToMultiByte LoadLibraryW OutputDebugStringW GetCPInfo GetOEMCP GetConsoleMode HeapFree DecodePointer EncodePointer IsDebuggerPresent IsProcessorFeaturePresent CreateFileW HeapAlloc RtlUnwind GetCommandLineW ExitProcess GetModuleHandleExW HeapSize Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetProcessHeap GetStdHandle WriteFile HeapReAlloc GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetACP

user32

MessageBoxW DefWindowProcW DestroyWindow CharNextW

advapi32

RegEnumKeyExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW

ole32

CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoInitialize

oleaut32

VarUI4FromStr

shlwapi

PathAppendW PathFileExistsW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_76f19cc6ab73c24a446193678ddb9649_elex_floxif_manuscrypt_rhadamanthys_stop

PE Signature issue

gdiplus

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

generic