C:\tufiwugu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-30_3984de03446668e2855f8a137422130e_amadey_rhadamanthys_smoke-loader.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-30_3984de03446668e2855f8a137422130e_amadey_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-30_3984de03446668e2855f8a137422130e_amadey_rhadamanthys_smoke-loader
-
Size
12.7MB
-
MD5
3984de03446668e2855f8a137422130e
-
SHA1
86477a07c4adb55a4f1cd6bfcdff69af4784c0d7
-
SHA256
91c46b2cafc037c13f3cc3f28b09af4abf9db3b1b5793a0d3a89d42b2a44f2ea
-
SHA512
e87d0d6f7fbeef21eeacb75a57407169f70425f0272efc92dd8ca84167372f537414cb7f594cc363ffa224d57d247d1ee0640d6a43ddb442d4e829852a4a0d13
-
SSDEEP
12288:TQy+PKMBWNKZ8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8Z8L:TQy+Pcy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-30_3984de03446668e2855f8a137422130e_amadey_rhadamanthys_smoke-loader
Files
-
2025-03-30_3984de03446668e2855f8a137422130e_amadey_rhadamanthys_smoke-loader.exe windows:5 windows x86 arch:x86
8035ff7b98b06adf69a1bd06062796db
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetSystemTimes
Sleep
SizeofResource
lstrlenW
GlobalUnfix
WriteFile
GetProcAddress
RegisterWaitForSingleObject
GetConsoleScreenBufferInfo
GetPrivateProfileSectionW
GetTickCount
GetModuleHandleW
GetCurrentProcess
GetLastError
ExitProcess
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapFree
IsProcessorFeaturePresent
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
Sections
.text Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.few Size: 1KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12.6MB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ