C:\hexetuzowuzanoz\siboyoxetumepim10 xadepuj-b.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-30_b3fe57536752c8d7d2448db15f67da9a_amadey_rhadamanthys_smoke-loader.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2025-03-30_b3fe57536752c8d7d2448db15f67da9a_amadey_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20250313-en
General
-
Target
2025-03-30_b3fe57536752c8d7d2448db15f67da9a_amadey_rhadamanthys_smoke-loader
-
Size
12.8MB
-
MD5
b3fe57536752c8d7d2448db15f67da9a
-
SHA1
a13fc2dde7e38c376d31112c7e1667cc94a1ce5b
-
SHA256
2e27b402a19db959fac5b96e42dc07d6249d22f929c34af2fe21b36b1343304e
-
SHA512
76a0d2acd265ecd1ac73a6b234b4e8a7f6087977982657b31023f84e3dcfbb499a9ed52972e19bb63e1ae1991a511b122b0a343c91dfe005b90a07816fa50d33
-
SSDEEP
24576:6PQuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuz:
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-30_b3fe57536752c8d7d2448db15f67da9a_amadey_rhadamanthys_smoke-loader
Files
-
2025-03-30_b3fe57536752c8d7d2448db15f67da9a_amadey_rhadamanthys_smoke-loader.exe windows:5 windows x86 arch:x86
54dc4fa00aed2dfea3bfa727027b942d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLocaleInfoW
FormatMessageW
GetExitCodeProcess
GetFileAttributesW
CreateFileW
lstrlenW
WritePrivateProfileStringW
GetNamedPipeHandleStateW
LCMapStringA
GlobalAlloc
GetLastError
GetProcAddress
RemoveDirectoryA
OpenWaitableTimerA
CreateHardLinkW
GetPrivateProfileSectionA
GetCurrentProcessId
GetCurrencyFormatW
SetCommTimeouts
WriteFile
GetModuleHandleW
SleepEx
GetDriveTypeW
IsBadStringPtrW
FindFirstFileExA
FindResourceA
Sleep
ExitProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
RtlUnwind
GetLocaleInfoA
WideCharToMultiByte
HeapAlloc
VirtualAlloc
HeapReAlloc
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringW
advapi32
LookupAccountNameA
Sections
.text Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 73KB - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12.7MB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ