2025-04-03_f648e21e939d0a1b85e0cc06fc030ed0_amadey_floxif_smoke-loader

Sharing

Copy URL

Twitter E-mail

General

Target

2025-04-03_f648e21e939d0a1b85e0cc06fc030ed0_amadey_floxif_smoke-loader
Size

3.9MB
MD5

f648e21e939d0a1b85e0cc06fc030ed0
SHA1

59760c8b0fb7d87768562ce46ecbc3722c3a4afa
SHA256

26b05b65a810084a62fd6c0119b07ba2d55450af656db8eb31d8c28e37df2790
SHA512

5793e7672da8e81d3bef8ab33da555fdcd5cd97c8356e16c8bef6df6c9ec196323653c0ff3a11fdaa79d24283c40572b0d144531492afccb8191edba7ebc55f9
SSDEEP

49152:yxvDiYlx4hrTQkHsZl3YbXx4hOrjWEKjaL6c5v4psztgWZRCrZlsV:49gTQkHsZl3YrxZrjWEMyv4yBjP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-04-03_f648e21e939d0a1b85e0cc06fc030ed0_amadey_floxif_smoke-loader

Files

2025-04-03_f648e21e939d0a1b85e0cc06fc030ed0_amadey_floxif_smoke-loader
.exe windows:4 windows x86 arch:x86

dc8dbae72b7d9b08c8bcb1d95e408345

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\MyViews\itzik.jan_SD_U3Uninstall_int\Software_Vob\SD_U3Uninstall_Comp\Release\DlgTest.pdb

Imports

setupapi

CM_Enable_DevNode
CM_Disable_DevNode
CM_Get_Device_ID_ExW
CM_Locate_DevNodeW
CM_Get_DevNode_Registry_PropertyW
CM_Get_Parent
SetupDiGetDeviceInfoListDetailW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
CM_Get_Child
CM_Get_Sibling
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceRegistryPropertyA

hid

HidD_FreePreparsedData
HidP_GetCaps
HidD_GetPreparsedData
HidD_SetNumInputBuffers
HidD_GetNumInputBuffers
HidD_GetHidGuid
HidD_GetManufacturerString
HidD_GetSerialNumberString
HidD_GetProductString
HidD_GetAttributes
HidP_GetSpecificValueCaps

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

winmm

mciSendCommandW

kernel32

TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
SystemTimeToFileTime
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
MoveFileW
GetStringTypeExW
ReadFile
SetFilePointer
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetFullPathNameW
GetShortPathNameW
GlobalGetAtomNameW
SetErrorMode
LocalFileTimeToFileTime
SetFileTime
GetFileAttributesW
GetFileTime
LocalUnlock
LocalLock
GetTempFileNameW
GetStartupInfoW
GetVersion
ExitProcess
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
HeapFree
IsBadReadPtr
GetModuleFileNameA
DeleteFileA
GetCPInfo
GetConsoleCP
ReadConsoleInputA
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
ExitThread
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
SetUnhandledExceptionFilter
IsBadWritePtr
LCMapStringA
LCMapStringW
DebugBreak
SetConsoleCtrlHandler
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
PeekConsoleInputA
GetNumberOfConsoleInputEvents
CreateFileA
GetConsoleOutputCP
WriteConsoleW
GetOEMCP
IsBadCodePtr
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
WriteConsoleA
GetDriveTypeA
GetCurrentDirectoryA
GetFullPathNameA
InterlockedDecrement
FindFirstFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileW
FindClose
TlsGetValue
GlobalSize
FormatMessageW
lstrcpynW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
lstrlenA
GetModuleHandleA
LoadLibraryA
lstrcatW
lstrcmpW
GetVersionExA
GlobalLock
GlobalUnlock
VirtualProtect
GetProcessTimes
UnmapViewOfFile
CreateFileMappingW
MapViewOfFileEx
GetLocaleInfoW
EnumResourceLanguagesW
EnumSystemLocalesW
GetUserDefaultLangID
GetSystemDefaultLangID
ExpandEnvironmentStringsW
MulDiv
GetLogicalDriveStringsW
GetLogicalDrives
ReadFileEx
SleepEx
ResetEvent
GetVolumeNameForVolumeMountPointW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetWindowsDirectoryW
ReleaseMutex
CreateMutexW
GlobalAlloc
GlobalFree
FreeResource
FreeLibrary
WideCharToMultiByte
LoadLibraryW
FindResourceExW
lstrlenW
FreeConsole
AllocConsole
GetDriveTypeW
FlushFileBuffers
TryEnterCriticalSection
GetSystemDirectoryW
EnterCriticalSection
LeaveCriticalSection
GetLongPathNameW
GetStdHandle
DeleteCriticalSection
InitializeCriticalSection
RaiseException
InterlockedExchangeAdd
GetCurrentProcessId
GetCurrentThreadId
OpenProcess
TerminateProcess
WriteFile
GetVolumeInformationW
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
lstrcpyW
CreateEventW
WaitForSingleObject
CreateThread
CreateFileW
DeviceIoControl
SetEvent
SetFileAttributesW
SetVolumeLabelW
CloseHandle
Sleep
OutputDebugStringW
GetCurrentThread
GetLastError
GetCurrentProcess
LocalAlloc
LocalFree
CopyFileW
DeleteFileW
RemoveDirectoryW
CreateDirectoryW
GetModuleHandleW
GetProcAddress
GetDiskFreeSpaceW
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GlobalHandle
GlobalReAlloc
GlobalFlags
lstrcmpiW
SuspendThread
ResumeThread
SetThreadPriority
lstrcmpA
lstrcmpiA
GetModuleFileNameW
SetLastError
ConvertDefaultLocale
RtlUnwind

user32

CreatePopupMenu
SetRectEmpty
BringWindowToTop
SetMenu
TranslateAcceleratorW
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
CopyAcceleratorTableW
SetRect
IsRectEmpty
CharNextW
CharUpperW
DestroyIcon
DeleteMenu
WaitMessage
GetWindowThreadProcessId
ReleaseCapture
WindowFromPoint
SetCapture
LoadCursorW
GetSysColorBrush
GetDialogBaseUnits
MapVirtualKeyW
GetKeyNameTextW
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
SetWindowContextHelpId
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
GetCursorPos
ValidateRect
ShowOwnedPopups
SetCursor
wsprintfW
GetMenuStringW
AppendMenuW
InsertMenuW
RemoveMenu
SetMenuItemBitmaps
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapW
ScrollWindowEx
MoveWindow
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
WinHelpW
SetWindowsHookExW
CallNextHookEx
GetClassInfoExW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
InsertMenuItemW
SendDlgItemMessageA
IsChild
GetWindowTextLengthW
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
LoadIconW
MapWindowPoints
ScrollWindow
MessageBoxW
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
IsWindowVisible
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
SetScrollInfo
GetClassInfoW
SetWindowPlacement
GetDlgCtrlID
CallWindowProcW
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
CopyRect
PtInRect
GetWindow
GetDesktopWindow
GetSystemMetrics
GetNextDlgTabItem
EndDialog
MapDialogRect
SetWindowPos
GetCapture
GetActiveWindow
SetActiveWindow
GetAsyncKeyState
GetFocus
SetFocus
IsWindowEnabled
SetWindowLongW
RegisterDeviceNotificationW
GetWindowLongW
UnregisterDeviceNotification
LoadAcceleratorsW
ReuseDDElParam
UnpackDDElParam
LoadMenuW
SetParent
LockWindowUpdate
PostQuitMessage
PeekMessageW
CreateDialogIndirectParamW
ShowWindow
GetWindowTextW
GetDlgItem
LoadStringW
BroadcastSystemMessageW
RegisterWindowMessageW
SendNotifyMessageW
UnregisterClassW
IsWindow
InvalidateRect
UpdateWindow
GetClientRect
GetDCEx
PostThreadMessageW
UnionRect
GetTabbedTextExtentW
IsClipboardFormatAvailable
SendDlgItemMessageW
RegisterClipboardFormatW
GetWindowRect
GetSysColor
GetSystemMenu
ModifyMenuW
GetMessageW
TranslateMessage
DispatchMessageW
FindWindowW
SetForegroundWindow
SetTimer
RegisterClassW
CreateWindowExW
DefWindowProcW
DestroyWindow
KillTimer
PostMessageW
LoadImageW
SendMessageW
EnableWindow
GetParent
GetScrollInfo
UnregisterClassA

gdi32

GetCharWidthW
StretchDIBits
CreateFontW
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
PolyDraw
ArcTo
CreateCompatibleBitmap
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
GetRgnBox
GetTextColor
GetBkColor
DPtoLP
GetMapMode
TextOutW
CombineRgn
SetRectRgn
EnumFontFamiliesExW
GetTextMetricsW
PatBlt
CreateRectRgnIndirect
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
OffsetClipRgn
IntersectClipRect
CreatePen
ExcludeClipRect
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateDCW
CopyMetaFileW
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
PlayMetaFile
EnumMetaFile
GetObjectType
PlayMetaFileRecord
SelectPalette
CreateCompatibleDC
CreatePatternBrush
GetDCOrgEx
GetTextExtentPoint32W
CreateDIBPatternBrushPt
DeleteDC
ExtSelectClipRgn
PolyBezierTo
GetStockObject
GetObjectW
CreateFontIndirectW
GetDeviceCaps
GetCurrentPositionEx
CreateICW
RectVisible
PtVisible
StartDocW
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
PolylineTo

comdlg32

PageSetupDlgW
FindTextW
ReplaceTextW
GetOpenFileNameW
CommDlgExtendedError
PrintDlgW
GetFileTitleW
GetSaveFileNameW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter
GetJobW

advapi32

CryptReleaseContext
RevertToSelf
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
OpenProcessToken
OpenThreadToken
GetFileSecurityW
SetFileSecurityW
RegCreateKeyW
RegQueryValueW
RegEnumKeyW
RegOpenKeyW
RegSetValueW
CryptGenRandom
CryptAcquireContextA
FreeSid
RegDeleteValueW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
ImpersonateSelf

shell32

SHChangeNotify
ExtractIconW
SHGetFileInfoW
DragFinish
DragQueryFileW
SHFileOperationW

comctl32

PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW
ord17
ord13
ImageList_Read
ImageList_Write
ord14
ImageList_Destroy
ImageList_Create
ImageList_LoadImageW
ImageList_Merge
ImageList_Draw
ImageList_GetImageInfo

shlwapi

PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
PathStripToRootW
PathFileExistsW
PathIsUNCW

oledlg

OleUIBusyW

ole32

CoTreatAsClass
StringFromCLSID
OleDuplicateData
ReleaseStgMedium
CoTaskMemAlloc
CreateBindCtx
OleUninitialize
CLSIDFromProgID
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
OleRun
CreateILockBytesOnHGlobal
CLSIDFromString
CoDisconnectObject
CoCreateInstance
StringFromGUID2
CoGetClassObject
CreateStreamOnHGlobal
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
CoRevokeClassObject
OleInitialize
CoRegisterClassObject
ReadFmtUserTypeStg
StgCreateDocfileOnILockBytes
CoFreeUnusedLibraries
ReadClassStg
StgOpenStorageOnILockBytes

oleaut32

VarDecFromStr
VarBstrFromDec
SysReAllocStringLen
VarDateFromStr
SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysFreeString
VariantInit
VariantChangeType
VariantClear
VarCyFromStr
VarBstrFromCy
LoadTypeLi
OleCreateFontIndirect
VarBstrFromDate
SysAllocStringLen

Sections

.textbss
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 500KB - Virtual size: 497KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 4KB - Virtual size: 793B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 460KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc8dbae72b7d9b08c8bcb1d95e408345

Headers

File Characteristics

PDB Paths

Imports

setupapi

hid

version

winmm

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.textbss Size: - Virtual size: 1.0MB

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 500KB - Virtual size: 497KB

.data Size: 56KB - Virtual size: 84KB

.idata Size: 24KB - Virtual size: 20KB

.didat Size: 4KB - Virtual size: 793B

.rsrc Size: 460KB - Virtual size: 457KB

.textbss
Size: - Virtual size: 1.0MB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 500KB - Virtual size: 497KB

.data
Size: 56KB - Virtual size: 84KB

.idata
Size: 24KB - Virtual size: 20KB

.didat
Size: 4KB - Virtual size: 793B

.rsrc
Size: 460KB - Virtual size: 457KB