g:\Sorce\2009\DrvLangChg Latest\DrvLangChg\Release\DrvLangChg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-05-14_a4170dfc749b2b91453be8cc24802d53_amadey_elex_gcleaner_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20250502-en
General
-
Target
2025-05-14_a4170dfc749b2b91453be8cc24802d53_amadey_elex_gcleaner_rhadamanthys_smoke-loader
-
Size
120KB
-
MD5
a4170dfc749b2b91453be8cc24802d53
-
SHA1
06b5273ddc5bb4a6012c99a90aa522c61895e500
-
SHA256
003509ffb329e2f2e9477dcb8d980a185140b185f0b5dda4b268b1c6ccbcc346
-
SHA512
4befb3141732960bdf174e7b946923dce03ccbf06b52f24d4371e03f9f88cf2d9a573f26f79d0cd4d499c24da72e33eaed0e2c9939f2ee510ac6b12d1936c767
-
SSDEEP
3072:p3hvYwqtslXhjD8MXxJGGl/hLkUYrrVTE:phnD3G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-05-14_a4170dfc749b2b91453be8cc24802d53_amadey_elex_gcleaner_rhadamanthys_smoke-loader
Files
-
2025-05-14_a4170dfc749b2b91453be8cc24802d53_amadey_elex_gcleaner_rhadamanthys_smoke-loader.exe windows:4 windows x86 arch:x86
781d0fc3f584a17e9927b75fd914c30c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
CloseHandle
ReleaseMutex
CreateMutexA
LocalAlloc
GetCurrentThread
GetProcAddress
GetLastError
GetCurrentProcess
GetVersionExA
GetModuleHandleA
GetSystemInfo
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
user32
ExitWindowsEx
GetWindowRect
SendDlgItemMessageA
MessageBoxA
DialogBoxParamA
LoadStringA
EndDialog
GetDesktopWindow
SetWindowPos
wsprintfA
advapi32
RegCloseKey
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenThreadToken
FreeSid
OpenProcessToken
EqualSid
RegSetValueExA
AllocateAndInitializeSid
GetTokenInformation
Sections
.text Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.zero Size: 4KB - Virtual size: 3KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ