2026-05-04_d1bdea3de84e4c096081ef4823704000_amadey_elex_smoke-loader

General

Target
2026-05-04_d1bdea3de84e4c096081ef4823704000_amadey_elex_smoke-loader
Size 616KB
Sample260504-pg8trae14k
SHA256 a530c9a40a0fa6493ea9414e8487d34b5b65cff3bd9ca9e41d9b98749b0e4dd1
MD5 d1bdea3de84e4c096081ef4823704000
SHA1 ed517f3e8e5229dddcaaff42b5db84685be8eaa0
SHA512 d5264c5144d31368a0716b074508caafa71f9f92b75a4dae6ed3a2dc0d87078a7c87ef6868581e5684b2e6d0b5cc2fcdd077283fe5a12e52da962f54a9999cfa
SSDEEP 6144:fcoMOpwvtELYnCPnsAO3T/OSMZoFrLiGnGU:f4OpwvqVnshPMWDGU
TLSH
T177D4D52265F1B0B0E2D51EF054788D98453FED20AFA1AB57FAB1356A3F367CF8410992
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-04_d1bdea3de84e4c096081ef4823704000_amadey_elex_smoke-loader

File Explorer

2026-05-04_d1bdea3de84e4c096081ef4823704000_amadey_elex_smoke-loader

.exe 616KB

2026-05-04_d1bdea3de84e4c096081ef4823704000_amadey_elex_smoke-loader

IMPHASH a99648a4d417f4130faca9d4625edb8e
SHA256 a530c9a40a0fa6493ea9414e8487d34b5b65cff3bd9ca9e41d9b98749b0e4dd1
MD5 d1bdea3de84e4c096081ef4823704000
SHA1 ed517f3e8e5229dddcaaff42b5db84685be8eaa0
SHA512 d5264c5144d31368a0716b074508caafa71f9f92b75a4dae6ed3a2dc0d87078a7c87ef6868581e5684b2e6d0b5cc2fcdd077283fe5a12e52da962f54a9999cfa
SSDEEP 6144:fcoMOpwvtELYnCPnsAO3T/OSMZoFrLiGnGU:f4OpwvqVnshPMWDGU
TLSH
T177D4D52265F1B0B0E2D51EF054788D98453FED20AFA1AB57FAB1356A3F367CF8410992
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

34859

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CreateProcessW CreateFileW CloseHandle WideCharToMultiByte GetLastError MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW

user32

AllowSetForegroundWindow WaitForInputIdle

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-04_d1bdea3de84e4c096081ef4823704000_amadey_elex_smoke-loader

kernel32

user32

generic