2026-06-25_c878ae215e57658a55a93a060aa6feed_amadey_elex_smoke-loader

General

Target
2026-06-25_c878ae215e57658a55a93a060aa6feed_amadey_elex_smoke-loader
Size 910KB
Sample260629-ylvmcsd161
SHA256 72ba1f67896d4e89821d852a787373ac116baceb5af0ca34bb6561d125ec4232
MD5 c878ae215e57658a55a93a060aa6feed
SHA1 ec0f461da283781a05883513be2f4a5d5432a208
SHA512 50b99931b87242c096c373b7e099cbdf0f09d60780e052118c0735bdeec048f5e475f46c3aeca81deb1bd4d64d256b7862a6174c7971c6258bc467e9de340d05
SSDEEP 24576:qM6aPsVQGNofMuDarQGhee21TrldFpAtXyXuzgdMVw+hkJ95FA7:VZ+LhkJ9U
TLSH
T1B815D2133501B828FB7012FB27A7464B64A864E44399E5F322972E9EF5437D72BFAC41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-25_c878ae215e57658a55a93a060aa6feed_amadey_elex_smoke-loader

File Explorer

2026-06-25_c878ae215e57658a55a93a060aa6feed_amadey_elex_smoke-loader

.exe 910KB

2026-06-25_c878ae215e57658a55a93a060aa6feed_amadey_elex_smoke-loader

IMPHASH 3d1ad7b615f29ee8da4ad88156d1c31b
SHA256 72ba1f67896d4e89821d852a787373ac116baceb5af0ca34bb6561d125ec4232
MD5 c878ae215e57658a55a93a060aa6feed
SHA1 ec0f461da283781a05883513be2f4a5d5432a208
SHA512 50b99931b87242c096c373b7e099cbdf0f09d60780e052118c0735bdeec048f5e475f46c3aeca81deb1bd4d64d256b7862a6174c7971c6258bc467e9de340d05
SSDEEP 24576:qM6aPsVQGNofMuDarQGhee21TrldFpAtXyXuzgdMVw+hkJ95FA7:VZ+LhkJ9U
TLSH
T1B815D2133501B828FB7012FB27A7464B64A864E44399E5F322972E9EF5437D72BFAC41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1e:28:1f:f2:50:a8:17:f1:1c:5b:75:2e:05:8b:fe:bb:c4:96:a6:79

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 16, 2009

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:27:81:00:00:00:00:00:08

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2008 - Jan 22, 2010

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:49:7c:ed:00:00:00:00:00:05

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 16, 2006 - Sep 16, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Minor OS version

0

Major OS version

4

Entry point

199283

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

y:\test4\e91\Debug\e91.pdb

kernel32

GetLocalTime GetProcAddress LoadLibraryW CompareStringW CompareStringA GetModuleHandleA GetStartupInfoW GetVersionExA DebugBreak RaiseException LoadLibraryA HeapFree IsBadWritePtr IsBadReadPtr HeapValidate HeapAlloc GetCPInfo ExitProcess MultiByteToWideChar GetStringTypeA GetLastError GetStringTypeW IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID TerminateProcess GetCurrentProcess UnhandledExceptionFilter GetModuleFileNameW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetStdHandle GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree RtlUnwind GetModuleFileNameA WriteFile GetProcessHeap CloseHandle FreeLibrary InterlockedDecrement OutputDebugStringA InterlockedIncrement VirtualAlloc HeapReAlloc GetTimeFormatA GetDateFormatA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime VirtualProtect GetSystemInfo VirtualQuery WideCharToMultiByte InterlockedExchange SetConsoleCtrlHandler GetTimeZoneInformation GetLocaleInfoW LCMapStringA LCMapStringW SetFilePointer GetACP GetOEMCP SetStdHandle FlushFileBuffers SetEnvironmentVariableA

ole32

CoTaskMemAlloc

Name

.rda�89�

Size

188KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

380KB

Virtual Size

378KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-25_c878ae215e57658a55a93a060aa6feed_amadey_elex_smoke-loader

PE Signature issue

kernel32

ole32

generic