2026-07-07_770f5b674d0c90a6bfc16f31b81f7d0a_amadey_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_770f5b674d0c90a6bfc16f31b81f7d0a_amadey_elex_smoke-loader_stop
Size 4.7MB
Sample260707-mefdbacy3l
SHA256 27f9ae92e694c88e08446ba2b8bd76651cffd592a8b72cf3e561204a2e802706
MD5 770f5b674d0c90a6bfc16f31b81f7d0a
SHA1 a319e77fb18da7801bb10e992ce7f49ecfb209f3
SHA512 7693a620aa97b31fa80986f91c63163af1b42aa6c8e03f46a7e13d87f8186116a55b52baecc6ab06ab5879d952528993ce922f4b426439254d8f43d9af80bfe5
SSDEEP 12288:BJzipepdgrNxlYNsRWPTfcDuSCszi+DQabp56Zc03FGCTsMh0u8bQZV:zNY2gtzi+DOBsM25bQD
TLSH
T113364B01F6428236E96315F2CFBE4A7DA27CAA21035460D7D3CC0DA95BA69F3793315B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_770f5b674d0c90a6bfc16f31b81f7d0a_amadey_elex_smoke-loader_stop

File Explorer

2026-07-07_770f5b674d0c90a6bfc16f31b81f7d0a_amadey_elex_smoke-loader_stop

.exe 4.7MB

2026-07-07_770f5b674d0c90a6bfc16f31b81f7d0a_amadey_elex_smoke-loader_stop

IMPHASH 54c77566664c5e0f79594eaa54ace683
SHA256 27f9ae92e694c88e08446ba2b8bd76651cffd592a8b72cf3e561204a2e802706
MD5 770f5b674d0c90a6bfc16f31b81f7d0a
SHA1 a319e77fb18da7801bb10e992ce7f49ecfb209f3
SHA512 7693a620aa97b31fa80986f91c63163af1b42aa6c8e03f46a7e13d87f8186116a55b52baecc6ab06ab5879d952528993ce922f4b426439254d8f43d9af80bfe5
SSDEEP 12288:BJzipepdgrNxlYNsRWPTfcDuSCszi+DQabp56Zc03FGCTsMh0u8bQZV:zNY2gtzi+DOBsM25bQD
TLSH
T113364B01F6428236E96315F2CFBE4A7DA27CAA21035460D7D3CC0DA95BA69F3793315B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1544532

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

W:\Dev\R_522\Wacom\Win\Utils\Build\build\Software\Wacom\Win\Win32\Release\WTouchUser.pdb

shlwapi

PathIsUNCA

mpr

WNetGetUniversalNameA

hid

HidD_GetPreparsedData HidD_FreePreparsedData HidD_SetFeature HidD_GetAttributes HidP_GetCaps HidD_GetHidGuid HidP_GetSpecificValueCaps

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces CM_Locate_DevNodeA CM_Get_Device_IDA SetupDiGetClassDevsA CM_Get_Parent

kernel32

DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetCurrentProcessId ProcessIdToSessionId CreateEventA OpenEventA GetCurrentThreadId GetModuleHandleW ResetEvent GetSystemPowerStatus FreeLibrary LoadLibraryA SetLastError GetSystemDefaultLCID GetUserDefaultLCID RaiseException CreateEventW SignalObjectAndWait WaitForMultipleObjectsEx MultiByteToWideChar WideCharToMultiByte UnmapViewOfFile CreateFileMappingA MapViewOfFile CreateMutexA CreateFileMappingW WaitForMultipleObjects DuplicateHandle GetTickCount ReleaseSemaphore WriteFile CreateSemaphoreW CreateNamedPipeA ConnectNamedPipe ReadFile GetOverlappedResult PeekNamedPipe DisconnectNamedPipe GetCurrentProcess CreateFileA SetThreadPriority GetCommandLineA GetVersionExW SetCommMask SetupComm SetCommTimeouts GetCommState SetCommState PurgeComm ClearCommError InitializeCriticalSection GetModuleFileNameA QueryPerformanceFrequency QueryPerformanceCounter GetStringTypeExA WaitForSingleObject LCMapStringW InterlockedCompareExchange InterlockedExchange GetVersionExA ReleaseMutex TlsSetValue TlsGetValue TlsFree TlsAlloc InterlockedIncrement CompareStringA GetTimeZoneInformation GetProcessHeap SetEndOfFile SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW InitializeCriticalSectionAndSpinCount GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA CreateFileW GetFullPathNameW GetCurrentDirectoryA GetFileInformationByHandle Process32NextW GetFullPathNameA GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA FlushFileBuffers SetFilePointer GetConsoleMode GetConsoleCP GetFileType SetHandleCount HeapSize IsValidCodePage GetOEMCP GetACP GetStdHandle ExitProcess HeapCreate VirtualAlloc VirtualFree GetCPInfo FindFirstFileW GetDriveTypeW FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime FindClose RtlUnwind GetStartupInfoA HeapReAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess HeapFree lstrlenW Process32FirstW CreateToolhelp32Snapshot LocalFree GetLastError GetModuleHandleA GetProcAddress LocalAlloc CloseHandle Sleep OpenProcess CreateThread OutputDebugStringA LCMapStringA SetEnvironmentVariableA InterlockedDecrement CreateDirectoryA CompareStringW HeapAlloc

user32

LoadStringA SendMessageTimeoutA EnumDisplaySettingsA EnumDisplayDevicesA GetMonitorInfoA EnumDisplayMonitors GetSystemMetrics GetDoubleClickTime MessageBeep keybd_event MapVirtualKeyA InvalidateRect SendMessageW IsWindow UpdateLayeredWindow ShowCursor FillRect RegisterClassExW GetDC VkKeyScanA EnumChildWindows GetParent GetWindowLongW IsWindowEnabled PostThreadMessageA DestroyCursor GetCursorPos SetSystemCursor CopyIcon CreateCursor mouse_event SendInput SetDlgItemTextW GetWindowInfo CreateDialogParamW UnregisterDeviceNotification PostThreadMessageW DefWindowProcW PostQuitMessage DispatchMessageW GetMessageW CreateWindowExW RegisterClassW LoadCursorW LoadIconW RegisterDeviceNotificationW EndDialog SetWindowPos DialogBoxParamW FindWindowW GetClassNameA PostMessageW ShowWindow GetWindowThreadProcessId UnhookWinEvent SetWinEventHook LoadStringW UnregisterClassA

gdi32

Ellipse CreateCompatibleDC CreateCompatibleBitmap SelectObject CreatePen GetStockObject

advapi32

SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegQueryValueExA RegEnumKeyExA RegOpenKeyExA RegOpenKeyW GetSecurityDescriptorSacl RegSetValueExA OpenProcessToken RegCreateKeyExA FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation

shell32

SHGetFolderPathA ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_770f5b674d0c90a6bfc16f31b81f7d0a_amadey_elex_smoke-loader_stop

shlwapi

mpr

hid

setupapi

kernel32

user32

gdi32

advapi32

shell32

generic