2026-07-08_87dc754411d744edc5cb0a98daf2aa07_amadey_elex_emotet_floxif_hijackloader_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_87dc754411d744edc5cb0a98daf2aa07_amadey_elex_emotet_floxif_hijackloader_smoke-loader_stop
Size 33.2MB
Sample260708-v232wsdv8n
SHA256 8cd7ad5a64e7d80be2c942c9f305ff13a22837bb84b632105f3f5cf40c9c9d20
MD5 87dc754411d744edc5cb0a98daf2aa07
SHA1 20b4e2a6a2b6ffd48d13e2584c0ee9f9b31821a4
SHA512 497d28272d2774d6a16508ad5520da4ca8ca2932e7f7efa0819ebb93cad946f8de3439a3c831805a9a4ded8adc13d5dbd0d6c95944c0b3874bfa8f3d3ea1e3db
SSDEEP 786432:VAl8FGNX5qVD86kZ0WDmHQhqsKyegbkPzJEEmP+:Cl3XMVqliHMmyegbx+
TLSH
T17C773311B7F4C079D1960A318E669BB690B4FE198B31D9C737C0BF6E1E31985C239B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-08_87dc754411d744edc5cb0a98daf2aa07_amadey_elex_emotet_floxif_hijackloader_smoke-loader_stop

File Explorer

2026-07-08_87dc754411d744edc5cb0a98daf2aa07_amadey_elex_emotet_floxif_hijackloader_smoke-loader_stop

.exe 33.2MB

2026-07-08_87dc754411d744edc5cb0a98daf2aa07_amadey_elex_emotet_floxif_hijackloader_smoke-loader_stop

IMPHASH bfd4e7a7a3654383c0fcb22c6c706de8
SHA256 8cd7ad5a64e7d80be2c942c9f305ff13a22837bb84b632105f3f5cf40c9c9d20
MD5 87dc754411d744edc5cb0a98daf2aa07
SHA1 20b4e2a6a2b6ffd48d13e2584c0ee9f9b31821a4
SHA512 497d28272d2774d6a16508ad5520da4ca8ca2932e7f7efa0819ebb93cad946f8de3439a3c831805a9a4ded8adc13d5dbd0d6c95944c0b3874bfa8f3d3ea1e3db
SSDEEP 786432:VAl8FGNX5qVD86kZ0WDmHQhqsKyegbkPzJEEmP+:Cl3XMVqliHMmyegbx+
TLSH
T17C773311B7F4C079D1960A318E669BB690B4FE198B31D9C737C0BF6E1E31985C239B1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c3:b5:a7:4e:2a:a5:1d:0c:a4:54:08:af:db:4e:fe:0d:4e:64:7a:44:2a:e9:a8:46:08:3e:30:15:26:45:d8:a6

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Chains

Apr 8, 2022

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

09:3b:b6:bc:dd:0e:e8:9b:0f:90:91:80:a4:5d:5d:95:33:94:29:5e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Chains

Apr 8, 2022

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2021 - Jul 27, 2036

Subject

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Serial Number

0d:af:98:a3:02:0b:e2:da:3b:82:56:89:b6:72:61:5d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 23, 2021 - Nov 22, 2022

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

Major OS version

Entry point

199064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

v:\admindeployment_win\source\admindeploymenttool\release\Inst.pdb

mpr

WNetAddConnection3W

kernel32

lstrlenA GetThreadLocale SetFilePointer FlushFileBuffers LockFile UnlockFile DuplicateHandle GetVolumeInformationW GetFullPathNameW SetErrorMode GetTickCount FileTimeToLocalFileTime HeapFree HeapAlloc GetProcessHeap GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime RtlUnwind ExitProcess HeapReAlloc RaiseException HeapSize VirtualProtect GetSystemInfo VirtualQuery GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode GetTimeZoneInformation GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFlags GetModuleHandleA GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GetCurrentProcessId SetLastError GlobalAddAtomW GlobalUnlock MulDiv WritePrivateProfileStringW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange GlobalLock lstrcmpW GetModuleHandleW lstrlenW CreateDirectoryW MultiByteToWideChar FileTimeToSystemTime LocalFileTimeToFileTime SetFileTime GetFileAttributesW OutputDebugStringW DosDateTimeToFileTime GetCurrentProcess InterlockedDecrement GetExitCodeProcess CreateProcessW GetFileTime MoveFileExW RemoveDirectoryW DeleteFileW SetFileAttributesW FreeResource GlobalAlloc GlobalFree FindClose FindNextFileW FindFirstFileW ReadFile GetFileSize EndUpdateResourceW GetSystemTime GetTimeFormatW WideCharToMultiByte SetEndOfFile LocalFree FormatMessageW SetStdHandle GetStdHandle GetTempFileNameW GetTempPathW WriteFile WaitNamedPipeW GetLastError CreateFileW CloseHandle WaitForSingleObject GetModuleFileNameW GetProcAddress LoadLibraryW FindResourceW LoadResource LockResource SizeofResource FreeLibrary VirtualAlloc

user32

MessageBeep GetNextDlgGroupItem InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableW CharNextW ReleaseCapture LoadCursorW SetCapture ShowWindow MoveWindow SetWindowTextW IsDialogMessageW DestroyMenu EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetDesktopWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextW GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow UpdateWindow GetMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx EqualRect CopyRect UnregisterClassA IsIconic SendMessageW GetSystemMetrics GetClientRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW SetWindowLongW OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement UnhookWindowsHookEx GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled SetCursor GetMenuItemID GetMenuItemCount GetSubMenu PostThreadMessageW RegisterClipboardFormatW GetWindow UnregisterClassW CharUpperW SetActiveWindow DrawIcon GetWindowRect LoadBitmapW GetSysColorBrush LoadIconW EnableWindow IsWindow PostMessageW MessageBoxW PostQuitMessage CheckMenuItem EnableMenuItem GetMenuState ModifyMenuW GetParent GetFocus GetMenuCheckMarkDimensions SetMenuItemBitmaps ValidateRect GetCursorPos PeekMessageW GetKeyState IsWindowVisible GetActiveWindow DispatchMessageW TranslateMessage GetMessageW CallNextHookEx SetWindowsHookExW SetWindowPos MapDialogRect SetWindowContextHelpId RegisterWindowMessageW

gdi32

GetStockObject CreateRectRgnIndirect GetMapMode GetBkColor GetTextColor GetRgnBox DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx GetClipBox GetDeviceCaps CreateBitmap Escape ExtTextOutW TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode SetBkMode RestoreDC SaveDC GetObjectW SetBkColor SetTextColor SelectObject

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW XcvDataW OpenPrinterW

advapi32

RegQueryValueW RegOpenKeyW RegDeleteKeyW RegSetValueExW RegEnumKeyW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey

shell32

SHGetPathFromIDListW ShellExecuteExW SHCreateDirectoryExW SHBrowseForFolderW

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW PathFindFileNameW PathIsDirectoryW PathIsDirectoryEmptyW PathFindExtensionW PathStripToRootW PathIsUNCW

oledlg

OleUIBusyW

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CoTaskMemAlloc CoTaskMemFree CLSIDFromProgID CoCreateInstance CoInitializeEx CLSIDFromString CoUninitialize CoInitialize OleUninitialize CoFreeUnusedLibraries OleInitialize CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject

oleaut32

VariantClear SysAllocString SysStringLen SysAllocStringLen VariantChangeType VariantInit VariantCopy SysFreeString SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_87dc754411d744edc5cb0a98daf2aa07_amadey_elex_emotet_floxif_hijackloader_smoke-loader_stop

PE Signature issue

PE Signature issue

mpr

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic