2026-07-30_431fafa8c4989b5eadbe219630472902_amadey_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_431fafa8c4989b5eadbe219630472902_amadey_elex_smoke-loader_stop
Size 21.6MB
Sample260730-gff4ca1cmf
SHA256 180a81d0e184fc245546e5f7fc39027736594f04299a08ce50977b13f84b64fe
MD5 431fafa8c4989b5eadbe219630472902
SHA1 159b5707ada33591952a8b506623d9ae442dc9fc
SHA512 51174805bdc310a52628000dbc1d4b8065bdbd3b681d91e3b68dcaeca446ab72930ca00c6f0a389fea0fcca079f9ea156dbdf28f402e16916c32c4820813792c
SSDEEP 393216:kpT7JkeljkHvkaXw6L1JIJUCTHz8IImOhmAEtCg3Q9ClGKkFC5SJn+3vU7aiEa3H:kpnJBljkPkaX3pJIZ8IInmAK3qCoKsH9
TLSH
T14C3733167A81C0F6E9F22671455A8729359075D40FB687CFE3DA03AD6FC90E60ABC36C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-07-30_431fafa8c4989b5eadbe219630472902_amadey_elex_smoke-loader_stop

File Explorer

2026-07-30_431fafa8c4989b5eadbe219630472902_amadey_elex_smoke-loader_stop

.exe 21.6MB

2026-07-30_431fafa8c4989b5eadbe219630472902_amadey_elex_smoke-loader_stop

IMPHASH c37a0cf32fb77a9ca8948933d9037856
SHA256 180a81d0e184fc245546e5f7fc39027736594f04299a08ce50977b13f84b64fe
MD5 431fafa8c4989b5eadbe219630472902
SHA1 159b5707ada33591952a8b506623d9ae442dc9fc
SHA512 51174805bdc310a52628000dbc1d4b8065bdbd3b681d91e3b68dcaeca446ab72930ca00c6f0a389fea0fcca079f9ea156dbdf28f402e16916c32c4820813792c
SSDEEP 393216:kpT7JkeljkHvkaXw6L1JIJUCTHz8IImOhmAEtCg3Q9ClGKkFC5SJn+3vU7aiEa3H:kpnJBljkPkaX3pJIZ8IInmAK3qCoKsH9
TLSH
T14C3733167A81C0F6E9F22671455A8729359075D40FB687CFE3DA03AD6FC90E60ABC36C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

6b:52:bd:15:8d:d5:eb:52:8c:ba:ed:20:77:9f:69:4c:2d:0e:28:88

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Mar 18, 2025

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Serial Number

01:68:45:30:aa:5d:df:40:76:e5:44:eb:fc:91:b8:8f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 6, 2024 - Sep 7, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

83871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteExW SHGetMalloc

user32

RegisterClassW DefWindowProcW GetWindowWord SetWindowWord BeginPaint GetSysColor GetClientRect SetRect EndPaint LoadCursorW ShowWindow GetLastActivePopup PostMessageW EnableWindow SendMessageW GetTopWindow SetWindowLongW GetWindowLongW SetForegroundWindow DialogBoxParamW SetDlgItemTextW EndDialog GetWindowRect GetSystemMetrics SetWindowPos OemToCharA SetTimer GetMessageW PostQuitMessage KillTimer LoadIconW PeekMessageW TranslateMessage DispatchMessageW SetCursor GetParent SendDlgItemMessageW GetDlgItem InvalidateRect UpdateWindow MessageBoxW SetWindowTextW GetDlgItemTextW SetActiveWindow LoadStringW

kernel32

LCMapStringW LCMapStringA HeapReAlloc HeapSize IsValidCodePage GetOEMCP GetACP GetCPInfo SetEndOfFile GetConsoleMode GetConsoleCP FindClose FindFirstFileW SetCurrentDirectoryW LocalFileTimeToFileTime DosDateTimeToFileTime LocalAlloc GetVolumeInformationW CreateDirectoryW DeleteFileW LoadLibraryA RemoveDirectoryW CloseHandle CreateFileW GlobalFree GlobalUnlock GlobalHandle GlobalLock GlobalAlloc GetModuleFileNameW GlobalMemoryStatus GetVersion GetVersionExW WriteFile GetSystemTime CreateProcessW LocalFree FormatMessageW GetLastError ExitProcess MoveFileExW FindNextFileW GetTickCount WaitForSingleObject SetErrorMode CreateFileA ReadFile SetFilePointer InitializeCriticalSection WriteConsoleA GetConsoleOutputCP WriteConsoleW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFileAttributesW FlushFileBuffers SetFileTime Sleep LeaveCriticalSection EnterCriticalSection SetStdHandle GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter VirtualAlloc VirtualFree FileTimeToSystemTime FileTimeToLocalFileTime GetFullPathNameW GetLocalTime GetProcAddress GetWindowsDirectoryW GetEnvironmentVariableW GetModuleHandleA MultiByteToWideChar WideCharToMultiByte GetDriveTypeW HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW RtlUnwind GetFileType TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate

gdi32

SetTextColor SetTextAlign GetBkColor GetTextExtentPoint32W ExtTextOutW CreateDCW GetDeviceCaps CreateFontIndirectW DeleteDC SelectObject DeleteObject SetBkColor

comctl32

ord17

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_431fafa8c4989b5eadbe219630472902_amadey_elex_smoke-loader_stop

shell32

user32

kernel32

gdi32

comctl32

generic