2026-07-30_ea5729039b72ed69d8a9768a21fdd9f5_amadey_elex_floxif_glassworm_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_ea5729039b72ed69d8a9768a21fdd9f5_amadey_elex_floxif_glassworm_smoke-loader
Size 6.7MB
Sample260730-va84tsce24
SHA256 65d8ff868699bfe91f1d548f1dc9b66f00981a57394ea6e8645da66a89c7b4b0
MD5 ea5729039b72ed69d8a9768a21fdd9f5
SHA1 b74732ed126d189dcd6f7bffd10fb951269ca1e2
SHA512 459f328a2326f53c5ef5665a73ca24e41e8c7c0a339044353a454f01066696aea814cd3cb363a06558a14b6433972124aa927ef9e75ae74b0f2256a52a46db20
SSDEEP 49152:D3QVGCKKbTbbZzOIniBJy0BK7JHCRrdfOzsOaR0IxEgkUAU/gRE3RhgJIC9weS6h:D3QwCKwPN1qBkJajAsj64/gZ85XH9jE
TLSH
T1AB66AF06FE9F42B1C86A037005AF22266B345FCE773647DB5294BC94E9333DA057A768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_ea5729039b72ed69d8a9768a21fdd9f5_amadey_elex_floxif_glassworm_smoke-loader

File Explorer

2026-07-30_ea5729039b72ed69d8a9768a21fdd9f5_amadey_elex_floxif_glassworm_smoke-loader

.exe 6.7MB

2026-07-30_ea5729039b72ed69d8a9768a21fdd9f5_amadey_elex_floxif_glassworm_smoke-loader

IMPHASH e39d31926c2a9a61bce453bce5997787
SHA256 65d8ff868699bfe91f1d548f1dc9b66f00981a57394ea6e8645da66a89c7b4b0
MD5 ea5729039b72ed69d8a9768a21fdd9f5
SHA1 b74732ed126d189dcd6f7bffd10fb951269ca1e2
SHA512 459f328a2326f53c5ef5665a73ca24e41e8c7c0a339044353a454f01066696aea814cd3cb363a06558a14b6433972124aa927ef9e75ae74b0f2256a52a46db20
SSDEEP 49152:D3QVGCKKbTbbZzOIniBJy0BK7JHCRrdfOzsOaR0IxEgkUAU/gRE3RhgJIC9weS6h:D3QwCKwPN1qBkJajAsj64/gZ85XH9jE
TLSH
T1AB66AF06FE9F42B1C86A037005AF22266B345FCE773647DB5294BC94E9333DA057A768
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2713993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentDirectoryA GetFullPathNameA GetConsoleMode SetConsoleMode ReadConsoleInputA FileTimeToLocalFileTime FileTimeToSystemTime IsBadCodePtr IsBadReadPtr SetConsoleCtrlHandler RaiseException FlushConsoleInputBuffer lstrlenA GetLocaleInfoA VirtualProtect SetStdHandle SetEnvironmentVariableA GetOEMCP GetACP CompareStringW GetCPInfo CompareStringA VirtualQuery InterlockedExchange GetStringTypeW LCMapStringW LCMapStringA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle HeapSize IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy RtlUnwind HeapReAlloc ExitProcess GetCommandLineA GetStartupInfoA GetSystemTimeAsFileTime HeapAlloc HeapFree SetLastError GetModuleHandleA MoveFileExA LocalAlloc LocalLock LocalUnlock LocalFree GetSystemInfo GlobalMemoryStatus GetWindowsDirectoryA GetDriveTypeA GetVolumeInformationA GetTimeZoneInformation GetSystemDefaultLangID GetSystemDefaultLCID GetComputerNameA GetCurrentThreadId GetTickCount GetVersion GetSystemDirectoryA SetEndOfFile FlushFileBuffers WriteFile UnlockFile LockFile ReadFile SetFilePointer FindResourceA LoadResource LockResource SizeofResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetVersionExA FreeLibrary GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameA SetErrorMode LoadLibraryA GetProcAddress GetProfileStringA InterlockedDecrement CreateProcessA RemoveDirectoryA GetExitCodeProcess OpenProcess TerminateProcess CreateEventA ResetEvent CreateFileMappingA MapViewOfFile WaitForSingleObject GetCurrentProcess DuplicateHandle Beep CreateFileA GetFileSize CloseHandle GetDiskFreeSpaceA FindFirstFileA FindNextFileA FindClose GetLastError SetFileAttributesA MultiByteToWideChar WideCharToMultiByte SetUnhandledExceptionFilter DeleteFileA Sleep CreateDirectoryA GetStringTypeA

user32

PeekMessageA GetQueueStatus GetMessageA DestroyWindow GetClientRect SetFocus ShowWindow CreateWindowExA GetSystemMetrics SystemParametersInfoA RegisterClassA LoadCursorA LoadIconA wsprintfA ReleaseDC DrawIcon GetWindowDC TranslateMessage GetWindowLongA SetWindowLongA EndPaint BeginPaint DefWindowProcA FillRect SetRect MessageBoxA GetKeyboardState GetDC EnumDisplaySettingsA ShowCaret SetCaretPos CreateCaret HideCaret EnumWindows SendMessageA InvalidateRect DispatchMessageA SetWindowPos PtInRect GetWindowThreadProcessId PostMessageA WaitForInputIdle KillTimer LoadImageA SetTimer FrameRect CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetClipboardData GetKeyState SetScrollPos GetFocus GetUpdateRect PostQuitMessage GetCursorPos RegisterClassExA SetScrollInfo ShowScrollBar UpdateWindow GetDesktopWindow

winspool.drv

ClosePrinter EndDocPrinter StartDocPrinterA WritePrinter StartPagePrinter EndPagePrinter OpenPrinterA DocumentPropertiesA DeviceCapabilitiesA

gdi32

LineTo PaintRgn GetObjectA CreateHalftonePalette GetDIBColorTable CreatePalette SelectPalette RealizePalette PtInRegion EndDoc AbortDoc StartDocA GetEnhMetaFileBits DeleteEnhMetaFile EndPage StartPage Escape SetTextCharacterExtra PatBlt MoveToEx GetTextMetricsA StretchBlt SetStretchBltMode GetTextExtentPointA SetTextAlign CreateBitmap SetBkMode GetRgnBox SelectClipRgn FrameRgn BitBlt CreateFontIndirectA SetTextColor CreatePen SetBkColor CreateSolidBrush SelectObject DeleteObject GetStockObject CreateCompatibleDC GetDeviceCaps DeleteDC CreateRectRgn SetRectRgn CombineRgn CreateEnhMetaFileA CreateCompatibleBitmap CreateDCA PlayEnhMetaFile SetEnhMetaFileBits GetEnhMetaFileHeader GetDIBits SetTextJustification TextOutA CloseEnhMetaFile

wininet

HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA InternetQueryDataAvailable HttpQueryInfoA HttpEndRequestA InternetAttemptConnect InternetWriteFile HttpSendRequestExA InternetQueryOptionA InternetCrackUrlA InternetCanonicalizeUrlA InternetCreateUrlA InternetSetOptionA InternetCloseHandle FtpOpenFileA InternetSetFilePointer InternetReadFile

wsock32

gethostbyname ioctlsocket ntohs htonl closesocket connect recv send WSAGetLastError htons shutdown WSASetLastError accept WSAAsyncSelect WSACleanup WSAStartup socket inet_addr gethostbyaddr getsockname ntohl

odbc32

ord75 ord41 ord11 ord36 ord18 ord16 ord14 ord15 ord13 ord4 ord27 ord24

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA CryptReleaseContext CryptGenRandom RegEnumValueA RegEnumKeyExA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegSetKeySecurity RegSetValueExA RegDeleteKeyA RegCreateKeyExA CryptAcquireContextA

rpcrt4

UuidFromStringA

rasapi32

RasHangUpA

ole32

CoInitialize CoCreateGuid CoCreateInstance CLSIDFromProgID CoUninitialize

oleaut32

SysAllocString VariantClear GetErrorInfo VariantInit SysFreeString

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

88KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

144KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=3, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=5, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=95, version=2179,

count=13, id=28, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=14, version=7299,

count=5, id=105, version=2067,

count=243, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=96, version=2179,

count=2, id=28, version=9177,

count=2, id=25, version=9111,

count=2, id=93, version=2067,

count=23, id=93, version=2179,

count=343, id=1, productName=Unmarked objects,

count=157, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=34, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=372, productName=Unmarked objects (old),

count=408, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,