2026-08-01_0daeb17fd127e3677a86cd44e4050e28_amadey_elex_smoke-loader_stop_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_0daeb17fd127e3677a86cd44e4050e28_amadey_elex_smoke-loader_stop_virut
Size 2.1MB
Sample260801-eckw1sdb96
SHA256 6de84e3d432431b4e067bff96ba207ced0234177b24004f50573172db38b84c5
MD5 0daeb17fd127e3677a86cd44e4050e28
SHA1 0ed702e1a801d404e382043e6594c5518fc9cc31
SHA512 adf2030d7dff2a15ce5cb033906b641a3fef84f0355123811840df7317086042b377ea231f0ebccbbc055aaf323a48cc012a27638fa2d3a9aa80b13e8c046bae
SSDEEP 3072:BQaqh0/Stf+9dAishTf4p89WN6Tvbx6lb2vmyVZwinNUObchH/KSsbCxVdLtikti:BQabT9aTY89vFmb2vmGZvNickt5dZnU
TLSH
T1ECA57C62BBCAC1B3C89B257144A7971AF733FA521F1284C773982B1E6D323D16936246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-01_0daeb17fd127e3677a86cd44e4050e28_amadey_elex_smoke-loader_stop_virut

File Explorer

2026-08-01_0daeb17fd127e3677a86cd44e4050e28_amadey_elex_smoke-loader_stop_virut

.exe 2.1MB

2026-08-01_0daeb17fd127e3677a86cd44e4050e28_amadey_elex_smoke-loader_stop_virut

IMPHASH ad764df29b9db688ceea77ad8d979574
SHA256 6de84e3d432431b4e067bff96ba207ced0234177b24004f50573172db38b84c5
MD5 0daeb17fd127e3677a86cd44e4050e28
SHA1 0ed702e1a801d404e382043e6594c5518fc9cc31
SHA512 adf2030d7dff2a15ce5cb033906b641a3fef84f0355123811840df7317086042b377ea231f0ebccbbc055aaf323a48cc012a27638fa2d3a9aa80b13e8c046bae
SSDEEP 3072:BQaqh0/Stf+9dAishTf4p89WN6Tvbx6lb2vmyVZwinNUObchH/KSsbCxVdLtikti:BQabT9aTY89vFmb2vmGZvNickt5dZnU
TLSH
T1ECA57C62BBCAC1B3C89B257144A7971AF733FA521F1284C773982B1E6D323D16936246
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

b8:e2:fa:a3:25:2d:82:6e:c2:9b:bb:c1:50:16:30:0e

Digest Algorithm

md5

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2009

Subject

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Serial Number

03:8c:44:aa:a0:77:57:41:9c:b3:91:07:99:2a:3a:73

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 21, 2005 - Sep 21, 2006

Minor OS version

Major OS version

Entry point

2225599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

U:\develop\global\Release\bin\acad\WSCommCntr.pdb

kernel32

GetModuleFileNameW LocalAlloc FormatMessageW CreateDirectoryW GetFileAttributesW CloseHandle OpenProcess DeleteFileW LocalFree WaitForSingleObject SetEvent CancelWaitableTimer WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerW CreateThread LeaveCriticalSection RaiseException GetLastError Sleep GetModuleHandleW GetCurrentThreadId GetCommandLineW SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle EnterCriticalSection lstrlenW InterlockedDecrement InterlockedIncrement DeleteCriticalSection CreateEventW InitializeCriticalSection GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP LoadLibraryA GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings GetLocaleInfoA FreeEnvironmentStringsA GetTimeZoneInformation WideCharToMultiByte GetDateFormatA GetTimeFormatA MultiByteToWideChar GetOEMCP GetACP GetCPInfo HeapSize ExitProcess VirtualFree SetFilePointer GetVersionExA HeapFree RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapReAlloc VirtualProtect VirtualAlloc GetProcAddress GetModuleHandleA GetSystemInfo VirtualQuery GetSystemTimeAsFileTime GetProcessHeap GetStartupInfoW WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapDestroy HeapCreate

user32

CharUpperBuffW TranslateMessage DispatchMessageW SetTimer PostThreadMessageW CharNextW CharUpperW GetMessageW UnregisterClassA

advapi32

RegDeleteKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryInfoKeyW

shell32

SHGetFolderPathW

ole32

CLSIDFromString CoUninitialize CoInitializeEx CoDisconnectObject CoRevokeClassObject CoRegisterClassObject StringFromGUID2 CoInitialize CoCreateInstance

oleaut32

RegisterTypeLi UnRegisterTypeLi VariantChangeType VarBstrCat SysAllocStringLen SafeArrayCreate SafeArrayRedim SafeArrayDestroy VariantCopy VariantClear SafeArrayCopy VariantInit VarBstrCmp SafeArrayUnlock SafeArrayGetVartype SafeArrayGetLBound SafeArrayGetUBound LoadTypeLi LoadRegTypeLi SysStringLen SysStringByteLen SysAllocStringByteLen SysAllocString SysFreeString SafeArrayLock

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_0daeb17fd127e3677a86cd44e4050e28_amadey_elex_smoke-loader_stop_virut

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic