2026-08-04_68d49b88af40df253c128d75f6045f14_amadey_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_68d49b88af40df253c128d75f6045f14_amadey_elex_smoke-loader
Size 6.5MB
Sample260805-a5ztesbb93
SHA256 de03298f84b7623f308c544f821f808acd4dfb5490ba1b3a489484c55ec8f657
MD5 68d49b88af40df253c128d75f6045f14
SHA1 bb02e002e36ecfec1442c4237d94dc738a9029eb
SHA512 faf4a32cf5b698265dfe2785f15e0e3f8ad02834ae3b4de1a3e0a9b851a4f5a71962c937c1ab4a941fb63f02cc9e571a05659cf352f465652d169ec91f2933b2
SSDEEP 49152:Fa/SqeeOtVrw7LU5Q0DpvSZ0S7UI8iaa6Nb4jdxeCPCfTE+3ND8aV9GFsQ6CTymN:Ftqap5yL7UI8i+4jdx87PD8s9G6m
TLSH
T16066AE10F2D2D0A6C4A505B042EFB6F6A5303F254F2496D3B790BF6EB8717D1983629E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_68d49b88af40df253c128d75f6045f14_amadey_elex_smoke-loader

File Explorer

2026-08-04_68d49b88af40df253c128d75f6045f14_amadey_elex_smoke-loader

.exe 6.5MB

2026-08-04_68d49b88af40df253c128d75f6045f14_amadey_elex_smoke-loader

IMPHASH a0e22a78cf43682fd7392bfb44407ef1
SHA256 de03298f84b7623f308c544f821f808acd4dfb5490ba1b3a489484c55ec8f657
MD5 68d49b88af40df253c128d75f6045f14
SHA1 bb02e002e36ecfec1442c4237d94dc738a9029eb
SHA512 faf4a32cf5b698265dfe2785f15e0e3f8ad02834ae3b4de1a3e0a9b851a4f5a71962c937c1ab4a941fb63f02cc9e571a05659cf352f465652d169ec91f2933b2
SSDEEP 49152:Fa/SqeeOtVrw7LU5Q0DpvSZ0S7UI8iaa6Nb4jdxeCPCfTE+3ND8aV9GFsQ6CTymN:Ftqap5yL7UI8i+4jdx87PD8s9G6m
TLSH
T16066AE10F2D2D0A6C4A505B042EFB6F6A5303F254F2496D3B790BF6EB8717D1983629E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1133912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\（◆開発用ディレクトリ）\[▼作業用]プログラム\RPGドライブプログラム＋◆Editor - 20180525_ver2.24版_SteamKit版込\Rpgドライブプログラム\Release\Game2.25.pdb

shlwapi

PathFileExistsA PathIsDirectoryA

psapi

GetProcessMemoryInfo

kernel32

GetProcAddress LoadLibraryW GetModuleFileNameW GetVersionExA InterlockedExchange GetACP GetLocaleInfoA GetTickCount CreateDirectoryA SetCurrentDirectoryA FindClose FindNextFileA FindFirstFileA GetCurrentDirectoryA GetModuleFileNameA lstrcpyA GlobalAlloc GlobalUnlock GlobalLock DeleteFileA CopyFileA RemoveDirectoryA OutputDebugStringA CloseHandle Sleep GetExitCodeThread GlobalMemoryStatusEx OpenProcess GetCurrentProcessId GetDiskFreeSpaceExA lstrlenA CreateFileA GetLastError FreeLibrary FlushFileBuffers InitializeCriticalSection DeleteCriticalSection RaiseException GetFileAttributesA GetStdHandle InterlockedDecrement InterlockedIncrement SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoW SetEndOfFile GetSystemInfo VirtualProtect SetStdHandle IsBadCodePtr IsBadReadPtr GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA VirtualQuery UnhandledExceptionFilter GetTimeZoneInformation LCMapStringW WideCharToMultiByte LCMapStringA GetFileType SetFilePointer HeapReAlloc WriteFile SetHandleCount ReadFile GetProcessHeap GetStringTypeW GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetCPInfo LeaveCriticalSection GetOEMCP SetUnhandledExceptionFilter IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy RtlUnwind ExitProcess GetSystemTimeAsFileTime HeapFree HeapAlloc GetModuleHandleA TerminateProcess GetCurrentProcess MoveFileA MultiByteToWideChar LoadLibraryA DebugBreak ExitThread GetCurrentThreadId CreateThread GetDriveTypeA GetFullPathNameA GetStartupInfoA GetCommandLineA TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue QueryPerformanceCounter EnterCriticalSection HeapSize

user32

EnumDisplayMonitors SetFocus ShowWindow SetWindowPos GetWindowRect CreateDialogParamA SendDlgItemMessageA GetScrollPos GetDlgItem DestroyWindow CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetClipboardData IsClipboardFormatAvailable SendMessageA GetSystemMetrics GetDC ReleaseDC GetCursorPos MonitorFromPoint ClipCursor GetMonitorInfoA CharNextA ClientToScreen MessageBoxA

gdi32

RemoveFontResourceExA AddFontResourceExA GetDeviceCaps

shell32

ShellExecuteA

wininet

InternetCloseHandle InternetReadFile HttpQueryInfoA InternetOpenUrlA InternetOpenA

winmm

timeGetTime

steam_api

SteamUserStats SteamUser SteamAPI_RunCallbacks SteamController SteamClient SteamAPI_Init SteamAPI_RestartAppIfNecessary SteamAPI_RegisterCallback SteamAPI_UnregisterCallback SteamUtils

advapi32

RegCloseKey

generic

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=196, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=57, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=8, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=79, id=110, productName=VS2005 build 50727, version=50727,

count=2, id=105, version=2067,

count=32, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=58, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=190, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=93, version=2067,

count=12, id=93, version=2179,

count=5, id=25, version=9210,

count=174, id=1, productName=Unmarked objects,

count=2, id=97, version=3077,

count=3, id=98, version=3077,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,