2026-08-09_a9008e0536a630ba6e0d517809204761_amadey_elex_floxif_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_a9008e0536a630ba6e0d517809204761_amadey_elex_floxif_smoke-loader_stop
Size 432KB
Sample260809-219llser3t
SHA256 05bd9116e1a36bdd81c440bfdfdc1d5735695d92ab3aec8f1715cb522a4918d8
MD5 a9008e0536a630ba6e0d517809204761
SHA1 29c7c66be01e6045eea71d9066a74b49799c1d14
SHA512 3e6085560aa38142bc5c85e9e2b3f526322ae51b53235339cc3be771330025b1ea4bc17c9616ad21626239de1e9a070d1b9abf8e7bda0ce3a2b7def83b0f159d
SSDEEP 6144:clIo1bqQrnkLQkADGLMWHCq79Zh34UH/ath3E4pBV+UdvrEFp7hKNZnV:exbxnWADGQWH179ZBXH/EpBjvrEH7i
TLSH
T15E944A0273E58275F2F32B31BD7982714AB7BC359C39C20E2390262D9EB5A51DA64737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_a9008e0536a630ba6e0d517809204761_amadey_elex_floxif_smoke-loader_stop

File Explorer

2026-08-09_a9008e0536a630ba6e0d517809204761_amadey_elex_floxif_smoke-loader_stop

.exe 432KB

2026-08-09_a9008e0536a630ba6e0d517809204761_amadey_elex_floxif_smoke-loader_stop

IMPHASH 96af6612ec5da507d35ee29ab1ba393d
SHA256 05bd9116e1a36bdd81c440bfdfdc1d5735695d92ab3aec8f1715cb522a4918d8
MD5 a9008e0536a630ba6e0d517809204761
SHA1 29c7c66be01e6045eea71d9066a74b49799c1d14
SHA512 3e6085560aa38142bc5c85e9e2b3f526322ae51b53235339cc3be771330025b1ea4bc17c9616ad21626239de1e9a070d1b9abf8e7bda0ce3a2b7def83b0f159d
SSDEEP 6144:clIo1bqQrnkLQkADGLMWHCq79Zh34UH/ath3E4pBV+UdvrEFp7hKNZnV:exbxnWADGQWH179ZBXH/EpBjvrEH7i
TLSH
T15E944A0273E58275F2F32B31BD7982714AB7BC359C39C20E2390262D9EB5A51DA64737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8b:8b:bf:70:2c:0f:b5:13:74:54:17:f3:a5:3c:cb:73:fe:51:67:b1

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems\, Incorporated,OU=Acrobat XI,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 5, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 7, 2012 - Jun 6, 2022

Subject

Serial Number

68:ad:d7:af:fc:72:18:3c:31:86:5a:cd:3c:b2:d7:0c

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 30, 2013 - Jul 25, 2014

Minor OS version

Major OS version

Entry point

102054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\CB\11X_MainQ\Acrobat\Installers\BootStrapExe_Small\Release\Setup.pdb

msi

ord92 ord205 ord171 ord281 ord32 ord70 ord240 ord195 ord159 ord160 ord118 ord141 ord88 ord8 ord19 ord137

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree lstrlenA GetModuleHandleA GlobalFlags WritePrivateProfileStringW GetFileAttributesW GetFileSizeEx GetFileTime SetErrorMode GetStartupInfoW GetSystemTimeAsFileTime RtlUnwind HeapAlloc HeapFree RaiseException LeaveCriticalSection ExitThread CreateThread ExitProcess SetStdHandle GetFileType HeapSize SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW VirtualAlloc InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetTimeZoneInformation LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryA GetDriveTypeA CreateFileA SetEnvironmentVariableA LocalAlloc InterlockedDecrement InterlockedIncrement CreateFileW GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile FindFirstFileW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW FindClose GetCurrentProcessId GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetModuleFileNameW lstrcmpA GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange CreateEventW SuspendThread SetEvent SetThreadPriority GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA lstrcmpW GetVersionExA WideCharToMultiByte MultiByteToWideChar SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock lstrlenW MulDiv SetCurrentDirectoryW DeleteFileW GetTempFileNameW FreeResource GetUserDefaultUILanguage ExpandEnvironmentStringsW GetPrivateProfileStringW GetVersionExW GetModuleHandleW GetCurrentProcess GetSystemInfo GetTempPathW CreateProcessW GetLastError WaitForSingleObject GetExitCodeProcess CloseHandle GetSystemDirectoryW GetCurrentDirectoryW GetUserDefaultLangID LoadLibraryW GetProcAddress FreeLibrary Sleep ResumeThread GetThreadPriority FormatMessageW LocalFree FindResourceW LoadResource LockResource SizeofResource HeapReAlloc

user32

ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetDC ReleaseDC GetSysColorBrush CharUpperW SetCursor GetWindowThreadProcessId PostQuitMessage GetMessageW TranslateMessage GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem RegisterWindowMessageW LoadIconW SendDlgItemMessageA WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetForegroundWindow GetLastActivePopup DispatchMessageW GetTopWindow UnhookWindowsHookEx GetMessageTime PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow IsWindowVisible UpdateWindow GetClientRect MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect PtInRect GetMenu SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetSystemMetrics GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow GetNextDlgTabItem GetWindowTextW GetFocus GetParent SetWindowPos SetFocus IsWindowEnabled ShowWindow SetWindowLongW GetDlgCtrlID IsWindow SetWindowTextW GetWindowLongW IsDialogMessageW SendDlgItemMessageW UnregisterClassW DestroyMenu EndPaint GetMessagePos BeginPaint GetDlgItem GetWindow GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu PostMessageW EndDialog EnableWindow KillTimer SetTimer SendMessageW

gdi32

SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx DeleteDC GetStockObject OffsetViewportOrgEx Escape SetViewportOrgEx ExtTextOutW TextOutW RectVisible PtVisible SetMapMode RestoreDC SaveDC CreateBitmap GetObjectW SetBkColor SetTextColor GetClipBox GetDeviceCaps DeleteObject SelectObject

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegQueryValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownW OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatusEx RegCreateKeyW RegOpenKeyExW RegCreateKeyExW RegSetValueExW RegCloseKey

shell32

SHGetSpecialFolderPathW

shlwapi

StrFormatByteSizeW PathFindExtensionW PathStripToRootW PathIsUNCW PathFileExistsW PathFindFileNameW

ole32

CoUninitialize CoCreateInstance CoInitialize

oleaut32

VariantInit VariantChangeType VariantClear

urlmon

URLDownloadToFileW

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_a9008e0536a630ba6e0d517809204761_amadey_elex_floxif_smoke-loader_stop

PE Signature issue

msi

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

urlmon

oleacc

generic