2026-08-09_f5a124ff2452b0a56d881a537f6c7eb0_elex_floxif_mespinoza_smoke-loader

General

Target
2026-08-09_f5a124ff2452b0a56d881a537f6c7eb0_elex_floxif_mespinoza_smoke-loader
Size 247KB
Sample260809-fbzjfszhph
SHA256 17308919f03a731656e391a7e2381f98087329da1e76aa04db20cb1b928eacf5
MD5 f5a124ff2452b0a56d881a537f6c7eb0
SHA1 6bded28bab1150db4bf61aa88f84e210ec12e25e
SHA512 0ff6fa29c33ca27269e02ce9a4186debec64a4bf680c32101e01ecd77a97fdb29c36bda2ae04a19d03b6fd0250eff982dbd79ec71e0a576a5b98309f7c6902bf
SSDEEP 6144:hEBH/FChedUjyAyr5xUTF+TJZnSjXUBV+UdvrEFp7hK8:hEBH/FChedUydFNnSjXUBjvrEH7/
TLSH
T146449D1074C183F9D172143438E8A6716AF9F83D0F6A9A9BB389076D5F3C0D2A635B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_f5a124ff2452b0a56d881a537f6c7eb0_elex_floxif_mespinoza_smoke-loader

File Explorer

2026-08-09_f5a124ff2452b0a56d881a537f6c7eb0_elex_floxif_mespinoza_smoke-loader

.exe 247KB

2026-08-09_f5a124ff2452b0a56d881a537f6c7eb0_elex_floxif_mespinoza_smoke-loader

IMPHASH 23c0ac197de022f3458bab5907ad8210
SHA256 17308919f03a731656e391a7e2381f98087329da1e76aa04db20cb1b928eacf5
MD5 f5a124ff2452b0a56d881a537f6c7eb0
SHA1 6bded28bab1150db4bf61aa88f84e210ec12e25e
SHA512 0ff6fa29c33ca27269e02ce9a4186debec64a4bf680c32101e01ecd77a97fdb29c36bda2ae04a19d03b6fd0250eff982dbd79ec71e0a576a5b98309f7c6902bf
SSDEEP 6144:hEBH/FChedUjyAyr5xUTF+TJZnSjXUBV+UdvrEFp7hK8:hEBH/FChedUydFNnSjXUBjvrEH7/
TLSH
T146449D1074C183F9D172143438E8A6716AF9F83D0F6A9A9BB389076D5F3C0D2A635B27
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

25718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Touch\Documents\Visual Studio 2015\Projects\win10_activator\Release\win10_activator.pdb

kernel32

WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RaiseException RtlUnwind GetLastError FreeLibrary LoadLibraryExW GetModuleFileNameW HeapAlloc HeapFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesExW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetProcessHeap IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA FindClose FindFirstFileExA FindNextFileA SetStdHandle WriteConsoleW ReadConsoleW HeapSize CreateFileW HeapReAlloc Sleep

advapi32

SystemFunction036

Name

.text

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_f5a124ff2452b0a56d881a537f6c7eb0_elex_floxif_mespinoza_smoke-loader

kernel32

advapi32

generic