2026-08-09_eb4f36395417f580ca46d40ee1ea7309_elex_floxif_mespinoza_smoke-loader

General

Target
2026-08-09_eb4f36395417f580ca46d40ee1ea7309_elex_floxif_mespinoza_smoke-loader
Size 247KB
Sample260809-fd4aes1aka
SHA256 afb6c0a59bfb89379f668e4bc44ffa70699d6e66d614a71f6da926747f3843c2
MD5 eb4f36395417f580ca46d40ee1ea7309
SHA1 815c4ff332058eebc8a322dc9e0f1a8f4f028822
SHA512 d7d38ef85837b3c23a1eaf971f2c509e38b50fcca531342424aa4dee59e18bbbfc9eae5ca1df444470537c5dd3da6c14308db3ff7361195d095dfe409539e42d
SSDEEP 6144:hEBH/FChedUjykyrgZYUTF+TJZnSjXUBV+UdvrEFp7hK+:hEBH/FChedUyhE6nSjXUBjvrEH7Z
TLSH
T1CD449D1074C183F9D172143038F8A6716AF9F83D0B6A9A9BB389076D5F7C0D26A35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_eb4f36395417f580ca46d40ee1ea7309_elex_floxif_mespinoza_smoke-loader

File Explorer

2026-08-09_eb4f36395417f580ca46d40ee1ea7309_elex_floxif_mespinoza_smoke-loader

.exe 247KB

2026-08-09_eb4f36395417f580ca46d40ee1ea7309_elex_floxif_mespinoza_smoke-loader

IMPHASH 23c0ac197de022f3458bab5907ad8210
SHA256 afb6c0a59bfb89379f668e4bc44ffa70699d6e66d614a71f6da926747f3843c2
MD5 eb4f36395417f580ca46d40ee1ea7309
SHA1 815c4ff332058eebc8a322dc9e0f1a8f4f028822
SHA512 d7d38ef85837b3c23a1eaf971f2c509e38b50fcca531342424aa4dee59e18bbbfc9eae5ca1df444470537c5dd3da6c14308db3ff7361195d095dfe409539e42d
SSDEEP 6144:hEBH/FChedUjykyrgZYUTF+TJZnSjXUBV+UdvrEFp7hK+:hEBH/FChedUyhE6nSjXUBjvrEH7Z
TLSH
T1CD449D1074C183F9D172143038F8A6716AF9F83D0B6A9A9BB389076D5F7C0D26A35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

25718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Touch\Documents\Visual Studio 2015\Projects\win10_activator\Release\win10_activator.pdb

kernel32

WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RaiseException RtlUnwind GetLastError FreeLibrary LoadLibraryExW GetModuleFileNameW HeapAlloc HeapFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesExW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetProcessHeap IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA FindClose FindFirstFileExA FindNextFileA SetStdHandle WriteConsoleW ReadConsoleW HeapSize CreateFileW HeapReAlloc Sleep

advapi32

SystemFunction036

Name

.text

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_eb4f36395417f580ca46d40ee1ea7309_elex_floxif_mespinoza_smoke-loader

kernel32

advapi32

generic