2026-08-09_d14c21b2ce24a49e8dcf71ae6cbb5731_amadey_elex_emotet_floxif_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_d14c21b2ce24a49e8dcf71ae6cbb5731_amadey_elex_emotet_floxif_smoke-loader_stop
Size 16.7MB
Sample260809-g8fchssdjc
SHA256 6bd8e5840d19abcaa51bdf54bce5049c9ebc258149c937c365ceab9be7d223fd
MD5 d14c21b2ce24a49e8dcf71ae6cbb5731
SHA1 529b528a8f612b968bfb5d442d52c392849a04dc
SHA512 3401f1c49802e3b350143695f2d2ce670978a135793f152b400148e28ad7d7fb13ec6a0c8db2422da9401fbd74e0ec103202546a6f1839ad0fe243efbbbf7ef7
SSDEEP 393216:MlXAG9SOjhME+R8uIHJ3OJoS9fDIb7Bb78v+hANX:4AJwIcHIoS9bsB+WUX
TLSH
T11E072310B7F5C574D29A45318D65ABB560F9FE198E7185CB37C0AF2E2F35882C239B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_d14c21b2ce24a49e8dcf71ae6cbb5731_amadey_elex_emotet_floxif_smoke-loader_stop

File Explorer

2026-08-09_d14c21b2ce24a49e8dcf71ae6cbb5731_amadey_elex_emotet_floxif_smoke-loader_stop

.exe 16.7MB

2026-08-09_d14c21b2ce24a49e8dcf71ae6cbb5731_amadey_elex_emotet_floxif_smoke-loader_stop

IMPHASH bfd4e7a7a3654383c0fcb22c6c706de8
SHA256 6bd8e5840d19abcaa51bdf54bce5049c9ebc258149c937c365ceab9be7d223fd
MD5 d14c21b2ce24a49e8dcf71ae6cbb5731
SHA1 529b528a8f612b968bfb5d442d52c392849a04dc
SHA512 3401f1c49802e3b350143695f2d2ce670978a135793f152b400148e28ad7d7fb13ec6a0c8db2422da9401fbd74e0ec103202546a6f1839ad0fe243efbbbf7ef7
SSDEEP 393216:MlXAG9SOjhME+R8uIHJ3OJoS9fDIb7Bb78v+hANX:4AJwIcHIoS9bsB+WUX
TLSH
T11E072310B7F5C574D29A45318D65ABB560F9FE198E7185CB37C0AF2E2F35882C239B0A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8b:81:3c:7e:39:23:67:05:e7:c9:e9:ca:20:d9:40:6d:e2:e4:40:70:7f:b8:91:02:57:8f:da:c7:fd:47:fb:ad

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Chains

Aug 31, 2021

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

72:b0:af:ed:fb:25:7a:d5:fe:17:b1:8e:11:75:6b:86:01:38:90:db

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Chains

Aug 31, 2021

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Serial Number

01:24:48:10:aa:34:44:fd:8e:ed:dd:b6:02:6e:00:24

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 15, 2020 - Dec 19, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

199064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

v:\admindeployment_win\source\admindeploymenttool\release\Inst.pdb

mpr

WNetAddConnection3W

kernel32

lstrlenA GetThreadLocale SetFilePointer FlushFileBuffers LockFile UnlockFile DuplicateHandle GetVolumeInformationW GetFullPathNameW SetErrorMode GetTickCount FileTimeToLocalFileTime HeapFree HeapAlloc GetProcessHeap GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime RtlUnwind ExitProcess HeapReAlloc RaiseException HeapSize VirtualProtect GetSystemInfo VirtualQuery GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode GetTimeZoneInformation GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFlags GetModuleHandleA GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GetCurrentProcessId SetLastError GlobalAddAtomW GlobalUnlock MulDiv WritePrivateProfileStringW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange GlobalLock lstrcmpW GetModuleHandleW lstrlenW CreateDirectoryW MultiByteToWideChar FileTimeToSystemTime LocalFileTimeToFileTime SetFileTime GetFileAttributesW OutputDebugStringW DosDateTimeToFileTime GetCurrentProcess InterlockedDecrement GetExitCodeProcess CreateProcessW GetFileTime MoveFileExW RemoveDirectoryW DeleteFileW SetFileAttributesW FreeResource GlobalAlloc GlobalFree FindClose FindNextFileW FindFirstFileW ReadFile GetFileSize EndUpdateResourceW GetSystemTime GetTimeFormatW WideCharToMultiByte SetEndOfFile LocalFree FormatMessageW SetStdHandle GetStdHandle GetTempFileNameW GetTempPathW WriteFile WaitNamedPipeW GetLastError CreateFileW CloseHandle WaitForSingleObject GetModuleFileNameW GetProcAddress LoadLibraryW FindResourceW LoadResource LockResource SizeofResource FreeLibrary VirtualAlloc

user32

MessageBeep GetNextDlgGroupItem InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableW CharNextW ReleaseCapture LoadCursorW SetCapture ShowWindow MoveWindow SetWindowTextW IsDialogMessageW DestroyMenu EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetDesktopWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextW GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow UpdateWindow GetMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx EqualRect CopyRect UnregisterClassA IsIconic SendMessageW GetSystemMetrics GetClientRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW SetWindowLongW OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement UnhookWindowsHookEx GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled SetCursor GetMenuItemID GetMenuItemCount GetSubMenu PostThreadMessageW RegisterClipboardFormatW GetWindow UnregisterClassW CharUpperW SetActiveWindow DrawIcon GetWindowRect LoadBitmapW GetSysColorBrush LoadIconW EnableWindow IsWindow PostMessageW MessageBoxW PostQuitMessage CheckMenuItem EnableMenuItem GetMenuState ModifyMenuW GetParent GetFocus GetMenuCheckMarkDimensions SetMenuItemBitmaps ValidateRect GetCursorPos PeekMessageW GetKeyState IsWindowVisible GetActiveWindow DispatchMessageW TranslateMessage GetMessageW CallNextHookEx SetWindowsHookExW SetWindowPos MapDialogRect SetWindowContextHelpId RegisterWindowMessageW

gdi32

GetStockObject CreateRectRgnIndirect GetMapMode GetBkColor GetTextColor GetRgnBox DeleteDC ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx GetClipBox GetDeviceCaps CreateBitmap Escape ExtTextOutW TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx DeleteObject SetMapMode SetBkMode RestoreDC SaveDC GetObjectW SetBkColor SetTextColor SelectObject

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW XcvDataW OpenPrinterW

advapi32

RegQueryValueW RegOpenKeyW RegDeleteKeyW RegSetValueExW RegEnumKeyW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey

shell32

SHGetPathFromIDListW ShellExecuteExW SHCreateDirectoryExW SHBrowseForFolderW

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW PathFindFileNameW PathIsDirectoryW PathIsDirectoryEmptyW PathFindExtensionW PathStripToRootW PathIsUNCW

oledlg

OleUIBusyW

ole32

CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CoTaskMemAlloc CoTaskMemFree CLSIDFromProgID CoCreateInstance CoInitializeEx CLSIDFromString CoUninitialize CoInitialize OleUninitialize CoFreeUnusedLibraries OleInitialize CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject

oleaut32

VariantClear SysAllocString SysStringLen SysAllocStringLen VariantChangeType VariantInit VariantCopy SysFreeString SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_d14c21b2ce24a49e8dcf71ae6cbb5731_amadey_elex_emotet_floxif_smoke-loader_stop

PE Signature issue

PE Signature issue

mpr

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic