2026-08-09_9a32557aadad68b3dbbdca54d93da626_elex_floxif_mespinoza_smoke-loader

General

Target
2026-08-09_9a32557aadad68b3dbbdca54d93da626_elex_floxif_mespinoza_smoke-loader
Size 247KB
Sample260809-hdj8naar2x
SHA256 444a7cdd134835aae8e102fb188456782a3ba5dc599490929560b5f60c74f031
MD5 9a32557aadad68b3dbbdca54d93da626
SHA1 5f17a26f496059b36ead0ce1c7d2efd53ded03d4
SHA512 6619ad89d52dd5c0ebb119d731c5b9e0f10dc9416e1a2706f39969d7b330ef70b98537842c070292b8624f2bbdeef0fafa6073d80201b3eb141ff2f05cca5b79
SSDEEP 6144:hEBH/FChedUjy4yrnZYUTFZoTJZnSjXUBV+UdvrEFp7hKeJ:hEBH/FChedUyF776nSjXUBjvrEH7p
TLSH
T143449D1075C183F9E172143038F8A6715AF9F83D0B6A9A9BA399076D4F7C0D26B31B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_9a32557aadad68b3dbbdca54d93da626_elex_floxif_mespinoza_smoke-loader

File Explorer

2026-08-09_9a32557aadad68b3dbbdca54d93da626_elex_floxif_mespinoza_smoke-loader

.exe 247KB

2026-08-09_9a32557aadad68b3dbbdca54d93da626_elex_floxif_mespinoza_smoke-loader

IMPHASH 23c0ac197de022f3458bab5907ad8210
SHA256 444a7cdd134835aae8e102fb188456782a3ba5dc599490929560b5f60c74f031
MD5 9a32557aadad68b3dbbdca54d93da626
SHA1 5f17a26f496059b36ead0ce1c7d2efd53ded03d4
SHA512 6619ad89d52dd5c0ebb119d731c5b9e0f10dc9416e1a2706f39969d7b330ef70b98537842c070292b8624f2bbdeef0fafa6073d80201b3eb141ff2f05cca5b79
SSDEEP 6144:hEBH/FChedUjy4yrnZYUTFZoTJZnSjXUBV+UdvrEFp7hKeJ:hEBH/FChedUyF776nSjXUBjvrEH7p
TLSH
T143449D1075C183F9E172143038F8A6715AF9F83D0B6A9A9BA399076D4F7C0D26B31B67
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

25718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Touch\Documents\Visual Studio 2015\Projects\win10_activator\Release\win10_activator.pdb

kernel32

WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RaiseException RtlUnwind GetLastError FreeLibrary LoadLibraryExW GetModuleFileNameW HeapAlloc HeapFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesExW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetProcessHeap IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA FindClose FindFirstFileExA FindNextFileA SetStdHandle WriteConsoleW ReadConsoleW HeapSize CreateFileW HeapReAlloc Sleep

advapi32

SystemFunction036

Name

.text

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_9a32557aadad68b3dbbdca54d93da626_elex_floxif_mespinoza_smoke-loader

kernel32

advapi32

generic