2026-08-10_23028109c7010dd0f36f3ee5afa43111_amadey_elex_emotet_icedid_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_23028109c7010dd0f36f3ee5afa43111_amadey_elex_emotet_icedid_smoke-loader
Size 331KB
Sample260811-by72wsdn41
SHA256 1828fe3a22ca1a472585fd1b0a9f75ef95db947f7f12926bb5a83b1a3e83fa40
MD5 23028109c7010dd0f36f3ee5afa43111
SHA1 1c785cabf43f58de2bda9874e3f323169de34ff6
SHA512 ae51daec5e9a7b516b3c6af76d424822033df3a39c09a98d617ec0a73e7c986236278502ed0aa89f0030b9e29a0e8943458057d11f5f2099da69c70f15a8cf50
SSDEEP 6144:eoZqkPVzR4K4rMPTJT/KBSb3a3h6XM8rXbdjbdubdbIB:/Ek9zRP8MNTiMTa3gXPbdjbdubdbIB
TLSH
T1B2745B0377E1C076D69216725EE3976AA2BEFD148F328B8723502B5EEE307C1A935315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-10_23028109c7010dd0f36f3ee5afa43111_amadey_elex_emotet_icedid_smoke-loader

File Explorer

2026-08-10_23028109c7010dd0f36f3ee5afa43111_amadey_elex_emotet_icedid_smoke-loader

.exe 331KB

2026-08-10_23028109c7010dd0f36f3ee5afa43111_amadey_elex_emotet_icedid_smoke-loader

IMPHASH d9e58d8d09546650a82b3392acd08518
SHA256 1828fe3a22ca1a472585fd1b0a9f75ef95db947f7f12926bb5a83b1a3e83fa40
MD5 23028109c7010dd0f36f3ee5afa43111
SHA1 1c785cabf43f58de2bda9874e3f323169de34ff6
SHA512 ae51daec5e9a7b516b3c6af76d424822033df3a39c09a98d617ec0a73e7c986236278502ed0aa89f0030b9e29a0e8943458057d11f5f2099da69c70f15a8cf50
SSDEEP 6144:eoZqkPVzR4K4rMPTJT/KBSb3a3h6XM8rXbdjbdubdbIB:/Ek9zRP8MNTiMTa3gXPbdjbdubdbIB
TLSH
T1B2745B0377E1C076D69216725EE3976AA2BEFD148F328B8723502B5EEE307C1A935315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9a:15:4c:40:e3:09:e7:6d:1a:2a:22:d1:80:99:55:05:e5:dc:5d:93

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Christiaan GHIJSELINCK,O=Christiaan GHIJSELINCK,C=BE,1.2.840.113549.1.9.1=#0c234368726973746961616e2e4768696a73656c696e636b4042656c6761636f6d2e6e6574

Chains

Oct 9, 2014

CN=Christiaan GHIJSELINCK,O=Christiaan GHIJSELINCK,C=BE,1.2.840.113549.1.9.1=#0c234368726973746961616e2e4768696a73656c696e636b4042656c6761636f6d2e6e6574

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

43:6b:88:d8:3f:d4:0f:d7:f2:4e:1d:d2:22:85:f2:7e

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Oct 25, 2022

Timespan

Sep 20, 2011 - Sep 20, 2026

Subject

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

61:3b:c7:91:00:00:00:00:00:34

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=Christiaan GHIJSELINCK,O=Christiaan GHIJSELINCK,C=BE,1.2.840.113549.1.9.1=#0c234368726973746961616e2e4768696a73656c696e636b4042656c6761636f6d2e6e6574

Serial Number

6e:82:95:8f:72:d3:d5:74:67:00:fc:e8:45:7f:9f:ea

Issuer

CN=Certum Code Signing CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftKernelCodeSigning

Revocation Status

Not revoked

Timespan

Oct 9, 2014 - Oct 8, 2017

Minor OS version

Major OS version

Entry point

100732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\WINDDK\6001\src\storage\RAMDISK_5.3.2.15\EXE\Full\Release\RAMDiskImage.pdb

setupapi

SetupDiSetClassInstallParamsA SetupDiCallClassInstaller SetupDiGetDeviceInstallParamsA SetupDiGetClassDevsA SetupDiEnumDeviceInfo CM_Get_DevNode_Status SetupDiDestroyDeviceInfoList

kernel32

GetTickCount GetStartupInfoW ExitProcess RtlUnwind CreateThread GetLocalTime HeapReAlloc TerminateProcess HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetOEMCP GetCPInfo IsBadWritePtr LCMapStringA LCMapStringW SetUnhandledExceptionFilter GetTimeZoneInformation IsBadReadPtr IsBadCodePtr GetStringTypeA GetStringTypeW SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA GetFileTime GetFileAttributesW FileTimeToLocalFileTime SetErrorMode GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle GetFileSize UnlockFile LockFile FlushFileBuffers WritePrivateProfileStringW FileTimeToSystemTime InterlockedIncrement GlobalFlags lstrcmpiW TlsFree LocalReAlloc TlsSetValue TlsAlloc TlsGetValue EnterCriticalSection GlobalHandle GlobalReAlloc LeaveCriticalSection LocalAlloc ReleaseMutex CreateMutexW GetCurrentThread GetModuleFileNameW ConvertDefaultLocale GetVersion EnumResourceLanguagesW GetLocaleInfoW LoadLibraryW InterlockedDecrement GlobalFree MulDiv lstrcpyW GlobalAlloc GlobalLock GlobalUnlock FormatMessageW lstrcpynW LocalFree FreeResource GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom lstrlenA GetModuleHandleA LoadLibraryA FreeLibrary lstrcatW lstrcmpW GetModuleHandleW GetProcAddress GetVersionExA MultiByteToWideChar CreateEventA UnmapViewOfFile CreateFileMappingA MapViewOfFile CreateFileW GetDiskFreeSpaceExW ExitThread GetFileSizeEx ReadFile ResumeThread GetDiskFreeSpaceW CreateFileA DeviceIoControl OutputDebugStringW SetFilePointer WriteFile SetEndOfFile HeapFree HeapDestroy GetThreadPriority SetThreadPriority WaitForSingleObject ResetEvent CreateEventW GetProcessHeap HeapAlloc SetLastError lstrlenW SetEvent DeleteCriticalSection InitializeCriticalSection RaiseException GetCommandLineW GetLastError Sleep WideCharToMultiByte CloseHandle FindResourceW LoadResource LockResource SizeofResource GetVersionExW GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange GetFileType

user32

MessageBeep GetNextDlgGroupItem InvalidateRgn CopyAcceleratorTableW SetRect IsRectEmpty CharNextW CharUpperW ReleaseCapture SetCapture LoadCursorW SetWindowContextHelpId MapDialogRect GetMessageW TranslateMessage ValidateRect PostQuitMessage GetDesktopWindow CreateDialogIndirectParamW EndDialog SetMenuItemBitmaps ModifyMenuW EnableMenuItem CheckMenuItem GetMenuCheckMarkDimensions LoadBitmapW IsWindowEnabled ShowWindow MoveWindow SetWindowTextW IsDialogMessageW EndPaint BeginPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetMenuState RegisterWindowMessageW WinHelpW GetCapture CreateWindowExW SetWindowsHookExW CallNextHookEx GetClassInfoExW GetClassLongW GetClassNameW SetPropW RemovePropW SendDlgItemMessageW SendDlgItemMessageA GetFocus SetFocus IsChild GetWindowTextW GetForegroundWindow GetLastActivePopup SetActiveWindow DispatchMessageW GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints MessageBoxW TrackPopupMenu GetKeyState IsWindowVisible GetMenu GetMenuItemID GetMenuItemCount AdjustWindowRectEx ScreenToClient EqualRect GetClassInfoW RegisterClassW GetDlgCtrlID DefWindowProcW CallWindowProcW SetWindowLongW SetWindowPos IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics PtInRect GetWindow SendMessageA BroadcastSystemMessageA GetCursorPos SetForegroundWindow wsprintfW UnregisterClassW GetSysColorBrush LoadIconW HideCaret PostThreadMessageW RegisterClipboardFormatW KillTimer SetTimer UpdateWindow FindWindowW FindWindowA IsWindow LoadStringW DestroyMenu LoadMenuW DestroyCursor LoadImageW GetIconInfo GetDC GetPropW CreateIconIndirect ReleaseDC GetSysColor GetSubMenu TrackPopupMenuEx PostMessageW SetCursor DestroyIcon GetWindowLongW EnableWindow WindowFromPoint GetParent GetNextDlgTabItem GetActiveWindow InvalidateRect ClientToScreen GetClientRect GetWindowRect SendMessageW DrawFocusRect FrameRect FillRect OffsetRect InflateRect CopyRect DrawStateW GetWindowTextLengthW

gdi32

Escape ExtTextOutW TextOutW PtVisible GetWindowExtEx GetViewportExtEx GetRgnBox SetViewportOrgEx GetTextColor GetBkColor GetMapMode CreateRectRgnIndirect CreateSolidBrush CreatePen ExtSelectClipRgn ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx SetTextColor DeleteDC GetStockObject DeleteObject BitBlt SelectObject CreateCompatibleDC RectVisible CreateCompatibleBitmap MoveToEx LineTo SetMapMode SetBkMode RestoreDC SaveDC GetDeviceCaps GetClipBox GetObjectW GetPixel SetPixel CreateBitmap SetBkColor OffsetViewportOrgEx

comdlg32

GetOpenFileNameW GetSaveFileNameW GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegisterServiceCtrlHandlerExW RegCloseKey RegOpenKeyExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegDeleteValueW RegCreateKeyExW RegSetValueExW RegSetValueExA SetFileSecurityA RegQueryValueExA RegDeleteValueA RegQueryValueW RegEnumKeyW RegDeleteKeyW DeleteService CreateServiceW OpenServiceW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegOpenKeyW SetFileSecurityW OpenSCManagerA CloseServiceHandle ControlService QueryServiceStatus RegOpenKeyExW RegQueryValueExW RegSetKeySecurity

shell32

Shell_NotifyIconA ShellExecuteExW

comctl32

_TrackMouseEvent ord17

shlwapi

PathFindFileNameW PathStripToRootW PathFindExtensionW PathIsUNCW

oledlg

OleUIBusyW

ole32

CoGetClassObject CLSIDFromString CLSIDFromProgID StgOpenStorageOnILockBytes CoTaskMemAlloc CoTaskMemFree StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject OleInitialize

oleaut32

OleCreateFontIndirect SysAllocString SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy SysAllocStringLen VariantCopy SysStringLen SysFreeString VariantInit VariantChangeType VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_23028109c7010dd0f36f3ee5afa43111_amadey_elex_emotet_icedid_smoke-loader

PE Signature issue

setupapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic