2026-08-14_15f28abe592c0bfca53dc0be54425c73_amadey_elex_floxif_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_15f28abe592c0bfca53dc0be54425c73_amadey_elex_floxif_smoke-loader_stop
Size 9.2MB
Sample260814-ftx4cafd73
SHA256 52f1d0de065e88a648d1ddcb0137700fec62924f3456b2e0e54e9efc429c6dcf
MD5 15f28abe592c0bfca53dc0be54425c73
SHA1 fafa894aced0fd0b6199295db42b8e117482d335
SHA512 4ca0d053ea259ca72a0b71cabab375c1bd930c9d7fffe66a25433613b5a98d5f8ec6124cd05fd7aac3535001e7ab38698ce9d2d8adcd88773a1aca5786dabd81
SSDEEP 196608:0BuBtanIkUYsb73p7YYPHDBS7+4xh3UPq1+3dQuD13QYL0h:0Burzf3p7YYAbxunyuD1AYAh
TLSH
T1A0A6331562EB43B6F0B31B31A8FD97765CB67825BA39C28B8741063D5A3D292DF30712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-14_15f28abe592c0bfca53dc0be54425c73_amadey_elex_floxif_smoke-loader_stop

File Explorer

2026-08-14_15f28abe592c0bfca53dc0be54425c73_amadey_elex_floxif_smoke-loader_stop

.exe 9.2MB

2026-08-14_15f28abe592c0bfca53dc0be54425c73_amadey_elex_floxif_smoke-loader_stop

IMPHASH cb62afda5a66eca097a889af3ca2eaa2
SHA256 52f1d0de065e88a648d1ddcb0137700fec62924f3456b2e0e54e9efc429c6dcf
MD5 15f28abe592c0bfca53dc0be54425c73
SHA1 fafa894aced0fd0b6199295db42b8e117482d335
SHA512 4ca0d053ea259ca72a0b71cabab375c1bd930c9d7fffe66a25433613b5a98d5f8ec6124cd05fd7aac3535001e7ab38698ce9d2d8adcd88773a1aca5786dabd81
SSDEEP 196608:0BuBtanIkUYsb73p7YYPHDBS7+4xh3UPq1+3dQuD13QYL0h:0Burzf3p7YYAbxunyuD1AYAh
TLSH
T1A0A6331562EB43B6F0B31B31A8FD97765CB67825BA39C28B8741063D5A3D292DF30712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

07:bd:7b:b2:05:45:fd:6e:a7:5a:d8:67:11:a0:36:a2:35:9c:3d:e6:26:dd:48:0e:d8:89:6c:8a:e4:95:49:e3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Chains

Mar 31, 2020

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=HP Inc.,OU=HP Cybersecurity,O=HP Inc.,L=Palo Alto,ST=California,C=US

Serial Number

0e:78:4a:3a:6e:92:c8:0c:c0:e4:66:2c:9d:31:9d:10

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 25, 2020 - May 11, 2020

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

117949

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

kernel32

WaitForSingleObject SetEvent ResetEvent WaitForMultipleObjects VirtualAlloc VirtualFree GetProcAddress GetModuleHandleA MultiByteToWideChar WideCharToMultiByte GetLastError LoadLibraryA AreFileApisANSI GetModuleFileNameA GetModuleFileNameW LocalFree FormatMessageA FormatMessageW SetFileAttributesA RemoveDirectoryA SetCurrentDirectoryA CreateDirectoryA DeleteFileA SetFileAttributesW RemoveDirectoryW CreateDirectoryW DeleteFileW lstrlenA GetFullPathNameA GetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryW GetTempPathA GetTempPathW GetFullPathNameW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW CreateFileA GetFileSize CreateThread ReadFile SetFileTime WriteFile SetEndOfFile CreateFileW CreateEventA GetStdHandle EnterCriticalSection LeaveCriticalSection GetUserDefaultLangID EnumResourceLanguagesA GetUserDefaultUILanguage GetVersionExA Sleep SetLastError DuplicateHandle GetCurrentProcess GetEnvironmentVariableW Process32Next OpenProcess Process32First CreateToolhelp32Snapshot GetExitCodeProcess CreateProcessA GetCommandLineW FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP GetLocaleInfoA GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount CloseHandle DeleteCriticalSection InitializeCriticalSection SetFilePointer HeapSize HeapCreate HeapReAlloc InterlockedDecrement GetCurrentThreadId InterlockedIncrement TlsFree TlsSetValue RaiseException RtlUnwind HeapAlloc HeapFree GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW ExitProcess GetCommandLineA GetStartupInfoA TlsGetValue TlsAlloc

user32

CharLowerA CharUpperA DestroyWindow PostMessageA ShowWindow EndDialog KillTimer SetTimer SendMessageA GetDlgItem MessageBoxW DialogBoxParamW DialogBoxParamA GetWindowLongA SetWindowLongA GetWindowTextLengthW GetWindowTextW SetWindowTextW SetWindowTextA GetWindowTextA GetWindowTextLengthA LoadStringW LoadStringA CharLowerW CharUpperW

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

SHCreateDirectoryExW SHGetPathFromIDListW SHCreateDirectoryExA ShellExecuteExA SHBrowseForFolderW

ole32

OleInitialize CoTaskMemFree

oleaut32

SysAllocString VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_15f28abe592c0bfca53dc0be54425c73_amadey_elex_floxif_smoke-loader_stop

PE Signature issue

comctl32

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic