2026-08-21_63c71a42d496330da033ae3c5fb32c96_amadey_elex_smoke-loader

General

Target
2026-08-21_63c71a42d496330da033ae3c5fb32c96_amadey_elex_smoke-loader
Size 320KB
Sample260822-ractvavema
SHA256 064b38d06dcdc2edd1daff65fc9e2414d6611bdd39fb2c6e65148a796e5cc4d1
MD5 63c71a42d496330da033ae3c5fb32c96
SHA1 5eed7b27a96f379dbce257ab60022a8188b6a60f
SHA512 de373e774b591bd46233181ee8b6f1046890ffbea1a5213535ee2f585083fe7547a2a6ee8cc9dcf574e274005309b9d02c7de648a9da9c1ddd46e73000a0fbdd
SSDEEP 6144:1B+5InlfSGQB7RqptAOWkK0W0H3ivKj1YrAaU/g5xDU:1BSInlfSBKokK0W0H3rj1YsaQg5xDU
TLSH
T1CA649D22B5D2C472D1B216340969D7914A3DBD702F629E7B33E4372E2E702C19636EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_63c71a42d496330da033ae3c5fb32c96_amadey_elex_smoke-loader

File Explorer

2026-08-21_63c71a42d496330da033ae3c5fb32c96_amadey_elex_smoke-loader

.exe 320KB

2026-08-21_63c71a42d496330da033ae3c5fb32c96_amadey_elex_smoke-loader

IMPHASH a99648a4d417f4130faca9d4625edb8e
SHA256 064b38d06dcdc2edd1daff65fc9e2414d6611bdd39fb2c6e65148a796e5cc4d1
MD5 63c71a42d496330da033ae3c5fb32c96
SHA1 5eed7b27a96f379dbce257ab60022a8188b6a60f
SHA512 de373e774b591bd46233181ee8b6f1046890ffbea1a5213535ee2f585083fe7547a2a6ee8cc9dcf574e274005309b9d02c7de648a9da9c1ddd46e73000a0fbdd
SSDEEP 6144:1B+5InlfSGQB7RqptAOWkK0W0H3ivKj1YrAaU/g5xDU:1BSInlfSBKokK0W0H3rj1YsaQg5xDU
TLSH
T1CA649D22B5D2C472D1B216340969D7914A3DBD702F629E7B33E4372E2E702C19636EB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

34859

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CreateProcessW CreateFileW CloseHandle WideCharToMultiByte GetLastError MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW

user32

AllowSetForegroundWindow WaitForInputIdle

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_63c71a42d496330da033ae3c5fb32c96_amadey_elex_smoke-loader

kernel32

user32

generic