2026-08-25_c3e9687dff05177467d7c038b7800995_amadey_elex_lynx

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_c3e9687dff05177467d7c038b7800995_amadey_elex_lynx
Size 676KB
Sample260826-mnkdmacj6v
SHA256 46ba730825dae239c4458ffb81610a31e6138d83349cf7ce6ee9ba3e23bf6b57
MD5 c3e9687dff05177467d7c038b7800995
SHA1 3aa70d9284cae6a10249bf899e47017b85e10d86
SHA512 2ae89684d2a5cc6f71baa8054e961acdb5f81e2763c038204f32fcf528bb405e2fda59efcc3f9b0e2d7b12edc687bccf3989c19a54f6bec96a99c8699325071c
SSDEEP 12288:ZaiNQAgN5oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:ZtNJgN5osqjnhMgeiCl7G0nehbGZpbD
TLSH
T18CE41252B5D840BEE972067041E9EE3998AFFD304B700C97639525AE8F710E08E3DE67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_c3e9687dff05177467d7c038b7800995_amadey_elex_lynx

File Explorer

2026-08-25_c3e9687dff05177467d7c038b7800995_amadey_elex_lynx

.exe 676KB

2026-08-25_c3e9687dff05177467d7c038b7800995_amadey_elex_lynx

IMPHASH ddee04b0a3ba762c58f681beb41c8d33
SHA256 46ba730825dae239c4458ffb81610a31e6138d83349cf7ce6ee9ba3e23bf6b57
MD5 c3e9687dff05177467d7c038b7800995
SHA1 3aa70d9284cae6a10249bf899e47017b85e10d86
SHA512 2ae89684d2a5cc6f71baa8054e961acdb5f81e2763c038204f32fcf528bb405e2fda59efcc3f9b0e2d7b12edc687bccf3989c19a54f6bec96a99c8699325071c
SSDEEP 12288:ZaiNQAgN5oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:ZtNJgN5osqjnhMgeiCl7G0nehbGZpbD
TLSH
T18CE41252B5D840BEE972067041E9EE3998AFFD304B700C97639525AE8F710E08E3DE67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\Client\Client\Windows\launcher\Bin\Release\NewZoomWebLauncher.pdb

shlwapi

ord155 StrCmpNIW StrStrA PathAppendW PathIsRelativeW

kernel32

GetSystemTime GetFileTime ExpandEnvironmentStringsA GetFileAttributesA CreateDirectoryA SetUnhandledExceptionFilter GetTickCount GetSystemDirectoryW LoadLibraryW ExitProcess LoadLibraryExW HeapLock HeapWalk GetVersion HeapUnlock ReleaseSemaphore CreateSemaphoreA VerifyVersionInfoA GetCommandLineA GetWindowsDirectoryA GetStartupInfoA VerSetConditionMask EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitThread TerminateThread CreateThread DeleteCriticalSection CompareFileTime WriteFile SetFilePointer SetEndOfFile SystemTimeToFileTime FlushFileBuffers ReleaseMutex GetLocalTime QueryPerformanceCounter GetSystemTimeAsFileTime IsProcessorFeaturePresent UnhandledExceptionFilter TerminateProcess GetTempFileNameA VerifyVersionInfoW GetFileAttributesW OpenProcess QueryDosDeviceW K32GetProcessImageFileNameW CreateToolhelp32Snapshot Process32NextW Process32FirstW GetWindowsDirectoryW GetModuleHandleW GetProcessTimes MultiByteToWideChar RaiseException CreateProcessA WideCharToMultiByte GetModuleHandleExW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage LCMapStringW TlsSetValue FreeLibrary TlsGetValue IsDebuggerPresent LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo GetProcessHeap GetCurrentProcessId GetProcAddress HeapAlloc CloseHandle FileTimeToSystemTime DeleteFileA CreateFileA MoveFileExA OpenMutexA GetLastError CopyFileA GetTempPathA Sleep GetModuleHandleA GetCurrentThreadId WaitForSingleObject CreateMutexA FindClose GetCurrentProcess SetLastError HeapFree FindFirstFileA GetModuleFileNameA LocalFree CreateFileW RtlUnwind

user32

FindWindowW GetDesktopWindow GetWindowThreadProcessId LoadCursorA InflateRect SetWindowPos SetActiveWindow GetSystemMetrics DrawTextA MapWindowPoints GetWindowLongA FrameRect AttachThreadInput GetForegroundWindow SetFocus FillRect PostMessageA FindWindowA PostQuitMessage LoadIconA RegisterClassExA SetForegroundWindow IsIconic LoadStringA RegisterClassA GetClassInfoA UnregisterClassA IsWindowVisible SetWindowLongA IntersectRect ShowWindowAsync SetPropA GetWindowRect DestroyWindow ShowWindow IsWindow MoveWindow GetPropA DefWindowProcA CreateWindowExA GetClientRect UpdateWindow InvalidateRect BeginPaint EndPaint PostThreadMessageA GetMessageA DispatchMessageA SetTimer TranslateMessage PeekMessageA KillTimer SendMessageA

gdi32

SetBkMode CreateFontIndirectA DeleteObject SetTextColor SelectObject CreateSolidBrush GetStockObject GetObjectA

advapi32

CryptVerifySignatureA OpenProcessToken GetUserNameA RegOpenKeyExA RegQueryValueExA RegCloseKey DuplicateTokenEx CheckTokenMembership FreeSid AllocateAndInitializeSid CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptReleaseContext CryptDestroyKey

shell32

ShellExecuteW SHGetFolderPathA

ole32

CoUninitialize CoInitialize CoCreateInstance

oleaut32

VariantInit VariantClear SysAllocString SysFreeString

Name

.text

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_c3e9687dff05177467d7c038b7800995_amadey_elex_lynx

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic