2026-08-30_02b14101f4ad7d74d05af08a6ad4eab3_amadey_elex_smoke-loader_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-30_02b14101f4ad7d74d05af08a6ad4eab3_amadey_elex_smoke-loader_wapomi
Size 500KB
Sample260830-2d6lfaaq5w
SHA256 11acfc28fc802a3e84af2d68992848ae51ec235a4083329d90003ea7925079c9
MD5 02b14101f4ad7d74d05af08a6ad4eab3
SHA1 981a22ea5908fc5d7817104e632a8b976636791a
SHA512 a069c0625d0e3b5eeccbc0b0e4000dff73f30b2902d73198a34eeb97312964a2aabd28747fd9e1485e0433fcdef0774f729c2a7efab27cd90218c59baf909420
SSDEEP 12288:aoOxhsVUWX8x7oCYCM9YyfoeQnugBT3jq:3OIVRX8uQD
TLSH
T11AB46C00B6A3C029F4F621F44AAEA26CA92D7AF1877C90CB61C567EE57345E46C33357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_02b14101f4ad7d74d05af08a6ad4eab3_amadey_elex_smoke-loader_wapomi

File Explorer

2026-08-30_02b14101f4ad7d74d05af08a6ad4eab3_amadey_elex_smoke-loader_wapomi

.exe 500KB

2026-08-30_02b14101f4ad7d74d05af08a6ad4eab3_amadey_elex_smoke-loader_wapomi

IMPHASH fa4089b5456013f5e974a51379d1d62a
SHA256 11acfc28fc802a3e84af2d68992848ae51ec235a4083329d90003ea7925079c9
MD5 02b14101f4ad7d74d05af08a6ad4eab3
SHA1 981a22ea5908fc5d7817104e632a8b976636791a
SHA512 a069c0625d0e3b5eeccbc0b0e4000dff73f30b2902d73198a34eeb97312964a2aabd28747fd9e1485e0433fcdef0774f729c2a7efab27cd90218c59baf909420
SSDEEP 12288:aoOxhsVUWX8x7oCYCM9YyfoeQnugBT3jq:3OIVRX8uQD
TLSH
T11AB46C00B6A3C029F4F621F44AAEA26CA92D7AF1877C90CB61C567EE57345E46C33357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

700416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Projects\DualTalkSwitch\src\DualTalkSwitch\Debug\DualTalkSwitchTool.pdb

flashtoollib

ord1012 ord1020 ord1017 ord1013

kernel32

RaiseException HeapValidate IsBadReadPtr EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW DebugBreak WideCharToMultiByte MultiByteToWideChar lstrlenA GetProcAddress LoadLibraryA DeleteCriticalSection FatalAppExitA GetModuleHandleA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleW Sleep InterlockedIncrement InterlockedDecrement ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStdHandle GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetLastError GetCurrentThread HeapDestroy HeapCreate HeapFree VirtualFree GetModuleFileNameA WriteFile HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage OutputDebugStringA WriteConsoleW OutputDebugStringW SetConsoleCtrlHandler LoadLibraryW RtlUnwind GetProcessHeap VirtualQuery FreeLibrary InitializeCriticalSectionAndSpinCount InterlockedExchange LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetLocaleInfoA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID FlushFileBuffers GetConsoleCP GetConsoleMode GetLocaleInfoW GetTimeZoneInformation SetFilePointer CloseHandle SetStdHandle WriteConsoleA GetConsoleOutputCP CreateFileA CompareStringA CompareStringW SetEnvironmentVariableA

Name

.textbss

Size

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

379KB

Virtual Size

379KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

��|��u

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-30_02b14101f4ad7d74d05af08a6ad4eab3_amadey_elex_smoke-loader_wapomi

flashtoollib

kernel32

generic