2026-09-07_e4c84144f594e4018e9746373723729a_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_e4c84144f594e4018e9746373723729a_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop
Size 676KB
Sample260908-dp6htacj2v
SHA256 7e3468a947b5d0a4290883641dc6a917a53d0276528e33a97666b6bac4ccf718
MD5 e4c84144f594e4018e9746373723729a
SHA1 8fa814119c5228dc19309325602cefcc828f7517
SHA512 4ebce5024030d9e35e1f8a0d6c3b4a5f9c24977332c2e2ef60eeee4d5f6570293058f36eedf640def4e348a6c4b6d135df72460899f5881eb138f05b5747160d
SSDEEP 6144:rGJrMyDFD11VfZSyDhbBZxbB7ackfZQU7Js5dUBV+UdvrEFp7hKY:rGP1VnDhdZxbBSZuvUBjvrEH7
TLSH
T15EE4490F25818172D46219352DE64254B765FFFC2E28EF8FAA353C0FDA379829538798
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-07_e4c84144f594e4018e9746373723729a_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop

File Explorer

2026-09-07_e4c84144f594e4018e9746373723729a_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop

.exe 676KB

2026-09-07_e4c84144f594e4018e9746373723729a_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop

IMPHASH 9d3f97cca885b7459c62ab9c3bb93b98
SHA256 7e3468a947b5d0a4290883641dc6a917a53d0276528e33a97666b6bac4ccf718
MD5 e4c84144f594e4018e9746373723729a
SHA1 8fa814119c5228dc19309325602cefcc828f7517
SHA512 4ebce5024030d9e35e1f8a0d6c3b4a5f9c24977332c2e2ef60eeee4d5f6570293058f36eedf640def4e348a6c4b6d135df72460899f5881eb138f05b5747160d
SSDEEP 6144:rGJrMyDFD11VfZSyDhbBZxbB7ackfZQU7Js5dUBV+UdvrEFp7hKY:rGP1VnDhdZxbBSZuvUBjvrEH7
TLSH
T15EE4490F25818172D46219352DE64254B765FFFC2E28EF8FAA353C0FDA379829538798
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e7:65:5a:25:e5:68:6c:66:0f:cd:91:91:2a:56:0e:c3:01:56:66:c2

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Hewlett-Packard Company,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Hewlett-Packard Company,O=Hewlett-Packard Company,L=Palo Alto,ST=California,C=US

Chains

Nov 24, 2010

CN=Hewlett-Packard Company,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Hewlett-Packard Company,O=Hewlett-Packard Company,L=Palo Alto,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Hewlett-Packard Company,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Hewlett-Packard Company,O=Hewlett-Packard Company,L=Palo Alto,ST=California,C=US

Serial Number

08:99:45:31:fd:f1:b2:eb:b8:c7:82:1b:f6:50:fd:cf

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 18, 2008 - Dec 18, 2011

Minor OS version

Major OS version

Entry point

702463

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

PDB paths

d:\perforce\iron\cicada\trunk\cicada\win\ezinstaller\release\installusb.pdb

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiOpenDeviceInfoW SetupDiCreateDeviceInfoList SetupDiGetDeviceRegistryPropertyW CM_Get_Sibling CM_Get_Child CM_Get_Device_IDW CM_Get_Parent SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInfo SetupDiGetClassDevsW

kernel32

SuspendThread GlobalAddAtomW FreeResource GetCurrentProcessId WritePrivateProfileStringW CompareStringW GlobalFindAtomW GetModuleHandleA lstrlenA LocalAlloc TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree GetThreadLocale FileTimeToSystemTime GlobalFlags MoveFileW SetFilePointer SetEvent SetEndOfFile SetErrorMode FileTimeToLocalFileTime GetFileAttributesW GetStartupInfoW GetDriveTypeW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc ExitProcess ExitThread CreateThread HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetCurrentDirectoryA VirtualAlloc GetTimeZoneInformation GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetDriveTypeA CreateFileA SetEnvironmentVariableA SetEnvironmentVariableW ResumeThread SetThreadPriority GlobalDeleteAtom ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW GlobalLock GlobalUnlock lstrlenW MulDiv GetTickCount GlobalFree GlobalAlloc LoadLibraryA LoadLibraryExW GetVersionExA InterlockedDecrement InterlockedIncrement ReadFile WriteFile CreateEventW SetLastError HeapFree GetProcessHeap HeapAlloc FindClose FindFirstFileW FreeLibrary GetModuleHandleW GetCurrentProcess MultiByteToWideChar WideCharToMultiByte GetCurrentThread CreateMutexW GetVersionExW GetWindowsDirectoryW InitializeCriticalSection LocalFree FormatMessageW OutputDebugStringW LeaveCriticalSection EnterCriticalSection GetCurrentThreadId GetLocalTime CreateFileW DeviceIoControl GetUserDefaultLangID GetSystemDefaultUILanguage GetUserDefaultUILanguage GetSystemDefaultLangID CloseHandle ReleaseMutex GetModuleFileNameW RemoveDirectoryW SetFileAttributesW GetExitCodeProcess WaitForSingleObject CreateProcessW CopyFileW CreateDirectoryW GetTempPathW GetProcAddress LoadLibraryW GetLastError FindResourceW DeleteFileW LoadResource GetSystemDirectoryW LockResource SizeofResource GetFullPathNameW Sleep FlushFileBuffers

user32

DestroyMenu UnregisterClassW LoadCursorW GetSysColorBrush EndPaint BeginPaint ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW MoveWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW CheckRadioButton RegisterWindowMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextW GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints GetMenu GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx PtInRect GetDlgCtrlID SystemParametersInfoA GetWindowPlacement GetWindow GetWindowThreadProcessId GetLastActivePopup SetCursor GetClientRect CopyRect GetDesktopWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem GetNextDlgTabItem EndDialog GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu SetProcessDefaultLayout ReleaseDC IsIconic SetForegroundWindow GetDC MessageBeep KillTimer SendMessageW SetTimer EnableWindow GetWindowLongW LoadStringW UnhookWindowsHookEx MessageBoxW SetWindowsHookExW CallNextHookEx SetWindowLongW SetWindowPos GetWindowRect GetSystemMetrics CallWindowProcW RegisterClassExW DispatchMessageW TranslateMessage GetMessageW DefWindowProcW PostQuitMessage UpdateWindow ShowWindow CreateWindowExW PostMessageW IsWindowEnabled UnregisterClassA

gdi32

PtVisible RectVisible TextOutW GetStockObject DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx DeleteObject SetMapMode SetBkMode RestoreDC SaveDC GetObjectW SetBkColor SetTextColor GetClipBox CreateBitmap GetDeviceCaps CreateBrushIndirect CreateFontW OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegCreateKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegQueryValueExW RegOpenKeyExW

shell32

ord680

comctl32

InitCommonControlsEx

shlwapi

PathAppendW PathFindExtensionW PathFindFileNameW

ole32

CoInitialize CreateClassMoniker StringFromCLSID CoUninitialize CoTaskMemFree CoCreateInstance GetRunningObjectTable

oleaut32

VariantInit VariantChangeType VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_e4c84144f594e4018e9746373723729a_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop

PE Signature issue

setupapi

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

generic