2026-09-07_d81247d989425008ec10138bb2be61a6_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_d81247d989425008ec10138bb2be61a6_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop
Size 316KB
Sample260908-e6jwtazyez
SHA256 e019661d559e6801e38958ce097beb9511f7e0f6239965d7a80c7d94821372b8
MD5 d81247d989425008ec10138bb2be61a6
SHA1 ad74bd4803f23294e29f64eb50eb74d012a50e0c
SHA512 06b78ee0df4f6ee04ed411d74d837aff5842b5f76d9904e3da729ecc79bee246400bb8903e4fef3e51b3e5fb49ac992d5ef039895f2ac1d1176b7016db6be842
SSDEEP 6144:JHievoneaFbjyJGy32bB22kzXeQZxq0mN2InUBV+UdvrEFp7hK0b:+ty01Y2kzXeQZc0mrnUBjvrEH79
TLSH
T12B64AF1336C1CBF7D592017238DB8B29A2F2BC2C4B6A41C777913B4D6EBC7925669306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-07_d81247d989425008ec10138bb2be61a6_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop

File Explorer

2026-09-07_d81247d989425008ec10138bb2be61a6_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop

.exe 316KB

2026-09-07_d81247d989425008ec10138bb2be61a6_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop

IMPHASH 3bc1d092b9d767df6a326415e4f2bfd9
SHA256 e019661d559e6801e38958ce097beb9511f7e0f6239965d7a80c7d94821372b8
MD5 d81247d989425008ec10138bb2be61a6
SHA1 ad74bd4803f23294e29f64eb50eb74d012a50e0c
SHA512 06b78ee0df4f6ee04ed411d74d837aff5842b5f76d9904e3da729ecc79bee246400bb8903e4fef3e51b3e5fb49ac992d5ef039895f2ac1d1176b7016db6be842
SSDEEP 6144:JHievoneaFbjyJGy32bB22kzXeQZxq0mN2InUBV+UdvrEFp7hK0b:+ty01Y2kzXeQZc0mrnUBjvrEH79
TLSH
T12B64AF1336C1CBF7D592017238DB8B29A2F2BC2C4B6A41C777913B4D6EBC7925669306
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

18:6d:96:8f:76:ee:51:a8:0e:7c:74:a5:0c:2a:17:a8:ce:e4:b8:98

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Hewlett-Packard Company,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Hewlett-Packard Company,O=Hewlett-Packard Company,L=Palo Alto,ST=California,C=US

Chains

Nov 24, 2010

CN=Hewlett-Packard Company,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Hewlett-Packard Company,O=Hewlett-Packard Company,L=Palo Alto,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Hewlett-Packard Company,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Hewlett-Packard Company,O=Hewlett-Packard Company,L=Palo Alto,ST=California,C=US

Serial Number

08:99:45:31:fd:f1:b2:eb:b8:c7:82:1b:f6:50:fd:cf

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 18, 2008 - Dec 18, 2011

Minor OS version

Major OS version

Entry point

333823

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\perforce\iron\cicada\trunk\cicada\win\ezinstaller\release\install.pdb

psapi

GetModuleBaseNameW

kernel32

GlobalAddAtomW lstrlenW GlobalUnlock InterlockedDecrement WritePrivateProfileStringW GetModuleHandleA GlobalFlags CompareStringW LocalAlloc TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree InterlockedIncrement GetVersionExA GlobalFindAtomW MoveFileW GetThreadLocale GlobalDeleteAtom SetFilePointer FlushFileBuffers SetEndOfFile lstrlenA FileTimeToSystemTime SetErrorMode FileTimeToLocalFileTime GetFileAttributesW GetStartupInfoW GetDriveTypeW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind ExitProcess RaiseException HeapReAlloc HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetCurrentDirectoryA VirtualAlloc GetTimeZoneInformation GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetDriveTypeA CreateFileA SetEnvironmentVariableA SetEnvironmentVariableW ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange GlobalLock lstrcmpW GlobalFree GlobalAlloc GetTickCount ReadFile WriteFile FindFirstFileW FindClose CreateFileW SetLastError LoadLibraryExW HeapFree GetProcessHeap HeapAlloc OutputDebugStringW LeaveCriticalSection EnterCriticalSection GetCurrentThreadId GetLocalTime GetWindowsDirectoryW InitializeCriticalSection LocalFree FormatMessageW GetModuleFileNameW GetModuleHandleW GetExitCodeProcess WaitForSingleObject CreateProcessW GetCurrentProcess MultiByteToWideChar WideCharToMultiByte GetCurrentThread GetSystemDefaultLangID GetUserDefaultLangID GetSystemDefaultUILanguage GetUserDefaultUILanguage FindResourceW LoadResource LockResource SizeofResource GetFullPathNameW LoadLibraryW Sleep DeleteFileW CloseHandle GetLastError OpenProcess GetCurrentProcessId FreeLibrary GetProcAddress LoadLibraryA GetVersionExW

user32

GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetClientRect GetMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx CopyRect DefWindowProcW SystemParametersInfoA IsIconic GetWindowPlacement LoadCursorW GetCapture GetWindow GetDlgCtrlID GetClassNameW PtInRect GetWindowTextW SetWindowTextW GetSysColor ReleaseDC GetDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetMenuItemID GetMenuItemCount IsWindow GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow SetCursor GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent SendMessageW ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem PostQuitMessage LoadStringW UnhookWindowsHookEx MessageBoxW SetWindowsHookExW CallNextHookEx SetWindowLongW SetWindowPos GetWindowRect GetSystemMetrics CallWindowProcW PostMessageW DestroyMenu UnregisterClassW GetSysColorBrush ShowWindow RemovePropW GetPropW SetPropW GetClassLongW GetSubMenu RegisterWindowMessageW LoadIconW WinHelpW ClientToScreen UnregisterClassA

gdi32

SetTextColor SetBkColor RestoreDC SaveDC SetViewportOrgEx SetMapMode GetClipBox OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx DeleteDC GetStockObject Escape ExtTextOutW TextOutW RectVisible PtVisible DeleteObject GetDeviceCaps CreateBitmap SelectObject

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegCreateKeyExW RegCloseKey RegSetValueExW RegOpenKeyExW RegQueryValueExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW

shell32

ord680

shlwapi

PathAppendW PathFindExtensionW PathFindFileNameW

oleaut32

VariantInit VariantChangeType VariantClear

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_d81247d989425008ec10138bb2be61a6_amadey_chir_elex_emotet_floxif_glassworm_smoke-loader_stop

PE Signature issue

psapi

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

oleacc

generic