2026-09-12_89f246479a7da7843cdd720c239d95cb_amadey_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-12_89f246479a7da7843cdd720c239d95cb_amadey_elex_smoke-loader_stop
Size 508KB
Sample260912-1yllbsag73
SHA256 f95f0d3fdfc03ffa07f29bd3ff5d3099f1e51f6ce08cc3a88def01dc79f7739f
MD5 89f246479a7da7843cdd720c239d95cb
SHA1 34f9680670b1c1c7859be01dd9d8eef68ae2a4f0
SHA512 5bc496e069cf59941e6b54e1a3009bbd780a5c8e5e7cfd5b10ecd6ed5be817c8963f102d4d66b3506a37dabdeece1fa16254d7473cf75acdeadfc5b6410ad4ec
SSDEEP 12288:51+b2NFYABXX4e0ne4F2rnXZM0eNpBj/NelN6:n+bcF0e4FCe0KpBIl4
TLSH
T1F3B4291E77FC8676F6F32B31AD79836D4AA6BC205D34C10E23A1191D9971AE0D928733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-12_89f246479a7da7843cdd720c239d95cb_amadey_elex_smoke-loader_stop

File Explorer

2026-09-12_89f246479a7da7843cdd720c239d95cb_amadey_elex_smoke-loader_stop

.exe 508KB

2026-09-12_89f246479a7da7843cdd720c239d95cb_amadey_elex_smoke-loader_stop

IMPHASH 026b77dd3f16375255f390e25300cbca
SHA256 f95f0d3fdfc03ffa07f29bd3ff5d3099f1e51f6ce08cc3a88def01dc79f7739f
MD5 89f246479a7da7843cdd720c239d95cb
SHA1 34f9680670b1c1c7859be01dd9d8eef68ae2a4f0
SHA512 5bc496e069cf59941e6b54e1a3009bbd780a5c8e5e7cfd5b10ecd6ed5be817c8963f102d4d66b3506a37dabdeece1fa16254d7473cf75acdeadfc5b6410ad4ec
SSDEEP 12288:51+b2NFYABXX4e0ne4F2rnXZM0eNpBj/NelN6:n+bcF0e4FCe0KpBIl4
TLSH
T1F3B4291E77FC8676F6F32B31AD79836D4AA6BC205D34C10E23A1191D9971AE0D928733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1c:b2:1d:ef:b4:71:1f:ee:3f:4e:fe:66:e5:5d:e0:8d:c2:fa:4e:0f

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Adobe Systems\, Incorporated,OU=Acrobat XI+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US

Chains

Sep 24, 2012

CN=Adobe Systems\, Incorporated,OU=Acrobat XI+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Adobe Systems\, Incorporated,OU=Acrobat XI+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US

Serial Number

09:ac:06:4d:05:28:17:ff:4d:79:42:ea:69:76:c3:d8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 20, 2012 - Sep 20, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

101937

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\CB\11X_Main\Acrobat\Installers\BootStrapExe_Small\Release\Setup.pdb

msi

ord92 ord205 ord171 ord281 ord32 ord70 ord240 ord195 ord159 ord160 ord118 ord141 ord88 ord8 ord19 ord137

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree lstrlenA GetModuleHandleA GlobalFlags WritePrivateProfileStringW GetFileAttributesW GetFileSizeEx GetFileTime SetErrorMode GetStartupInfoW GetSystemTimeAsFileTime RtlUnwind HeapAlloc HeapFree RaiseException TlsGetValue ExitThread CreateThread ExitProcess SetStdHandle GetFileType HeapSize SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW VirtualAlloc InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetTimeZoneInformation LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryA GetDriveTypeA CreateFileA SetEnvironmentVariableA LeaveCriticalSection LocalAlloc InterlockedDecrement InterlockedIncrement CreateFileW GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile FindFirstFileW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW FindClose GetCurrentProcessId GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetModuleFileNameW lstrcmpA GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange CreateEventW SuspendThread SetEvent SetThreadPriority GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA lstrcmpW GetVersionExA WideCharToMultiByte MultiByteToWideChar SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock lstrlenW MulDiv SetCurrentDirectoryW DeleteFileW GetTempFileNameW FreeResource GetUserDefaultUILanguage ExpandEnvironmentStringsW GetPrivateProfileStringW GetVersionExW GetModuleHandleW GetCurrentProcess GetSystemInfo GetTempPathW CreateProcessW GetLastError WaitForSingleObject GetExitCodeProcess CloseHandle GetCurrentDirectoryW GetUserDefaultLangID LoadLibraryW GetProcAddress FreeLibrary Sleep ResumeThread GetThreadPriority FormatMessageW LocalFree FindResourceW LoadResource LockResource SizeofResource HeapReAlloc

user32

ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetDC ReleaseDC GetSysColorBrush CharUpperW SetCursor GetWindowThreadProcessId PostQuitMessage GetMessageW TranslateMessage GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem RegisterWindowMessageW LoadIconW SendDlgItemMessageA WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetForegroundWindow GetLastActivePopup DispatchMessageW GetTopWindow UnhookWindowsHookEx GetMessageTime PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow IsWindowVisible UpdateWindow GetClientRect MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect PtInRect GetMenu SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetSystemMetrics GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow GetNextDlgTabItem GetWindowTextW GetFocus GetParent SetWindowPos SetFocus IsWindowEnabled ShowWindow SetWindowLongW GetDlgCtrlID IsWindow SetWindowTextW GetWindowLongW IsDialogMessageW SendDlgItemMessageW UnregisterClassW DestroyMenu EndPaint GetMessagePos BeginPaint GetDlgItem GetWindow GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu PostMessageW EndDialog EnableWindow KillTimer SetTimer SendMessageW

gdi32

SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx DeleteDC GetStockObject OffsetViewportOrgEx Escape SetViewportOrgEx ExtTextOutW TextOutW RectVisible PtVisible SetMapMode RestoreDC SaveDC CreateBitmap GetObjectW SetBkColor SetTextColor GetClipBox GetDeviceCaps DeleteObject SelectObject

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegQueryValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownW OpenSCManagerW OpenServiceW CloseServiceHandle QueryServiceStatusEx RegCreateKeyW RegOpenKeyExW RegCreateKeyExW RegSetValueExW RegCloseKey

shell32

SHGetSpecialFolderPathW

shlwapi

StrFormatByteSizeW PathFindExtensionW PathStripToRootW PathIsUNCW PathFileExistsW PathFindFileNameW

ole32

CoUninitialize CoCreateInstance CoInitialize

oleaut32

VariantInit VariantChangeType VariantClear

urlmon

URLDownloadToFileW

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-12_89f246479a7da7843cdd720c239d95cb_amadey_elex_smoke-loader_stop

PE Signature issue

msi

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

urlmon

oleacc

generic