2026-09-13_3955ea7b65ad642c89d4f67f4dffee82_amadey_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-13_3955ea7b65ad642c89d4f67f4dffee82_amadey_elex_smoke-loader
Size 255KB
Sample260913-tqb9cssscs
SHA256 b0ac0dcc3564d66503b027dcc793065cc311051105ef1098201aa969f90cc0e5
MD5 3955ea7b65ad642c89d4f67f4dffee82
SHA1 ceba852917be2d12e2d9fed5fcf7b413394b472a
SHA512 99be9cf54f70684f3a05a9240fa0f2f674bb76ff5185814ff20b56761ea5b63cbcbc814c7cb171882ddd72cb5282387de490ee03945cdbce73f36d8652e17784
SSDEEP 6144:LQ3G6GL24+E1ZyZb0aIU2V5hA9DaBQPy/ec9PTBndnqbn:U3/GaRUyZffaBQa/59PTv
TLSH
T1D3448D207660D532E492213689FADBBA5D7DB071073A91DB73C42F7E6D203E2667438B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-13_3955ea7b65ad642c89d4f67f4dffee82_amadey_elex_smoke-loader

File Explorer

2026-09-13_3955ea7b65ad642c89d4f67f4dffee82_amadey_elex_smoke-loader

.exe 255KB

2026-09-13_3955ea7b65ad642c89d4f67f4dffee82_amadey_elex_smoke-loader

IMPHASH 8a1cd82509f9cabdcd1e9a364c426da9
SHA256 b0ac0dcc3564d66503b027dcc793065cc311051105ef1098201aa969f90cc0e5
MD5 3955ea7b65ad642c89d4f67f4dffee82
SHA1 ceba852917be2d12e2d9fed5fcf7b413394b472a
SHA512 99be9cf54f70684f3a05a9240fa0f2f674bb76ff5185814ff20b56761ea5b63cbcbc814c7cb171882ddd72cb5282387de490ee03945cdbce73f36d8652e17784
SSDEEP 6144:LQ3G6GL24+E1ZyZb0aIU2V5hA9DaBQPy/ec9PTBndnqbn:U3/GaRUyZffaBQa/59PTv
TLSH
T1D3448D207660D532E492213689FADBBA5D7DB071073A91DB73C42F7E6D203E2667438B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

106183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\Desktop\cangku\cangku\chajian\Release-exe\上线模块.pdb

kernel32

CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle LoadLibraryW GetProcAddress CreateFileW GetCurrentProcess lstrcpyW GetLastError HeapAlloc GetProcessHeap HeapFree OpenProcess GetDriveTypeW GetDiskFreeSpaceExW GlobalMemoryStatusEx GetSystemInfo FreeLibrary GetModuleFileNameW GetCommandLineW GetStartupInfoW CreateProcessW ExitProcess WideCharToMultiByte CreateFileA DeviceIoControl QueryPerformanceFrequency GetConsoleWindow SetEvent ResetEvent QueryPerformanceCounter WaitForSingleObject InterlockedExchange lstrcmpW ExpandEnvironmentStringsW CopyFileW GetFileAttributesW CreateEventA FormatMessageW SetLastError VirtualProtect IsBadReadPtr LoadLibraryA GetNativeSystemInfo SetErrorMode SetUnhandledExceptionFilter GetCurrentThreadId CreateThread CreateMutexW GetFileSize DeleteFileW ReleaseMutex SetFilePointer RaiseException CreateEventW GetModuleHandleW LocalFree ReadFile LCMapStringW FlushFileBuffers SetStdHandle WriteConsoleW GetSystemTimeAsFileTime GetTickCount Sleep lstrcatW GetSystemDirectoryW GetLocaleInfoW GetLocalTime GetCurrentProcessId MultiByteToWideChar lstrlenW InterlockedDecrement VirtualAlloc LeaveCriticalSection EnterCriticalSection DeleteCriticalSection VirtualFree WriteFile InitializeCriticalSection GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetOEMCP InitializeCriticalSectionAndSpinCount HeapCreate HeapDestroy CreateWaitableTimerW GetACP GetCPInfo GetStringTypeW TlsFree TlsSetValue TlsGetValue TlsAlloc HeapSize GetStdHandle GetConsoleMode GetConsoleCP IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter TerminateProcess RtlUnwind HeapSetInformation HeapReAlloc ExitThread EncodePointer DecodePointer TryEnterCriticalSection CancelWaitableTimer SetWaitableTimer lstrlenA UnmapViewOfFile SwitchToThread CreateFileMappingW MapViewOfFileEx InterlockedIncrement InterlockedCompareExchange

user32

GetForegroundWindow GetMonitorInfoW GetWindowTextW MsgWaitForMultipleObjects PeekMessageW TranslateMessage DispatchMessageW GetLastInputInfo SendMessageW FindWindowA GetWindowTextA GetWindow GetClassNameA MessageBoxW OpenWindowStationW SetProcessWindowStation IsWindow PostThreadMessageA GetInputState EnumDisplayMonitors wsprintfW

advapi32

RegCreateKeyW RegDeleteValueW RegQueryValueExW RegOpenKeyExW LookupAccountSidW GetTokenInformation OpenProcessToken FreeSid CheckTokenMembership AllocateAndInitializeSid RegCloseKey RegEnumKeyExA RegQueryInfoKeyW RegOpenKeyExA GetCurrentHwProfileW RegSetValueExW

shell32

SHGetFolderPathW

ole32

CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysStringLen SysAllocString SysFreeString

ws2_32

WSASetLastError WSAStringToAddressW shutdown WSAAddressToStringW send setsockopt WSAIoctl htons WSAGetLastError inet_ntoa gethostbyname gethostname getsockname freeaddrinfo getaddrinfo WSAStartup WSAResetEvent WSAEventSelect WSACleanup bind connect recv WSACloseEvent WSACreateEvent socket WSAEnumNetworkEvents WSAWaitForMultipleEvents closesocket ntohs

shlwapi

StrChrW StrPBrkW PathIsDirectoryA

netapi32

NetWkstaGetInfo

dinput8

DirectInput8Create

winmm

timeGetDevCaps timeEndPeriod timeBeginPeriod timeGetTime

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-13_3955ea7b65ad642c89d4f67f4dffee82_amadey_elex_smoke-loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

netapi32

dinput8

winmm

generic