2026-09-16_af981784a5ec4a1922972c7d1a23be70_amadey_elex_smoke-loader

General

Target
2026-09-16_af981784a5ec4a1922972c7d1a23be70_amadey_elex_smoke-loader
Size 306KB
Sample260916-wplgraej31
SHA256 131f3db835e8af36b456cb43c6ae19d592dcaeca235cc3d8e5a767a88940a35c
MD5 af981784a5ec4a1922972c7d1a23be70
SHA1 9ebf1b0d9851cffdeb474df5d73302b6edb7cfcf
SHA512 95bee3cce23f555ba4483b338a93bfbc170e5e68536d8acf1d84719ad12cef4b519eff39c4bd9fd9cd87eb5c7acfe859f1c57e43ceda7649ccfb995b3ae997e6
SSDEEP 6144:P/1NViOKCNMPor1lLhwcch7BfbFtwOnt2aK+qeUK4G9:1NpfN9wzPJsG
TLSH
T14D64BE2136D0C477D1270231CDD4F7F9AABABAB2893192473F941B2E6F755D29A1830B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_af981784a5ec4a1922972c7d1a23be70_amadey_elex_smoke-loader

File Explorer

2026-09-16_af981784a5ec4a1922972c7d1a23be70_amadey_elex_smoke-loader

.exe 306KB

2026-09-16_af981784a5ec4a1922972c7d1a23be70_amadey_elex_smoke-loader

IMPHASH ab385e32b6883f24946315ae0c020570
SHA256 131f3db835e8af36b456cb43c6ae19d592dcaeca235cc3d8e5a767a88940a35c
MD5 af981784a5ec4a1922972c7d1a23be70
SHA1 9ebf1b0d9851cffdeb474df5d73302b6edb7cfcf
SHA512 95bee3cce23f555ba4483b338a93bfbc170e5e68536d8acf1d84719ad12cef4b519eff39c4bd9fd9cd87eb5c7acfe859f1c57e43ceda7649ccfb995b3ae997e6
SSDEEP 6144:P/1NViOKCNMPor1lLhwcch7BfbFtwOnt2aK+qeUK4G9:1NpfN9wzPJsG
TLSH
T14D64BE2136D0C477D1270231CDD4F7F9AABABAB2893192473F941B2E6F755D29A1830B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

120425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryW GetModuleFileNameW GetModuleFileNameA LocalFree FormatMessageW FormatMessageA CloseHandle SetFileTime CreateFileW SetLastError SetFileAttributesW SetFileAttributesA RemoveDirectoryW RemoveDirectoryA MoveFileW MoveFileA CreateDirectoryW CreateDirectoryA DeleteFileW DeleteFileA GetFullPathNameW GetFullPathNameA GetLastError GetCurrentProcessId GetTickCount GetCurrentThreadId FindClose FindFirstFileW FindFirstFileA GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile CreateFileA FileTimeToSystemTime MultiByteToWideChar WideCharToMultiByte WaitForMultipleObjects VirtualAlloc VirtualFree WaitForSingleObject CreateEventA SetEvent ResetEvent InitializeCriticalSection GetCommandLineW SetFileApisToOEM GetProcessHeap GetStringTypeW LCMapStringW WriteConsoleW SetStdHandle LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetStdHandle SetConsoleMode GetConsoleMode GetVersionExA FileTimeToLocalFileTime SetConsoleCtrlHandler IsValidCodePage GetOEMCP GetACP GetCPInfo GetSystemTimeAsFileTime RtlUnwind RaiseException DecodePointer EncodePointer HeapAlloc HeapFree HeapReAlloc ExitThread CreateThread GetCommandLineA HeapSetInformation TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW InterlockedDecrement GetProcAddress TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent Sleep HeapSize ExitProcess HeapCreate SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW GetConsoleCP FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter

user32

CharUpperW CharUpperA CharNextA

advapi32

RegOpenKeyExA RegQueryValueExW RegQueryValueExA RegCloseKey

oleaut32

VariantClear SysFreeString SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_af981784a5ec4a1922972c7d1a23be70_amadey_elex_smoke-loader

kernel32

user32

advapi32

oleaut32

generic