2026-09-19_86a4d7f44c8f38e8ae6fbc34c40d6956_amadey_elex_floxif_glassworm_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_86a4d7f44c8f38e8ae6fbc34c40d6956_amadey_elex_floxif_glassworm_smoke-loader
Size 6.7MB
Sample260919-3pc9psvx2n
SHA256 10d973f063bb29258ade6312191d72906769fcbc95c890b895d531efd86733a4
MD5 86a4d7f44c8f38e8ae6fbc34c40d6956
SHA1 a47f795639b4d6f913674e77731e834bb543a9cd
SHA512 807125251b1475a7899d1ffbf0c3878994b9052674978b87faab1bd19ae53f0903d359b8467300cbdcff6eab5961f5b84f6b069832d423698111711480586e0c
SSDEEP 98304:aEsQNFaQKc8mDyPCAioOdcMpxhryv19HH9Nf:XkQSmDICAaryzX
TLSH
T17066AE06FE9F42B1C86A073001AB26266F385FCA77364BDB5295BC98D9333D6057B718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-19_86a4d7f44c8f38e8ae6fbc34c40d6956_amadey_elex_floxif_glassworm_smoke-loader

File Explorer

2026-09-19_86a4d7f44c8f38e8ae6fbc34c40d6956_amadey_elex_floxif_glassworm_smoke-loader

.exe 6.7MB

2026-09-19_86a4d7f44c8f38e8ae6fbc34c40d6956_amadey_elex_floxif_glassworm_smoke-loader

IMPHASH e39d31926c2a9a61bce453bce5997787
SHA256 10d973f063bb29258ade6312191d72906769fcbc95c890b895d531efd86733a4
MD5 86a4d7f44c8f38e8ae6fbc34c40d6956
SHA1 a47f795639b4d6f913674e77731e834bb543a9cd
SHA512 807125251b1475a7899d1ffbf0c3878994b9052674978b87faab1bd19ae53f0903d359b8467300cbdcff6eab5961f5b84f6b069832d423698111711480586e0c
SSDEEP 98304:aEsQNFaQKc8mDyPCAioOdcMpxhryv19HH9Nf:XkQSmDICAaryzX
TLSH
T17066AE06FE9F42B1C86A073001AB26266F385FCA77364BDB5295BC98D9333D6057B718
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2719209

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentDirectoryA GetFullPathNameA GetConsoleMode SetConsoleMode ReadConsoleInputA FileTimeToLocalFileTime FileTimeToSystemTime IsBadCodePtr IsBadReadPtr SetConsoleCtrlHandler RaiseException FlushConsoleInputBuffer lstrlenA GetLocaleInfoA VirtualProtect SetStdHandle SetEnvironmentVariableA GetOEMCP GetACP CompareStringW GetCPInfo CompareStringA VirtualQuery InterlockedExchange GetStringTypeW LCMapStringW LCMapStringA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle HeapSize IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy RtlUnwind HeapReAlloc ExitProcess GetCommandLineA GetStartupInfoA GetSystemTimeAsFileTime HeapAlloc HeapFree SetLastError GetModuleHandleA MoveFileExA LocalAlloc LocalLock LocalUnlock LocalFree GetSystemInfo GlobalMemoryStatus GetWindowsDirectoryA GetDriveTypeA GetVolumeInformationA GetTimeZoneInformation GetSystemDefaultLangID GetSystemDefaultLCID GetComputerNameA GetCurrentThreadId GetTickCount GetVersion GetSystemDirectoryA SetEndOfFile FlushFileBuffers WriteFile UnlockFile LockFile ReadFile SetFilePointer FindResourceA LoadResource LockResource SizeofResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetVersionExA FreeLibrary GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameA SetErrorMode LoadLibraryA GetProcAddress GetProfileStringA InterlockedDecrement CreateProcessA RemoveDirectoryA GetExitCodeProcess OpenProcess TerminateProcess CreateEventA ResetEvent CreateFileMappingA MapViewOfFile WaitForSingleObject GetCurrentProcess DuplicateHandle Beep CreateFileA GetFileSize CloseHandle GetDiskFreeSpaceA FindFirstFileA FindNextFileA FindClose GetLastError SetFileAttributesA MultiByteToWideChar WideCharToMultiByte SetUnhandledExceptionFilter DeleteFileA Sleep CreateDirectoryA GetStringTypeA

user32

PeekMessageA GetQueueStatus GetMessageA DestroyWindow GetClientRect SetFocus ShowWindow CreateWindowExA GetSystemMetrics SystemParametersInfoA RegisterClassA LoadCursorA LoadIconA wsprintfA ReleaseDC DrawIcon GetWindowDC TranslateMessage GetWindowLongA SetWindowLongA EndPaint BeginPaint DefWindowProcA FillRect SetRect MessageBoxA GetKeyboardState GetDC EnumDisplaySettingsA ShowCaret SetCaretPos CreateCaret HideCaret EnumWindows SendMessageA InvalidateRect DispatchMessageA SetWindowPos PtInRect GetWindowThreadProcessId PostMessageA WaitForInputIdle KillTimer LoadImageA SetTimer FrameRect CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetClipboardData GetKeyState SetScrollPos GetFocus GetUpdateRect PostQuitMessage GetCursorPos RegisterClassExA SetScrollInfo ShowScrollBar UpdateWindow GetDesktopWindow

winspool.drv

ClosePrinter EndDocPrinter StartDocPrinterA WritePrinter StartPagePrinter EndPagePrinter OpenPrinterA DocumentPropertiesA DeviceCapabilitiesA

gdi32

LineTo PaintRgn GetObjectA CreateHalftonePalette GetDIBColorTable CreatePalette SelectPalette RealizePalette PtInRegion EndDoc AbortDoc StartDocA GetEnhMetaFileBits DeleteEnhMetaFile EndPage StartPage Escape SetTextCharacterExtra PatBlt MoveToEx GetTextMetricsA StretchBlt SetStretchBltMode GetTextExtentPointA SetTextAlign CreateBitmap SetBkMode GetRgnBox SelectClipRgn FrameRgn BitBlt CreateFontIndirectA SetTextColor CreatePen SetBkColor CreateSolidBrush SelectObject DeleteObject GetStockObject CreateCompatibleDC GetDeviceCaps DeleteDC CreateRectRgn SetRectRgn CombineRgn CreateEnhMetaFileA CreateCompatibleBitmap CreateDCA PlayEnhMetaFile SetEnhMetaFileBits GetEnhMetaFileHeader GetDIBits SetTextJustification TextOutA CloseEnhMetaFile

wininet

HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA InternetQueryDataAvailable HttpQueryInfoA HttpEndRequestA InternetAttemptConnect InternetWriteFile HttpSendRequestExA InternetQueryOptionA InternetCrackUrlA InternetCanonicalizeUrlA InternetCreateUrlA InternetSetOptionA InternetCloseHandle FtpOpenFileA InternetSetFilePointer InternetReadFile

wsock32

gethostbyname ioctlsocket ntohs htonl closesocket connect recv send WSAGetLastError htons shutdown WSASetLastError accept WSAAsyncSelect WSACleanup WSAStartup socket inet_addr gethostbyaddr getsockname ntohl

odbc32

ord75 ord41 ord11 ord36 ord18 ord16 ord14 ord15 ord13 ord4 ord27 ord24

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA CryptReleaseContext CryptGenRandom RegEnumValueA RegEnumKeyExA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegSetKeySecurity RegSetValueExA RegDeleteKeyA RegCreateKeyExA CryptAcquireContextA

rpcrt4

UuidFromStringA

rasapi32

RasHangUpA

ole32

CoInitialize CoCreateGuid CoCreateInstance CLSIDFromProgID CoUninitialize

oleaut32

SysAllocString VariantClear GetErrorInfo VariantInit SysFreeString

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

88KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

144KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=3, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=5, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=95, version=2179,

count=13, id=28, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=14, version=7299,

count=5, id=105, version=2067,

count=243, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=96, version=2179,

count=2, id=28, version=9177,

count=2, id=25, version=9111,

count=2, id=93, version=2067,

count=23, id=93, version=2179,

count=343, id=1, productName=Unmarked objects,

count=157, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=34, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=372, productName=Unmarked objects (old),

count=408, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,