2026-09-29_dd9c58b692e244a9f6a2dd6ab8b4d6e1_amadey_dharma_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_dd9c58b692e244a9f6a2dd6ab8b4d6e1_amadey_dharma_elex_smoke-loader_stop
Size 688KB
Sample260930-thlstszaqb
SHA256 e5a41ad87802858ce9a5224bbf89b13a2808059cf7c4b6855fef1c2ef366abaa
MD5 dd9c58b692e244a9f6a2dd6ab8b4d6e1
SHA1 8b4f00070e225879ff8555bb9371c09b25d109ec
SHA512 64de8c9e70acb37e739e89193c943c217e92ae16afcce7f2f4e0669686627f8d0320526c7b1f182d41543325f46692ebfbfac258cf1d65f59c99b79cd4b4b557
SSDEEP 12288:TGbqq6vEok5XtNdS4vGq3y5f4pUMs8ZiJiwEgJzUtEijw1jLV6V:u5XtNdSBSmEUb8ZZcotEtjO
TLSH
T104E49F00B661D03BF57723F019A6B76DB5287EB0572094CB53D927AE6734AE0ED3132A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_dd9c58b692e244a9f6a2dd6ab8b4d6e1_amadey_dharma_elex_smoke-loader_stop

File Explorer

2026-09-29_dd9c58b692e244a9f6a2dd6ab8b4d6e1_amadey_dharma_elex_smoke-loader_stop

.exe 688KB

2026-09-29_dd9c58b692e244a9f6a2dd6ab8b4d6e1_amadey_dharma_elex_smoke-loader_stop

IMPHASH a87e71b986f547bfa207d9fb7ed499a5
SHA256 e5a41ad87802858ce9a5224bbf89b13a2808059cf7c4b6855fef1c2ef366abaa
MD5 dd9c58b692e244a9f6a2dd6ab8b4d6e1
SHA1 8b4f00070e225879ff8555bb9371c09b25d109ec
SHA512 64de8c9e70acb37e739e89193c943c217e92ae16afcce7f2f4e0669686627f8d0320526c7b1f182d41543325f46692ebfbfac258cf1d65f59c99b79cd4b4b557
SSDEEP 12288:TGbqq6vEok5XtNdS4vGq3y5f4pUMs8ZiJiwEgJzUtEijw1jLV6V:u5XtNdSBSmEUb8ZZcotEtjO
TLSH
T104E49F00B661D03BF57723F019A6B76DB5287EB0572094CB53D927AE6734AE0ED3132A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

200208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\77\VB2T\Release\spaces.pdb

kernel32

InterlockedExchange LockResource FindResourceExA CreateFileW GetFileInformationByHandle SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile GetConsoleOutputCP WriteConsoleA GetTimeZoneInformation SetStdHandle GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetLocaleInfoA GetStringTypeW GetStringTypeA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetTickCount QueryPerformanceCounter LCMapStringW LCMapStringA FlushFileBuffers SetFilePointer GetConsoleCP InitializeCriticalSectionAndSpinCount IsDBCSLeadByte TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage OpenEventA GetOEMCP HeapCreate LoadLibraryW GetFileType WriteConsoleW GetStdHandle DebugBreak GetStartupInfoA GetCommandLineA VirtualQuery VirtualProtect RtlUnwind IsDebuggerPresent GlobalAlloc UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime ExitProcess Sleep GetModuleHandleW IsBadReadPtr HeapValidate GetModuleFileNameW GetCurrentThread CreateFileMappingA MapViewOfFile GetProcAddress lstrcmpiA LoadLibraryExA FindResourceA LoadResource SizeofResource FreeLibrary InitializeCriticalSection lstrlenW MultiByteToWideChar GetModuleFileNameA InterlockedDecrement InterlockedIncrement GetWindowsDirectoryA DeleteCriticalSection GetConsoleMode CreateEventW WriteFile GetCurrentProcessId CreateToolhelp32Snapshot Module32FirstW Module32NextW SetHandleCount CloseHandle WaitForSingleObject CancelIoEx GetLastError GetFullPathNameA CreateDirectoryA GetShortPathNameA GetLongPathNameA RemoveDirectoryA GetDiskFreeSpaceExA GetDiskFreeSpaceA GetCommState GlobalFree LocalLock VirtualAlloc OpenProcess ExpandEnvironmentStringsA GetFileAttributesA EnumDateFormatsA lstrlenA FormatMessageA LocalFree CreateFileA GetModuleHandleA GetProcessHeap lstrcpyA GetFileSize HeapAlloc ReadFile WideCharToMultiByte GetCurrentProcess FlushInstructionCache SetLastError GetSystemInfo UnmapViewOfFile HeapDestroy GetCurrentThreadId HeapSize HeapReAlloc InterlockedCompareExchange IsProcessorFeaturePresent LoadLibraryA HeapFree VirtualFree OutputDebugStringW OutputDebugStringA SetEvent LocalAlloc GetOverlappedResult GetACP GetFileAttributesW SetUnhandledExceptionFilter GetFileAttributesExW GetVersionExA RaiseException EnterCriticalSection LeaveCriticalSection GetCPInfo

user32

GetWindowLongA GetWindowRect GetWindow EndDialog IsDialogMessageA LoadImageA GetSystemMetrics CopyRect SendMessageA SetWindowTextA GetDlgItem GetActiveWindow PostQuitMessage UpdateWindow InvalidateRect MonitorFromWindow DestroyWindow IsWindow GetClientRect MapWindowPoints SetWindowLongA GetScrollInfo SetWindowPos SetLayeredWindowAttributes SendDlgItemMessageA GetWindowTextA GetWindowTextLengthA GetParent EnableScrollBar GetDC DispatchMessageA TranslateMessage DialogBoxParamA GetMonitorInfoA CharNextA CallWindowProcA CreateDialogParamA UnregisterClassA DefWindowProcA GetMenu EndMenu SetScrollPos ScrollWindowEx IsWindowUnicode ActivateKeyboardLayout SetScrollRange ReleaseDC BeginPaint EndPaint GetWindowWord TrackPopupMenu CheckMenuRadioItem LoadIconA MessageBoxA LoadStringA LoadAcceleratorsA TranslateAcceleratorA CallNextHookEx SetWindowsHookExA UnhookWindowsHookEx SetRect GetSysColor FillRect GetFocus ShowWindow PeekMessageA GetMessageA

gdi32

GetPixel SetStretchBltMode GetDIBColorTable SetDIBColorTable GetObjectA CreateDIBSection StretchBlt CreateFontW GetMapMode SetMapMode BitBlt SelectPalette RealizePalette DeleteDC CreatePalette AddFontResourceExW CombineRgn CreateCompatibleDC SelectObject DeleteObject CreateSolidBrush CreateFontA SetPixelV

comdlg32

GetOpenFileNameA GetSaveFileNameA

advapi32

OpenThreadToken SetThreadToken CreateWellKnownSid GetUserNameA IsTextUnicode RegQueryInfoKeyA RegSetValueExA RegEnumKeyExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA OpenProcessToken AllocateAndInitializeSid IsWellKnownSid CryptAcquireContextA CryptGenRandom CryptGenKey CryptReleaseContext CryptSetProvParam CryptGetUserKey CryptExportKey CryptAcquireContextW CryptImportKey CryptSetKeyParam CryptDestroyKey RegQueryValueExA GetSecurityInfo ConvertSidToStringSidA RevertToSelf

shell32

DragQueryFileA Shell_NotifyIconA

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree GetRunningObjectTable CreateItemMoniker StgOpenStorage CoUninitialize CoInitialize CoCreateInstance

oleaut32

SafeArrayPutElement SafeArrayDestroy SafeArrayAccessData VariantInit VarUI4FromStr VarR4FromI2 SafeArrayUnaccessData VarR4FromI4 SafeArrayCreateVector

odbc32

ord3 ord12 ord1 ord2 ord13 ord41 ord19 ord16 ord31 ord9

shlwapi

PathFileExistsA ColorRGBToHLS PathStripToRootA PathFindExtensionA PathFindExtensionW PathFileExistsW

comctl32

ImageList_GetIconSize ImageList_LoadImageA ord17 InitCommonControlsEx

msimg32

TransparentBlt AlphaBlend

opengl32

glDepthFunc glClearDepth glShadeModel glHint glEnable glClearColor

gdiplus

GdipFree GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipDeleteGraphics GdipCreateFromHWNDICM GdipCreateFromHWND GdipSaveImageToFile GdipDisposeImage GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipCloneImage GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipDrawImageI GdipGetImageGraphicsContext GdipAlloc GdiplusShutdown

psapi

EnumProcessModules GetModuleBaseNameA GetModuleFileNameExA

winmm

waveInPrepareHeader waveInAddBuffer waveOutOpen waveInOpen

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

crypt32

PFXImportCertStore CertEnumCertificatesInStore CertGetCertificateContextProperty CertFreeCertificateContext CryptAcquireCertificatePrivateKey

rpcrt4

UuidCreateSequential UuidCreate UuidToStringA

uxtheme

SetThemeAppProperties

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_dd9c58b692e244a9f6a2dd6ab8b4d6e1_amadey_dharma_elex_smoke-loader_stop

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

odbc32

shlwapi

comctl32

msimg32

opengl32

gdiplus

psapi

winmm

version

crypt32

rpcrt4

uxtheme

generic