2026-10-13_e96a7f36f84982fac1bdac32285ed06a_amadey_elex_floxif_glassworm_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_e96a7f36f84982fac1bdac32285ed06a_amadey_elex_floxif_glassworm_smoke-loader
Size 6.7MB
Sample261014-c2sxtaxvav
SHA256 d192a0c864a23c0db064120e1c9272eaee61f740a13827e973527c89b3ca91a0
MD5 e96a7f36f84982fac1bdac32285ed06a
SHA1 f950976d555542f3f116356df34ebe80246283f9
SHA512 b72c7149f5f0990bdc6f43c1ad9de44c38662f6dda79a97f23331cfb91a60ea51fa0d77c5dd755441d9cc1349a7c28083f8d6edf8190ffe27698e799c71bef58
SSDEEP 49152:63zVGCKKbwbbZzOIniBJy0BK7JHCRrdfOzsOaR0IxEgkUAe/gRE3RhgJIC9weS6T:63zwCKwsN1qBkJajA6j64/gZ85XH9jK
TLSH
T1F666AF06FE9F42B1C96A037005AF22266B345FCE773647DB5294BC94E9333DA057A728
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-13_e96a7f36f84982fac1bdac32285ed06a_amadey_elex_floxif_glassworm_smoke-loader

File Explorer

2026-10-13_e96a7f36f84982fac1bdac32285ed06a_amadey_elex_floxif_glassworm_smoke-loader

.exe 6.7MB

2026-10-13_e96a7f36f84982fac1bdac32285ed06a_amadey_elex_floxif_glassworm_smoke-loader

IMPHASH e39d31926c2a9a61bce453bce5997787
SHA256 d192a0c864a23c0db064120e1c9272eaee61f740a13827e973527c89b3ca91a0
MD5 e96a7f36f84982fac1bdac32285ed06a
SHA1 f950976d555542f3f116356df34ebe80246283f9
SHA512 b72c7149f5f0990bdc6f43c1ad9de44c38662f6dda79a97f23331cfb91a60ea51fa0d77c5dd755441d9cc1349a7c28083f8d6edf8190ffe27698e799c71bef58
SSDEEP 49152:63zVGCKKbwbbZzOIniBJy0BK7JHCRrdfOzsOaR0IxEgkUAe/gRE3RhgJIC9weS6T:63zwCKwsN1qBkJajA6j64/gZ85XH9jK
TLSH
T1F666AF06FE9F42B1C96A037005AF22266B345FCE773647DB5294BC94E9333DA057A728
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2713993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentDirectoryA GetFullPathNameA GetConsoleMode SetConsoleMode ReadConsoleInputA FileTimeToLocalFileTime FileTimeToSystemTime IsBadCodePtr IsBadReadPtr SetConsoleCtrlHandler RaiseException FlushConsoleInputBuffer lstrlenA GetLocaleInfoA VirtualProtect SetStdHandle SetEnvironmentVariableA GetOEMCP GetACP CompareStringW GetCPInfo CompareStringA VirtualQuery InterlockedExchange GetStringTypeW LCMapStringW LCMapStringA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle HeapSize IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy RtlUnwind HeapReAlloc ExitProcess GetCommandLineA GetStartupInfoA GetSystemTimeAsFileTime HeapAlloc HeapFree SetLastError GetModuleHandleA MoveFileExA LocalAlloc LocalLock LocalUnlock LocalFree GetSystemInfo GlobalMemoryStatus GetWindowsDirectoryA GetDriveTypeA GetVolumeInformationA GetTimeZoneInformation GetSystemDefaultLangID GetSystemDefaultLCID GetComputerNameA GetCurrentThreadId GetTickCount GetVersion GetSystemDirectoryA SetEndOfFile FlushFileBuffers WriteFile UnlockFile LockFile ReadFile SetFilePointer FindResourceA LoadResource LockResource SizeofResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetVersionExA FreeLibrary GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameA SetErrorMode LoadLibraryA GetProcAddress GetProfileStringA InterlockedDecrement CreateProcessA RemoveDirectoryA GetExitCodeProcess OpenProcess TerminateProcess CreateEventA ResetEvent CreateFileMappingA MapViewOfFile WaitForSingleObject GetCurrentProcess DuplicateHandle Beep CreateFileA GetFileSize CloseHandle GetDiskFreeSpaceA FindFirstFileA FindNextFileA FindClose GetLastError SetFileAttributesA MultiByteToWideChar WideCharToMultiByte SetUnhandledExceptionFilter DeleteFileA Sleep CreateDirectoryA GetStringTypeA

user32

PeekMessageA GetQueueStatus GetMessageA DestroyWindow GetClientRect SetFocus ShowWindow CreateWindowExA GetSystemMetrics SystemParametersInfoA RegisterClassA LoadCursorA LoadIconA wsprintfA ReleaseDC DrawIcon GetWindowDC TranslateMessage GetWindowLongA SetWindowLongA EndPaint BeginPaint DefWindowProcA FillRect SetRect MessageBoxA GetKeyboardState GetDC EnumDisplaySettingsA ShowCaret SetCaretPos CreateCaret HideCaret EnumWindows SendMessageA InvalidateRect DispatchMessageA SetWindowPos PtInRect GetWindowThreadProcessId PostMessageA WaitForInputIdle KillTimer LoadImageA SetTimer FrameRect CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetClipboardData GetKeyState SetScrollPos GetFocus GetUpdateRect PostQuitMessage GetCursorPos RegisterClassExA SetScrollInfo ShowScrollBar UpdateWindow GetDesktopWindow

winspool.drv

ClosePrinter EndDocPrinter StartDocPrinterA WritePrinter StartPagePrinter EndPagePrinter OpenPrinterA DocumentPropertiesA DeviceCapabilitiesA

gdi32

LineTo PaintRgn GetObjectA CreateHalftonePalette GetDIBColorTable CreatePalette SelectPalette RealizePalette PtInRegion EndDoc AbortDoc StartDocA GetEnhMetaFileBits DeleteEnhMetaFile EndPage StartPage Escape SetTextCharacterExtra PatBlt MoveToEx GetTextMetricsA StretchBlt SetStretchBltMode GetTextExtentPointA SetTextAlign CreateBitmap SetBkMode GetRgnBox SelectClipRgn FrameRgn BitBlt CreateFontIndirectA SetTextColor CreatePen SetBkColor CreateSolidBrush SelectObject DeleteObject GetStockObject CreateCompatibleDC GetDeviceCaps DeleteDC CreateRectRgn SetRectRgn CombineRgn CreateEnhMetaFileA CreateCompatibleBitmap CreateDCA PlayEnhMetaFile SetEnhMetaFileBits GetEnhMetaFileHeader GetDIBits SetTextJustification TextOutA CloseEnhMetaFile

wininet

HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA InternetQueryDataAvailable HttpQueryInfoA HttpEndRequestA InternetAttemptConnect InternetWriteFile HttpSendRequestExA InternetQueryOptionA InternetCrackUrlA InternetCanonicalizeUrlA InternetCreateUrlA InternetSetOptionA InternetCloseHandle FtpOpenFileA InternetSetFilePointer InternetReadFile

wsock32

gethostbyname ioctlsocket ntohs htonl closesocket connect recv send WSAGetLastError htons shutdown WSASetLastError accept WSAAsyncSelect WSACleanup WSAStartup socket inet_addr gethostbyaddr getsockname ntohl

odbc32

ord75 ord41 ord11 ord36 ord18 ord16 ord14 ord15 ord13 ord4 ord27 ord24

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA CryptReleaseContext CryptGenRandom RegEnumValueA RegEnumKeyExA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegSetKeySecurity RegSetValueExA RegDeleteKeyA RegCreateKeyExA CryptAcquireContextA

rpcrt4

UuidFromStringA

rasapi32

RasHangUpA

ole32

CoInitialize CoCreateGuid CoCreateInstance CLSIDFromProgID CoUninitialize

oleaut32

SysAllocString VariantClear GetErrorInfo VariantInit SysFreeString

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

88KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

144KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=3, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=5, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=95, version=2179,

count=13, id=28, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=14, version=7299,

count=5, id=105, version=2067,

count=243, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=96, version=2179,

count=2, id=28, version=9177,

count=2, id=25, version=9111,

count=2, id=93, version=2067,

count=23, id=93, version=2179,

count=343, id=1, productName=Unmarked objects,

count=157, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=34, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=372, productName=Unmarked objects (old),

count=408, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,