2026-10-15_f22dc0df39dc7b17f4640325aa14bf21_elex_smoke-loader_wapomi

General

Target
2026-10-15_f22dc0df39dc7b17f4640325aa14bf21_elex_smoke-loader_wapomi
Size 75KB
Sample261015-2873raew8l
SHA256 c79581c589e4d83b92078f79648096338b3c5ec1b7f7616e08631f94dac23af9
MD5 f22dc0df39dc7b17f4640325aa14bf21
SHA1 718b8502392a766807abaae660b1130da1289fe0
SHA512 6ad71be28d193ebfde805777aaa0b916fd6691194163f8c95461782493add8406f6311ce1f9f6ab85962fbe644bd70b787aac329d84b239ee24890a7dc373e34
SSDEEP 1536:py3IqGrGu6sug3I9SBC3KVnnYQGCjmS3GGCq2iW7z:yEGdsuQI8PnnYlCp2GCH
TLSH
T1D2736D4B8E7900A3E8885670119262770E7B95325368DBFFFFC81C9566216A09D743FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-15_f22dc0df39dc7b17f4640325aa14bf21_elex_smoke-loader_wapomi

File Explorer

2026-10-15_f22dc0df39dc7b17f4640325aa14bf21_elex_smoke-loader_wapomi

.exe 75KB

2026-10-15_f22dc0df39dc7b17f4640325aa14bf21_elex_smoke-loader_wapomi

IMPHASH 4ba3cc1f9c4d4695a3d9b7e225747632
SHA256 c79581c589e4d83b92078f79648096338b3c5ec1b7f7616e08631f94dac23af9
MD5 f22dc0df39dc7b17f4640325aa14bf21
SHA1 718b8502392a766807abaae660b1130da1289fe0
SHA512 6ad71be28d193ebfde805777aaa0b916fd6691194163f8c95461782493add8406f6311ce1f9f6ab85962fbe644bd70b787aac329d84b239ee24890a7dc373e34
SSDEEP 1536:py3IqGrGu6sug3I9SBC3KVnnYQGCjmS3GGCq2iW7z:yEGdsuQI8PnnYlCp2GCH
TLSH
T1D2736D4B8E7900A3E8885670119262770E7B95325368DBFFFFC81C9566216A09D743FF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

73728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\php-sdk\php54dev\vc9\x86\obj\Release\php.pdb

php5

php_network_getaddresses zend_hash_apply_with_arguments zend_llist_get_next_ex zend_ini_boolean_displayer_cb OnUpdateBool zend_register_ini_entries php_network_freeaddresses php_register_variable_safe spprintf php_set_sock_blocking zend_hash_del_key_or_index _zend_hash_index_update_or_next_insert zend_execute_scripts vspprintf php_handle_special_queries php_handle_auth_data php_url_decode _estrdup zend_hash_index_find php_socket_strerror zend_llist_get_first_ex php_escape_html_entities_ex _erealloc php_network_populate_name_from_sockaddr php_poll2 sapi_send_headers ap_php_snprintf zend_unregister_ini_entries _safe_malloc php_ini_scanned_files zend_read_property zend_printf reflection_extension_ptr zend_eval_string_ex gc_remove_zval_from_buffer zend_strndup php_module_shutdown_wrapper zend_register_constant php_getopt zend_ini_deactivate _php_stream_free sapi_shutdown get_zend_version php_output_write php_module_shutdown zend_is_auto_global _zend_hash_add_or_update zend_hash_copy php_execute_script _zval_ptr_dtor php_handle_aborted_connection _efree zend_strip display_ini_entries php_get_highlight_struct sapi_globals php_ini_scanned_path reflection_ptr reflection_zend_extension_ptr _emalloc sapi_module executor_globals zend_hash_destroy php_output_end_all reflection_method_ptr zend_exception_get_default zend_llist_copy zend_load_extension compiler_globals zend_hash_apply php_register_variable php_ini_opened_path php_lint_script reflection_function_ptr module_registry zend_call_method zend_str_tolower_dup php_printf zend_error tsrm_realpath php_module_startup _php_stream_open_wrapper_ex zif_dl core_globals php_print_info php_request_startup zend_extensions _zend_hash_init php_import_environment_variables sapi_startup zend_highlight zend_hash_find php_info_print_module _php_stream_get_line _object_init_ex open_file_for_scanning zend_qsort zend_hash_sort _estrndup zend_llist_destroy php_request_shutdown reflection_class_ptr sapi_deactivate zend_llist_sort php_select zend_llist_apply

ws2_32

htons ntohs getsockname setsockopt recv bind socket closesocket send listen accept WSAGetLastError

msvcr90

_stricmp _setmode _read _close _open _setjmp3 memset _strdup _controlfp_s _invoke_watson _except_handler4_common _decode_pointer _onexit _lock __dllonexit _unlock ?terminate@@YAXXZ _crt_debugger_hook __set_app_type _encode_pointer __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm __initenv _XcptFilter _exit _cexit __getmainargs _amsg_exit _getcwd _stat32 _ctime32_s toupper bsearch _chdir strncpy strtol _ftime32 signal strerror strncmp exit fclose getenv fseek realloc ftell strrchr fwrite _fmode _fileno fprintf fopen printf isalnum fgetc _errno fflush strchr __iob_func strstr rewind malloc free memmove memcpy

kernel32

GetCurrentThreadId Sleep InterlockedCompareExchange TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetCurrentProcessId InterlockedExchange GetTickCount QueryPerformanceCounter

Name

.text

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

��o�u�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-15_f22dc0df39dc7b17f4640325aa14bf21_elex_smoke-loader_wapomi

php5

ws2_32

msvcr90

kernel32

generic