General

  • Target
    2026-10-23_f3182fa584ccfbc372bea4aa40d37270_amadey_elex_smoke-loader
  • Size 15.0MB
  • Sample261023-gjfa8azy2n
  • SHA256 237a2d346ff791d3e2a9886eeec6e7e17b9bc6e97e7ee42b6a792b2afd0f5742
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Signatures

  • Detects executables packed with VMProtect. 1 IoCs
  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • 2026-10-23_f3182fa584ccfbc372bea4aa40d37270_amadey_elex_smoke-loader
    .exe 15.0MB

2026-10-23_f3182fa584ccfbc372bea4aa40d37270_amadey_elex_smoke-loader

  • IMPHASH cfafd8edd96f9701bb52de289050c4b1
  • SHA256 237a2d346ff791d3e2a9886eeec6e7e17b9bc6e97e7ee42b6a792b2afd0f5742
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Detects executables packed with VMProtect.

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest
9b:76:98:d2:7f:77:d6:cf:9e:c3:eb:4f:99:02:9d:83:c4:50:5b:0a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=ROBLOX Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ROBLOX Corporation,L=Menlo Park,ST=California,C=US
Minor OS version
1
Major OS version
5
Entry point
16244163
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\BuildAgent\work\838e6b7f780c1f82\Client\WindowsClient\Win32\Release\RobloxPlayerBetaRaw.pdb