2026-10-22_084a6979fb234b9817f493fe31fc0a64_amadey_elex_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_084a6979fb234b9817f493fe31fc0a64_amadey_elex_smoke-loader_stop
Size 9.9MB
Sample261024-2f7xaacx7x
SHA256 d54c7ae285b1bae4de896150a2e6179bd9c908bcae87221cd2eabd4489a9a40a
MD5 084a6979fb234b9817f493fe31fc0a64
SHA1 8850adc8fad612779165fc00c732e522283bab6a
SHA512 d9aefc3ba856015b578d0de883a7b5bd70ff86511f3bc446ffe7052d0f341aad215330b658782b29c90910601a18a7962c292b83d9513ed32aa0b3e209fffcaa
SSDEEP 196608:fsqc63OqahFzlhsru/tQxwyr+QZgajHFwZGoVjeTeOVM59X+0wvqSc:fsqh3OqahFX/tWwyrgKwZ/jeTeOVM7XY
TLSH
T184A6AE12FC64C178D68222B2D93E3F7D946ED769173858C3B2C82C5C2E752E26A37257
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_084a6979fb234b9817f493fe31fc0a64_amadey_elex_smoke-loader_stop

File Explorer

2026-10-22_084a6979fb234b9817f493fe31fc0a64_amadey_elex_smoke-loader_stop

.exe 9.9MB

2026-10-22_084a6979fb234b9817f493fe31fc0a64_amadey_elex_smoke-loader_stop

IMPHASH e3d444d3d456cb172f70698bd74d6032
SHA256 d54c7ae285b1bae4de896150a2e6179bd9c908bcae87221cd2eabd4489a9a40a
MD5 084a6979fb234b9817f493fe31fc0a64
SHA1 8850adc8fad612779165fc00c732e522283bab6a
SHA512 d9aefc3ba856015b578d0de883a7b5bd70ff86511f3bc446ffe7052d0f341aad215330b658782b29c90910601a18a7962c292b83d9513ed32aa0b3e209fffcaa
SSDEEP 196608:fsqc63OqahFzlhsru/tQxwyr+QZgajHFwZGoVjeTeOVM59X+0wvqSc:fsqh3OqahFX/tWwyrgKwZ/jeTeOVM7XY
TLSH
T184A6AE12FC64C178D68222B2D93E3F7D946ED769173858C3B2C82C5C2E752E26A37257
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

925896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Work\GF\SRCS\Game\TW_based\ELFonline\play\GrandFantasia.pdb

kernel32

ReadFile SetFilePointer GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage CompareStringA CompareStringW SetEnvironmentVariableA GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetSystemInfo TlsSetValue GetCurrentProcessId GetTickCount HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetFileType SetHandleCount GetConsoleMode VirtualFree GetConsoleCP VirtualAlloc Sleep CloseHandle GetStdHandle WideCharToMultiByte GetOEMCP GetACP OpenProcess Process32Next Process32First ReleaseMutex OpenMutexA TerminateThread GetExitCodeThread IsDBCSLeadByteEx GetModuleFileNameW IsBadReadPtr GetSystemDirectoryA LocalFree GetSystemTime SetFileAttributesA GetFileSize MoveFileA RemoveDirectoryA lstrcmpiA GetCPInfo GetCurrentThread InterlockedDecrement SetLastError InterlockedIncrement GetCurrentThreadId ExitProcess GetSystemTimeAsFileTime GetFullPathNameA GetDriveTypeA FlushFileBuffers UnmapViewOfFile CreateFileMappingA MapViewOfFile GlobalFree IsProcessorFeaturePresent GlobalMemoryStatusEx GetPrivateProfileStringA GetPrivateProfileIntA WritePrivateProfileStringA MulDiv IsDBCSLeadByte ReadProcessMemory HeapSize GlobalAlloc FileTimeToLocalFileTime FileTimeToSystemTime WriteFile CreateFileA GetLastError SetEndOfFile GetProcessHeaps GlobalLock GlobalUnlock QueryDosDeviceA CreateMutexA GetStartupInfoA GetProcessHeap HeapAlloc GetVersionExA HeapFree GetCommandLineA DeleteFileA RaiseException IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind GetFileAttributesA CreateDirectoryA SetThreadAffinityMask CreateThread GetCurrentProcess GetProcessAffinityMask ResumeThread SuspendThread SetThreadPriority TlsFree GetModuleHandleA GetModuleFileNameA LoadLibraryA GetProcAddress QueryPerformanceFrequency QueryPerformanceCounter OutputDebugStringA WaitForSingleObject ReleaseSemaphore CreateSemaphoreA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection VirtualQuery FindFirstFileA FindNextFileA FindClose SwitchToThread InterlockedCompareExchange InterlockedExchange TlsAlloc FreeLibrary GetTimeZoneInformation LCMapStringW MultiByteToWideChar LCMapStringA SetEnvironmentVariableW GetCurrentDirectoryA SetProcessWorkingSetSize FormatMessageA GetEnvironmentVariableA CreateFileW GlobalMemoryStatus VirtualProtect HeapLock HeapWalk HeapUnlock TlsGetValue GetLocalTime GetUserDefaultLangID WriteProcessMemory

user32

SetTimer KillTimer PostMessageA GetActiveWindow GetLastActivePopup SendMessageA PeekMessageA TranslateMessage TranslateAcceleratorA DispatchMessageA GetWindowThreadProcessId LoadIconA LoadCursorA RegisterClassA CreateWindowExA SetClassLongA ShowWindow UpdateWindow SetFocus DestroyWindow SetCursor MessageBoxExA MessageBoxExW DrawTextA SetWindowTextA GetAsyncKeyState CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfA PtInRect SetRect RegisterClassExA EnumDisplaySettingsA IsWindow ClientToScreen GetClientRect GetClipboardData GetKeyState MoveWindow ChangeDisplaySettingsA SystemParametersInfoA ScreenToClient GetCursorPos ReleaseDC GetDC UnregisterClassA GetSystemMetrics FindWindowA GetWindowRect GetWindowLongA SetWindowLongA SetWindowPos PostQuitMessage DefWindowProcA GetParent GetProcessWindowStation GetUserObjectInformationW GetDesktopWindow MessageBoxA AdjustWindowRectEx

alaudio

alGetListener3f alListener3f alListenerfv alGetListenerfv alSourcePlay alGenSources alSourceQueueBuffers alSource3f alGenBuffers alBufferData alDeleteBuffers alGetEnumValue alGetSource3f alGetSourcei alSourceRewind alGetSourcef alSourcef alSourcei alIsSource alSourcePause alSourceStop alDeleteSources alcDestroyContext alcCloseDevice alGetError alcOpenDevice alcCreateContext alcMakeContextCurrent alcGetError alDistanceModel ord403 ord401 ord406 ord402 ord400 ord600 ord603 ord602 ord601 ord604 ord202 ord205 ord200 ord204 ord201 ord203 ord144 ord145 ord146 ord147 ord148 ord143 ord152 ord150 ord151 ord502 ord153

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueA

dinput8

DirectInput8Create

gdi32

AddFontResourceA RemoveFontResourceA CreateFontIndirectA DeleteDC CreateCompatibleDC SelectObject CreateDIBSection CreateSolidBrush GdiFlush DeleteObject GetTextExtentPoint32A SetTextColor GetStockObject SetBkMode

advapi32

RegOpenKeyExA OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueA GetSecurityInfo GetUserNameA SetEntriesInAclA SetSecurityInfo DeregisterEventSource RegisterEventSourceA ReportEventA OpenProcessToken RegCloseKey RegQueryValueExA

shell32

SHFileOperationA ShellExecuteA

psapi

GetProcessMemoryInfo

imm32

ImmSetOpenStatus ImmSetCompositionWindow ImmSetStatusWindowPos ImmReleaseContext ImmGetContext ImmGetOpenStatus ImmAssociateContext

winmm

waveOutReset timeGetTime waveOutOpen waveOutClose waveOutPrepareHeader waveOutWrite waveOutUnprepareHeader

iphlpapi

GetAdaptersInfo

ws2_32

inet_ntoa shutdown gethostname inet_addr WSAStartup WSACleanup closesocket gethostbyname WSAGetLastError WSARecv WSAAsyncSelect WSASend WSAConnect WSASocketA htons setsockopt

Name

.text

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1007KB

Virtual Size

1006KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

130KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

33B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfmod

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=4, id=126, version=50327,

count=52, id=125, productName=VS2005 build 50727, version=50727,

count=219, id=109, productName=VS2005 build 50727, version=50727,

count=8, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=9, id=223, productName=VS2013 UPD2 build 30501, version=30501,

count=234, id=224, productName=VS2013 UPD2 build 30501, version=30501,

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=21, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=23, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=356, id=1, productName=Unmarked objects,

count=1638, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=122, productName=VS2005 build 50727, version=50727,

count=1, id=124, productName=VS2005 build 50727, version=50727,

count=1, id=120, productName=VS2005 build 50727, version=50727,