2026-10-31_e65611987da76fda56ecca8b6009cd5c_amadey_elex_smoke-loader

General

Target
2026-10-31_e65611987da76fda56ecca8b6009cd5c_amadey_elex_smoke-loader
Size 571KB
Sample261101-xp3ayada96
SHA256 14ed0b00b62cff6c3f871b8ab11829d8e807caa62aae2c8cefef0af44033d4fe
MD5 e65611987da76fda56ecca8b6009cd5c
SHA1 bd36acdbd5ac7d3a6b6347819228bd018e8f510c
SHA512 67989cb0c3ab58b950a98aac2ac97ea489ee0b36514e09eed8f24d5a33839dd7d5f30e29202fae8f0716f52c007d7e3445eb3386c0299f870ac1f4ab7039ff73
SSDEEP 12288:O96kTxEWNDT64h2Vufu9JcVyRxgw17DFkcW+ZX0EyU7:O9LTxNDTb279+VyHH7p08
TLSH
T101C4D010ABA1C039F5F356F849B993A8B43E79A1676054CF23E51AEE5634AE0FD30317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_e65611987da76fda56ecca8b6009cd5c_amadey_elex_smoke-loader

File Explorer

2026-10-31_e65611987da76fda56ecca8b6009cd5c_amadey_elex_smoke-loader

.exe 571KB

2026-10-31_e65611987da76fda56ecca8b6009cd5c_amadey_elex_smoke-loader

IMPHASH bdaee7bf3d7f5fcbbe5fa5d59a50c909
SHA256 14ed0b00b62cff6c3f871b8ab11829d8e807caa62aae2c8cefef0af44033d4fe
MD5 e65611987da76fda56ecca8b6009cd5c
SHA1 bd36acdbd5ac7d3a6b6347819228bd018e8f510c
SHA512 67989cb0c3ab58b950a98aac2ac97ea489ee0b36514e09eed8f24d5a33839dd7d5f30e29202fae8f0716f52c007d7e3445eb3386c0299f870ac1f4ab7039ff73
SSDEEP 12288:O96kTxEWNDT64h2Vufu9JcVyRxgw17DFkcW+ZX0EyU7:O9LTxNDTb279+VyHH7p08
TLSH
T101C4D010ABA1C039F5F356F849B993A8B43E79A1676054CF23E51AEE5634AE0FD30317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

364304

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\zopubov\xib\nanodod\noteteb_mit_xulu.pdb

kernel32

TlsGetValue CommConfigDialogA BuildCommDCBAndTimeoutsA FreeLibrary InterlockedDecrement ZombifyActCtx SetFirmwareEnvironmentVariableA SetEnvironmentVariableW CreateJobObjectW GetNamedPipeHandleStateA GetProfileSectionA SetVolumeMountPointW GetModuleHandleW GetProcessHeap GetPrivateProfileStringW GetConsoleTitleA ReadConsoleW CreateRemoteThread GetSystemWow64DirectoryA TlsSetValue GetConsoleCP SetFileShortNameW GetConsoleMode TerminateThread CopyFileW GetCalendarInfoA GetVersionExW LeaveCriticalSection GlobalFlags SetDllDirectoryA HeapValidate VerifyVersionInfoA IsDBCSLeadByte GetModuleFileNameW CreateActCtxA GetEnvironmentVariableA GetConsoleAliasesLengthW GetStartupInfoW WritePrivateProfileStringW GetPrivateProfileIntW VerifyVersionInfoW InterlockedExchange GetLastError SetLastError BackupRead GetLongPathNameA CreateNamedPipeA SearchPathA GetNumaHighestNodeNumber ProcessIdToSessionId LocalAlloc GetFileType SetCurrentDirectoryW GetVolumePathNamesForVolumeNameA GetModuleFileNameA WriteProfileStringA FindFirstChangeNotificationA GetProcessShutdownParameters FreeEnvironmentStringsW BuildCommDCBA VirtualProtect GetConsoleCursorInfo OutputDebugStringA FindFirstVolumeA TlsAlloc GetWindowsDirectoryW ReadConsoleOutputCharacterW GetSystemTime TlsFree CopyFileExA CloseHandle CreateFileW lstrlenA GetComputerNameA CompareStringW ExitProcess EncodePointer DecodePointer GetCommandLineW HeapSetInformation IsProcessorFeaturePresent GetCurrentThreadId GetProcAddress InterlockedIncrement SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount DeleteCriticalSection IsBadReadPtr HeapCreate WriteFile TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection GetACP GetOEMCP GetCPInfo IsValidCodePage RtlUnwind LoadLibraryW HeapAlloc HeapReAlloc HeapSize HeapQueryInformation HeapFree RaiseException WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW WriteConsoleW OutputDebugStringW SetFilePointer SetStdHandle FlushFileBuffers

user32

GetMenuBarInfo

advapi32

ImpersonateSelf InitiateSystemShutdownA AbortSystemShutdownW

Name

.text

Size

476KB

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

39.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.noziy

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.focuf

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_e65611987da76fda56ecca8b6009cd5c_amadey_elex_smoke-loader

kernel32

user32

advapi32

generic