2026-11-02_f8c867413f62b714033d275e0dde6983_amadey_elex_smoke-loader

General

Target
2026-11-02_f8c867413f62b714033d275e0dde6983_amadey_elex_smoke-loader
Size 12.2MB
Sample261102-wcczvaby31
SHA256 06d82a32600149c9cc6adef2cc375671dff57f527e3a0b2d23661d636cae8b9c
MD5 f8c867413f62b714033d275e0dde6983
SHA1 e04f6b9864b6dec20ba20f870a013da56adb0895
SHA512 7ca61af5f301f3817a0ceb999e3f753a3b68e2ae909ac5eacce90ec2b4a412e6189e2d0cbf00179b661c7eb5026ca71946990e39959f90a40ffb22ff59da2222
SSDEEP 12288:8RPXkiYgBj6dYDSSXuZet0yS81Kex66v:CPkiJKT
TLSH
T109D68D1594720433F1791AFCEB1E7F5854FEE6B6A34DE82B72C014E64C179A828FA217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_f8c867413f62b714033d275e0dde6983_amadey_elex_smoke-loader

File Explorer

2026-11-02_f8c867413f62b714033d275e0dde6983_amadey_elex_smoke-loader

.exe 12.2MB

2026-11-02_f8c867413f62b714033d275e0dde6983_amadey_elex_smoke-loader

IMPHASH ac14a22dc3791ebf7f4a67e197a18bc7
SHA256 06d82a32600149c9cc6adef2cc375671dff57f527e3a0b2d23661d636cae8b9c
MD5 f8c867413f62b714033d275e0dde6983
SHA1 e04f6b9864b6dec20ba20f870a013da56adb0895
SHA512 7ca61af5f301f3817a0ceb999e3f753a3b68e2ae909ac5eacce90ec2b4a412e6189e2d0cbf00179b661c7eb5026ca71946990e39959f90a40ffb22ff59da2222
SSDEEP 12288:8RPXkiYgBj6dYDSSXuZet0yS81Kex66v:CPkiJKT
TLSH
T109D68D1594720433F1791AFCEB1E7F5854FEE6B6A34DE82B72C014E64C179A828FA217
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

98368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\fejateragar.pdb

kernel32

LocalUnlock GetThreadContext GetPrivateProfileSectionNamesW SetCriticalSectionSpinCount GlobalMemoryStatus FindResourceA lstrcmpA FindFirstFileW EnumCalendarInfoA WriteConsoleInputW IsBadStringPtrW EnumDateFormatsExW CopyFileExW GetNumaProcessorNode GetStringTypeA SetLocalTime UnmapViewOfFile MoveFileExA GetNumberOfConsoleInputEvents GetConsoleAliasExesLengthA BuildCommDCBAndTimeoutsA SetUnhandledExceptionFilter SetDllDirectoryW GetQueuedCompletionStatus VerSetConditionMask MoveFileExW ReadConsoleA InterlockedDecrement GetCurrentProcess SetMailslotInfo SetDefaultCommConfigW GlobalLock AddConsoleAliasW GetComputerNameW SetEvent OpenSemaphoreA CreateHardLinkA LockFile GetFileAttributesExA _lclose GetModuleHandleW GetTickCount GetCommConfig GetProcessHeap IsBadReadPtr GetSystemTimeAsFileTime GetNumberFormatA GetPrivateProfileStringW GetConsoleTitleA GetCompressedFileSizeW WaitNamedPipeW EnumTimeFormatsA SetCommState GetSystemWow64DirectoryA TzSpecificLocalTimeToSystemTime WaitForMultipleObjectsEx GetProcessTimes TlsSetValue GetVolumePathNameW AllocateUserPhysicalPages FindResourceExA GlobalAlloc GetPrivateProfileIntA FatalAppExitW GetThreadSelectorEntry GetPrivateProfileStructW GetCalendarInfoW ReadFileScatter SetSystemTimeAdjustment SetVolumeMountPointA GetSystemWindowsDirectoryA ReadConsoleOutputW SetConsoleCP DeleteVolumeMountPointW GetFileAttributesA lstrcpynW SetConsoleMode HeapValidate GetVolumePathNamesForVolumeNameW CreateSemaphoreA SetConsoleCursorPosition VerifyVersionInfoA WritePrivateProfileSectionW TerminateProcess IsDBCSLeadByte GetModuleFileNameW CreateActCtxA lstrcatA QueryInformationJobObject GetBinaryTypeW lstrlenW SetConsoleTitleA WritePrivateProfileStringW GetFullPathNameA VirtualUnlock CreateJobObjectA GetNamedPipeHandleStateW GetLargestConsoleWindowSize GetPrivateProfileIntW VerifyVersionInfoW InterlockedExchange ReleaseActCtx SetCurrentDirectoryA GetStdHandle FindFirstFileA FreeLibraryAndExitThread GetLastError ChangeTimerQueueTimer ReadConsoleOutputCharacterA GetProcAddress GetLongPathNameA HeapSize BackupWrite SetFirmwareEnvironmentVariableW CreateNamedPipeA CreateJobSet EnterCriticalSection VerLanguageNameW SearchPathA BuildCommDCBW DefineDosDeviceA FindClose GetPrivateProfileStringA GetAtomNameA LoadLibraryA Process32FirstW OpenMutexA ProcessIdToSessionId MoveFileA GetExitCodeThread SetCurrentDirectoryW SetFileApisToANSI QueryDosDeviceW PostQueuedCompletionStatus HeapWalk GetPrivateProfileStructA GetTapeParameters SetNamedPipeHandleState SetEnvironmentVariableA GetDefaultCommConfigA WriteProfileStringA EnumDateFormatsA WaitCommEvent FindFirstChangeNotificationA GetProcessShutdownParameters LoadLibraryExA QueueUserWorkItem ContinueDebugEvent HeapSetInformation IsDebuggerPresent FreeEnvironmentStringsW EnumResourceNamesA FindNextFileW WriteProfileStringW VirtualProtect EnumDateFormatsW CompareStringA FatalAppExitA PeekConsoleInputA WriteConsoleOutputAttribute OutputDebugStringA DuplicateHandle GetVersionExA TlsAlloc TerminateJobObject CloseHandle GetVersion FindFirstVolumeW DeleteTimerQueueTimer GlobalAddAtomW SetFileValidData GetTempPathA FindActCtxSectionStringW ResetWriteWatch UnregisterWaitEx InterlockedPushEntrySList TlsFree GetProfileSectionW EnumSystemLocalesW CopyFileExA CommConfigDialogW DeleteFileA CreateThread lstrcpyA CreateFileW SetStdHandle RaiseException GlobalUnlock ExitProcess GetCommandLineW GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId InterlockedIncrement DecodePointer GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsGetValue SetLastError HeapCreate WriteFile GetACP GetOEMCP GetCPInfo IsValidCodePage LeaveCriticalSection LoadLibraryW UnhandledExceptionFilter HeapAlloc GetModuleFileNameA HeapReAlloc HeapQueryInformation HeapFree RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW WriteConsoleW OutputDebugStringW IsProcessorFeaturePresent SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers

user32

GetMessageTime GetMenuItemID

gdi32

GetBitmapBits

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_f8c867413f62b714033d275e0dde6983_amadey_elex_smoke-loader

kernel32

user32

gdi32

generic