2026-11-02_5544fe73e02d0281f79c51a9bf9190a5_amadey_elex_smoke-loader

General

Target
2026-11-02_5544fe73e02d0281f79c51a9bf9190a5_amadey_elex_smoke-loader
Size 13.9MB
Sample261103-lnmnbabs4k
SHA256 020399b0c0807440c1bd0d8278635f9d608e93d23054f387c5b79ae938ab1dbb
MD5 5544fe73e02d0281f79c51a9bf9190a5
SHA1 d9dbb68e9eb7666ae541c5cfdc44894210b50e48
SHA512 07d9489f75c7dcddac8328fdab1ae49a44bb6764b2be92d9050e74aef1a3e71b53832f0a4f33b651e45dbc927246a076c135987061c90810a14e57490842b055
SSDEEP 6144:KHqwnbbymwxbMBaw5PH8tNLpO7yXlLVD86g:cqwnbbHwvwf8tNLphXl5D
TLSH
T163E68C300568B4A0C06551FE3B2E7786E7ECD8B1C71E9ABFA18964D0DC22BB742D475B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_5544fe73e02d0281f79c51a9bf9190a5_amadey_elex_smoke-loader

File Explorer

2026-11-02_5544fe73e02d0281f79c51a9bf9190a5_amadey_elex_smoke-loader

.exe 13.9MB

2026-11-02_5544fe73e02d0281f79c51a9bf9190a5_amadey_elex_smoke-loader

IMPHASH 5bf1109d17f31fdf1287dd3cc8a8bd45
SHA256 020399b0c0807440c1bd0d8278635f9d608e93d23054f387c5b79ae938ab1dbb
MD5 5544fe73e02d0281f79c51a9bf9190a5
SHA1 d9dbb68e9eb7666ae541c5cfdc44894210b50e48
SHA512 07d9489f75c7dcddac8328fdab1ae49a44bb6764b2be92d9050e74aef1a3e71b53832f0a4f33b651e45dbc927246a076c135987061c90810a14e57490842b055
SSDEEP 6144:KHqwnbbymwxbMBaw5PH8tNLpO7yXlLVD86g:cqwnbbHwvwf8tNLphXl5D
TLSH
T163E68C300568B4A0C06551FE3B2E7786E7ECD8B1C71E9ABFA18964D0DC22BB742D475B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

100928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\pebu2\yowey.pdb

kernel32

_lwrite InterlockedDecrement SetFirmwareEnvironmentVariableA GetNamedPipeHandleStateA SetHandleInformation SetConsoleScreenBufferSize CancelWaitableTimer SetVolumeMountPointW FindFirstFileExW FreeEnvironmentStringsA GetModuleHandleW GetConsoleAliasesLengthA GetSystemTimeAsFileTime GetPrivateProfileStringW ReadConsoleW GetSystemWow64DirectoryA QueryActCtxW CreateActCtxW GetSystemTimes ActivateActCtx GlobalAlloc GlobalFindAtomA LoadLibraryW ReadConsoleInputA SizeofResource GetSystemWindowsDirectoryA SetConsoleMode HeapValidate GetVolumePathNamesForVolumeNameW GetModuleFileNameW GetSystemDirectoryA SetDllDirectoryW GetStartupInfoW VerifyVersionInfoW GetLastError IsDBCSLeadByteEx SetLastError GetProcAddress CreateNamedPipeA IsValidCodePage CopyFileA GlobalGetAtomNameA SearchPathA GetPrivateProfileStringA OpenWaitableTimerA WritePrivateProfileStringA WTSGetActiveConsoleSessionId SetConsoleCursorInfo GetProcessShutdownParameters BuildCommDCBA GetCurrentDirectoryA GetFileTime GetVersionExA GetWindowsDirectoryW FileTimeToLocalFileTime TlsFree GetProfileSectionW CommConfigDialogW LocalFileTimeToFileTime CompareStringW TlsGetValue DeleteFileA GetCommandLineA HeapSetInformation EnterCriticalSection LeaveCriticalSection DecodePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer IsProcessorFeaturePresent SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId InterlockedIncrement ExitProcess GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW IsBadReadPtr TlsAlloc TlsSetValue HeapCreate WriteFile GetACP GetOEMCP GetCPInfo OutputDebugStringA WriteConsoleW OutputDebugStringW RtlUnwind RaiseException SetFilePointer GetConsoleCP GetConsoleMode HeapAlloc HeapReAlloc HeapSize HeapQueryInformation HeapFree FlushFileBuffers GetStringTypeW LCMapStringW MultiByteToWideChar SetStdHandle CloseHandle CreateFileW

user32

GetMessageTime

gdi32

GetBitmapBits

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_5544fe73e02d0281f79c51a9bf9190a5_amadey_elex_smoke-loader

kernel32

user32

gdi32

generic