2026-11-03_ba9b473de3aa38a1772601967ef38873_amadey_elex_smoke-loader

General

Target
2026-11-03_ba9b473de3aa38a1772601967ef38873_amadey_elex_smoke-loader
Size 311KB
Sample261104-ljfzzada35
SHA256 5e27c0ffeb8992390588cf15819c883c803307f072399ff500dd6a4d7885aca9
MD5 ba9b473de3aa38a1772601967ef38873
SHA1 747745af9da2bb0534db8ce86a6ddb982aca386d
SHA512 5840b6455b086333bc920a7b2911df67ba587cdc538c140baed9cb336784596849cea70c7f1dc3df52e2218a80343f4c21145193181cd272707ceaab422251a3
SSDEEP 6144:MDy1DMXWofPxr4HzFbSXuZet0yAw8IDmrgHtRJn:6uYRiHzFbSXuZet0yAw8lgHx
TLSH
T14A648E10A7A0F435F5F756F889B993A9793F7DA16B2490CB62D016EA46347E0DC3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_ba9b473de3aa38a1772601967ef38873_amadey_elex_smoke-loader

File Explorer

2026-11-03_ba9b473de3aa38a1772601967ef38873_amadey_elex_smoke-loader

.exe 311KB

2026-11-03_ba9b473de3aa38a1772601967ef38873_amadey_elex_smoke-loader

IMPHASH 705b3a479c4f9a4f00e097c6805450fd
SHA256 5e27c0ffeb8992390588cf15819c883c803307f072399ff500dd6a4d7885aca9
MD5 ba9b473de3aa38a1772601967ef38873
SHA1 747745af9da2bb0534db8ce86a6ddb982aca386d
SHA512 5840b6455b086333bc920a7b2911df67ba587cdc538c140baed9cb336784596849cea70c7f1dc3df52e2218a80343f4c21145193181cd272707ceaab422251a3
SSDEEP 6144:MDy1DMXWofPxr4HzFbSXuZet0yAw8IDmrgHtRJn:6uYRiHzFbSXuZet0yAw8lgHx
TLSH
T14A648E10A7A0F435F5F756F889B993A9793F7DA16B2490CB62D016EA46347E0DC3031B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

97248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bivini\kobeja28_jo.pdb

kernel32

ExitProcess GetFullPathNameA LocalUnlock GetThreadContext GetPrivateProfileSectionNamesW EnumResourceNamesW SetCriticalSectionSpinCount GlobalMemoryStatus FindResourceA lstrcmpA FindFirstFileW EnumCalendarInfoA WriteConsoleInputW IsBadStringPtrW EnumDateFormatsExW CopyFileExW GetStringTypeA UnmapViewOfFile MoveFileExA GetNumberOfConsoleInputEvents GetConsoleAliasExesLengthA SetUnhandledExceptionFilter LoadLibraryExW GetQueuedCompletionStatus MoveFileExW InterlockedDecrement GetCurrentProcess SetDefaultCommConfigW SetFirmwareEnvironmentVariableA GlobalLock SetVolumeMountPointW GetComputerNameW SetEvent SetThreadExecutionState OpenSemaphoreA CreateHardLinkA GetFileAttributesExA FreeEnvironmentStringsA _lclose GetModuleHandleW GetCommConfig GetProcessHeap IsBadReadPtr GetSystemTimeAsFileTime GetNumberFormatA GetPrivateProfileStringW GetConsoleTitleA GetCompressedFileSizeW ReadConsoleOutputA WaitNamedPipeW EnumTimeFormatsA SetCommState GetSystemWow64DirectoryA TzSpecificLocalTimeToSystemTime WaitForMultipleObjectsEx GetProcessTimes TlsSetValue AllocateUserPhysicalPages FindResourceExA GlobalAlloc GetConsoleMode FatalAppExitW GetThreadSelectorEntry CopyFileW GetPrivateProfileStructW GetCalendarInfoW ReadFileScatter SetSystemTimeAdjustment GetSystemWindowsDirectoryA SetConsoleCP DeleteVolumeMountPointW LeaveCriticalSection GetFileAttributesA lstrcpynW SetDllDirectoryA SetConsoleMode HeapValidate GetVolumePathNamesForVolumeNameW CreateSemaphoreA SetConsoleCursorPosition WritePrivateProfileSectionW TerminateProcess IsDBCSLeadByte GetModuleFileNameW CreateActCtxA GetBinaryTypeW lstrlenW WritePrivateProfileStringW GlobalUnlock VirtualUnlock CreateJobObjectA GetNamedPipeHandleStateW EnumSystemLocalesA GetPrivateProfileIntW VerifyVersionInfoW InterlockedExchange GetStdHandle FindFirstFileA GetLastError ChangeTimerQueueTimer SetLastError ReadConsoleOutputCharacterA GetProcAddress GetLongPathNameA HeapSize PeekConsoleInputW BackupWrite CreateNamedPipeA EnumDateFormatsExA CreateJobSet EnterCriticalSection VerLanguageNameW SearchPathA BuildCommDCBW DefineDosDeviceA GetNumaHighestNodeNumber FindClose GetPrivateProfileStringA GetAtomNameA LoadLibraryA Process32FirstW OpenMutexA ProcessIdToSessionId BuildCommDCBAndTimeoutsW GetExitCodeThread SetCurrentDirectoryW SetFileApisToANSI QueryDosDeviceW PostQueuedCompletionStatus HeapWalk GetPrivateProfileStructA SetNamedPipeHandleState SetEnvironmentVariableA GetModuleFileNameA GetDefaultCommConfigA WriteProfileStringA EnumDateFormatsA WaitCommEvent SetConsoleTitleW FindFirstChangeNotificationA GetProcessShutdownParameters QueueUserWorkItem ContinueDebugEvent lstrcatW HeapSetInformation IsDebuggerPresent FreeEnvironmentStringsW FindNextFileW WriteProfileStringW VirtualProtect CompareStringA GetConsoleCursorInfo WriteConsoleOutputAttribute OutputDebugStringA DuplicateHandle GetVersionExA TlsAlloc TerminateJobObject CloseHandle GetVersion FindFirstVolumeW DeleteTimerQueueTimer GlobalAddAtomW SetFileValidData GetTempPathA FindActCtxSectionStringW ResetWriteWatch UnregisterWaitEx InterlockedPushEntrySList TlsFree CopyFileExA CommConfigDialogW DeleteFileA CreateThread lstrcpyA GetCommandLineW GetStartupInfoW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId InterlockedIncrement DecodePointer GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsGetValue HeapCreate WriteFile GetACP GetOEMCP GetCPInfo IsValidCodePage LoadLibraryW UnhandledExceptionFilter HeapAlloc HeapReAlloc HeapQueryInformation HeapFree RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW WriteConsoleW OutputDebugStringW IsProcessorFeaturePresent SetFilePointer GetConsoleCP RaiseException SetStdHandle CreateFileW FlushFileBuffers

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_ba9b473de3aa38a1772601967ef38873_amadey_elex_smoke-loader

kernel32

generic