2026-11-09_9b09aeb455e672e682d09271bc77a956_amadey_elex_smoke-loader

General

Target
2026-11-09_9b09aeb455e672e682d09271bc77a956_amadey_elex_smoke-loader
Size 299KB
Sample261109-29dwasst7m
SHA256 01b14ff942cee545031b1c0d7a166ccde2c18e0085f209f0c5ad893b4425f335
MD5 9b09aeb455e672e682d09271bc77a956
SHA1 b546479c5b159971e7bb7460742443f7158cec7c
SHA512 03b0e9e8f41a657cf8a0e154c0721dfc632e2a8ccb1a76d10070895d6d639ebac9c17b7272625bb90766e1abc8e8c26484a7bd37ebf3a65c4beb17dcf6a61261
SSDEEP 6144:rNy6CYUg2Reux2oJfvHT+eGOz90cByDHZ32p0M:rE6I7wWrvT+etz9n4HZs
TLSH
T148549D04ABA0D434F5B712F849BA93BDB53F7AB16B2490CB12D226EA1B356D0DD30357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_9b09aeb455e672e682d09271bc77a956_amadey_elex_smoke-loader

File Explorer

2026-11-09_9b09aeb455e672e682d09271bc77a956_amadey_elex_smoke-loader

.exe 299KB

2026-11-09_9b09aeb455e672e682d09271bc77a956_amadey_elex_smoke-loader

IMPHASH c50981c3cb3d1a5776b7d51392f3f197
SHA256 01b14ff942cee545031b1c0d7a166ccde2c18e0085f209f0c5ad893b4425f335
MD5 9b09aeb455e672e682d09271bc77a956
SHA1 b546479c5b159971e7bb7460742443f7158cec7c
SHA512 03b0e9e8f41a657cf8a0e154c0721dfc632e2a8ccb1a76d10070895d6d639ebac9c17b7272625bb90766e1abc8e8c26484a7bd37ebf3a65c4beb17dcf6a61261
SSDEEP 6144:rNy6CYUg2Reux2oJfvHT+eGOz90cByDHZ32p0M:rE6I7wWrvT+etz9n4HZs
TLSH
T148549D04ABA0D434F5B712F849BA93BDB53F7AB16B2490CB12D226EA1B356D0DD30357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

104720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\pupuvih\cezub53\wofuciti\deximukad18\zucixi xirixiwesen.pdb

kernel32

OpenFileMappingA GetNumaProcessorNode FindFirstVolumeW ExitProcess GetExitCodeProcess ProcessIdToSessionId GetVersionExW VerifyVersionInfoA GetPrivateProfileStringW GetConsoleCP TlsGetValue GetConsoleMode CopyFileExW VerLanguageNameW FindFirstChangeNotificationA FreeEnvironmentStringsW RequestWakeupLatency SetVolumeMountPointW SetCurrentDirectoryW GetLongPathNameW SetConsoleCursorInfo GlobalHandle SystemTimeToTzSpecificLocalTime SetProcessShutdownParameters CompareStringW LocalLock GetNamedPipeHandleStateW BuildCommDCBAndTimeoutsW GetProcAddress GetModuleHandleA LocalAlloc Sleep MoveFileExA GetCommandLineW InterlockedDecrement InterlockedExchange DeleteFileW GetVolumePathNamesForVolumeNameA GetPrivateProfileIntW HeapValidate GetProcessHeaps CreateNamedPipeW GetCPInfoExA GetSystemWindowsDirectoryA GetSystemWow64DirectoryA GetPrivateProfileStringA GetCalendarInfoA GetLastError GetStringTypeA FatalAppExitA GetThreadSelectorEntry WaitForDebugEvent FindFirstFileA ReadFileScatter GetTempPathW GetDefaultCommConfigA UnmapViewOfFile GlobalWire WritePrivateProfileSectionW TerminateThread lstrcatW VirtualLock CreateActCtxW InterlockedPopEntrySList OutputDebugStringW SetConsoleTitleA DefineDosDeviceW LoadLibraryA WritePrivateProfileStringW WaitNamedPipeA InterlockedIncrement TerminateProcess SetConsoleMode PeekConsoleInputW ReadConsoleOutputW GetNumberFormatW DuplicateHandle GetPrivateProfileSectionNamesA EnumTimeFormatsA SetLocalTime FindNextFileA FindFirstFileW CreateSemaphoreA OutputDebugStringA lstrcpyA HeapSetInformation CreateHardLinkA SetThreadExecutionState GetSystemTime LockFile EnumCalendarInfoExA GetVolumePathNamesForVolumeNameW SetConsoleScreenBufferSize SearchPathA GetOverlappedResult IsBadStringPtrA GetAtomNameW GetConsoleAliasExesLengthW WriteConsoleInputA LocalUnlock SetCommConfig _lopen EnumSystemLocalesA GetCommState SetEndOfFile GetWriteWatch UnhandledExceptionFilter OpenSemaphoreA GetConsoleScreenBufferInfo ZombifyActCtx EnumDateFormatsW GetSystemTimeAdjustment OpenMutexA GetComputerNameA HeapCompact CommConfigDialogW GetModuleFileNameA OpenMutexW GetBinaryTypeW AllocateUserPhysicalPages FindResourceA AreFileApisANSI DeleteTimerQueueTimer EnumResourceNamesW CreateTimerQueueTimer GetProcessTimes UnregisterWait IsBadWritePtr GetCurrentProcessId FatalAppExitW GetFileAttributesA lstrcpynW SetNamedPipeHandleState WriteConsoleOutputAttribute GetCompressedFileSizeA GetFullPathNameW WriteProfileStringW AddVectoredExceptionHandler GlobalAddAtomA EnumDateFormatsExW TerminateJobObject QueryDosDeviceA LeaveCriticalSection SetCurrentDirectoryA SetFileShortNameA GetBinaryTypeA ReadFileEx lstrlenW EncodePointer DecodePointer MoveFileA DeleteFileA GetStartupInfoW IsBadReadPtr GetModuleHandleW IsProcessorFeaturePresent SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount GetCurrentThreadId GetSystemTimeAsFileTime GetModuleFileNameW GetEnvironmentStringsW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsSetValue TlsFree SetLastError HeapCreate WriteFile EnterCriticalSection HeapAlloc HeapReAlloc HeapSize HeapQueryInformation GetCurrentProcess IsDebuggerPresent HeapFree GetACP GetOEMCP GetCPInfo IsValidCodePage LoadLibraryW RtlUnwind WriteConsoleW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW SetFilePointer RaiseException SetStdHandle CreateFileW CloseHandle FlushFileBuffers

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_9b09aeb455e672e682d09271bc77a956_amadey_elex_smoke-loader

kernel32

generic