2026-11-11_6fb4038e064d03cccaba9394560572ff_amadey_elex_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_6fb4038e064d03cccaba9394560572ff_amadey_elex_smoke-loader
Size 740KB
Sample261113-macrmatt5q
SHA256 28359432ac4713369e28ff3ddc8fad9ea5aee93e8311ff7a0099f7a7d41962a6
MD5 6fb4038e064d03cccaba9394560572ff
SHA1 3223729ba4f2fa24d09fedf6ff4bc97175825527
SHA512 5a6f91a37822c56de3301154a4ed256d4a393ae3836b70c51089a02efc9985b3410076f77f400a5b3338062bb59889c716343e46e5edbd05dc43821d6f43cd22
SSDEEP 12288:T92XH0lpjTuE1oJJJJJJJa3x4N2L0RzSe2i:T96H07DoJJJJJJJUK2L3e2i
TLSH
T1A4F438217BF58836F1F31B72ADBA96156A76BD511F32C2CF2244224D1D32AD0CE3176A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_6fb4038e064d03cccaba9394560572ff_amadey_elex_smoke-loader

File Explorer

2026-11-11_6fb4038e064d03cccaba9394560572ff_amadey_elex_smoke-loader

.exe 740KB

2026-11-11_6fb4038e064d03cccaba9394560572ff_amadey_elex_smoke-loader

IMPHASH 9af8bbcb5fc2cb7ca01a0d0d6dc6229a
SHA256 28359432ac4713369e28ff3ddc8fad9ea5aee93e8311ff7a0099f7a7d41962a6
MD5 6fb4038e064d03cccaba9394560572ff
SHA1 3223729ba4f2fa24d09fedf6ff4bc97175825527
SHA512 5a6f91a37822c56de3301154a4ed256d4a393ae3836b70c51089a02efc9985b3410076f77f400a5b3338062bb59889c716343e46e5edbd05dc43821d6f43cd22
SSDEEP 12288:T92XH0lpjTuE1oJJJJJJJa3x4N2L0RzSe2i:T96H07DoJJJJJJJUK2L3e2i
TLSH
T1A4F438217BF58836F1F31B72ADBA96156A76BD511F32C2CF2244224D1D32AD0CE3176A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

dwtrig20.pdb

advapi32

RegCloseKey RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegQueryValueExA RegOpenKeyExA FreeSid CheckTokenMembership AllocateAndInitializeSid RegEnumValueW RegQueryInfoKeyW RegQueryValueExW ConvertSidToStringSidA AddAce ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorDacl OpenThreadToken OpenProcessToken GetTokenInformation CopySid IsValidSid InitializeAcl AddAccessDeniedAce AddAccessAllowedAce GetLengthSid

kernel32

EnterCriticalSection LoadLibraryA InterlockedExchange FreeLibrary GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter VirtualProtect SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCurrentThread LocalAlloc LocalFree GetModuleFileNameA GetShortPathNameA OpenMutexA CreateMutexA GetCurrentProcess GetModuleHandleA GetProcAddress MultiByteToWideChar Sleep GlobalAlloc GlobalFree CreateProcessW CloseHandle GetShortPathNameW GetLongPathNameW lstrcmpiW GetSystemWindowsDirectoryW GetLastError GetFileAttributesW WaitForSingleObject GetModuleFileNameW CreateEventW lstrlenW InterlockedDecrement SetEvent InterlockedIncrement RaiseException LeaveCriticalSection SetLastError VirtualFree VirtualAlloc InitializeCriticalSectionAndSpinCount TlsAlloc GetSystemDefaultLCID TlsFree DeleteCriticalSection TlsSetValue TlsGetValue

msvcrt

_wtol _except_handler3 memmove _c_exit _XcptFilter _cexit exit __p___winitenv _amsg_exit __wgetmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type __dllonexit _onexit _controlfp _exit

ole32

StringFromCLSID CoUninitialize CoInitializeEx CoRegisterClassObject StringFromIID CoCreateInstance CoRevokeClassObject CoTaskMemFree

oleaut32

SysAllocString SysFreeString LoadRegTypeLi LoadTypeLi

shell32

SHGetSpecialFolderPathW

user32

SystemParametersInfoW

generic

count=1, id=28, version=9178,

count=4, id=95, version=2067,

count=4, id=25, version=9210,

count=2, id=37, version=8755,

count=2, id=93, version=2035,

count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,

count=1, id=14, version=7299,

count=7, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=4, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=4, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=95, version=5060,

count=7, id=93, version=2067,

count=160, id=1, productName=Unmarked objects,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=15, id=96, version=5060,

count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,