2026-05-22_291aa630e2d03ad4a875fccf8797bb73_amadey_elex_hellokitty_manuscrypt

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-22_291aa630e2d03ad4a875fccf8797bb73_amadey_elex_hellokitty_manuscrypt
Size 9.8MB
Sample260522-nygadscw21
SHA256 104061da6036d0c65ee52fb33b5eff91a03b13a066592921b7f291618d492a09
MD5 291aa630e2d03ad4a875fccf8797bb73
SHA1 9228cc30848ee4766061304a6eb196963804ca88
SHA512 ee1117563964a7eb034603e66d379760bf2a52d2d1d7cc4b54567251722e2f71e25f9f9cd6432f131212882dc22d4ac612c4fe84cdda9e05d83f1d5c62bded0f
SSDEEP 3072:avzR22s+hQY1lx2s4OYlbS+4PhQgRblKxVhgr6v3:26+t1Ot/cCBgY
TLSH
T1ECA65DD85B802D67C9F12FBD5D3F0BF9C3CB68D606F48105825583CC7A5A1BB226CA96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_291aa630e2d03ad4a875fccf8797bb73_amadey_elex_hellokitty_manuscrypt

File Explorer

2026-05-22_291aa630e2d03ad4a875fccf8797bb73_amadey_elex_hellokitty_manuscrypt

.exe 9.8MB

2026-05-22_291aa630e2d03ad4a875fccf8797bb73_amadey_elex_hellokitty_manuscrypt

IMPHASH c06bd965f8be5b8807b8d78517fbab8d
SHA256 104061da6036d0c65ee52fb33b5eff91a03b13a066592921b7f291618d492a09
MD5 291aa630e2d03ad4a875fccf8797bb73
SHA1 9228cc30848ee4766061304a6eb196963804ca88
SHA512 ee1117563964a7eb034603e66d379760bf2a52d2d1d7cc4b54567251722e2f71e25f9f9cd6432f131212882dc22d4ac612c4fe84cdda9e05d83f1d5c62bded0f
SSDEEP 3072:avzR22s+hQY1lx2s4OYlbS+4PhQgRblKxVhgr6v3:26+t1Ot/cCBgY
TLSH
T1ECA65DD85B802D67C9F12FBD5D3F0BF9C3CB68D606F48105825583CC7A5A1BB226CA96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11077

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

QueryPerformanceCounter Sleep GetProcessTimes GetCurrentProcess GetCurrentProcessId ExitProcess GetSystemInfo GetTickCount GetSystemDirectoryW VirtualAllocEx VirtualProtectEx VirtualFreeEx FreeLibrary GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress LoadResource LockResource CloseHandle LoadLibraryW GlobalAlloc GlobalFree GlobalMemoryStatus SwitchToFiber DeleteFiber CreateFiber ConvertThreadToFiber FindResourceA CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW GetTempPathW GetFileTime CreateFileW CreateDirectoryW GetEnvironmentVariableW SetFilePointerEx GetConsoleMode GetConsoleOutputCP SizeofResource GetEnvironmentVariableA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers DecodePointer

user32

wsprintfW

advapi32

RegCloseKey RegOpenKeyExW RegEnumValueW GetUserNameW

ntdll

NtCreateFile

rpcrt4

UuidFromStringW

iphlpapi

GetAdaptersAddresses

Name

.text

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9.7MB

Virtual Size

9.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_291aa630e2d03ad4a875fccf8797bb73_amadey_elex_hellokitty_manuscrypt

kernel32

user32

advapi32

ntdll

rpcrt4

iphlpapi

generic