2026-07-20_065324559341109fc54d9d295308a659_amadey_elex_hellokitty_manuscrypt

General

Target
2026-07-20_065324559341109fc54d9d295308a659_amadey_elex_hellokitty_manuscrypt
Size 1.2MB
Sample260720-wt3ltscv81
SHA256 c048281ce41033aa281c981997b4bf3dba511eca8ea0f759dd96899b18dead68
MD5 065324559341109fc54d9d295308a659
SHA1 84493cd8e36e582edebeebb24820f10bf0f282fd
SHA512 40237d4df15e07f1f4f46e9da01244078ba78149cbbff47de035f3a56a76985f93d8c7fefaf1b093cd34e7e64ef9e1d7feb2b7236d8533ce84c663b7028284e8
SSDEEP 12288:XIUUYryEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:ZUYWERIk1k7c+vDqGJAAg
TLSH
T14C45120079DA9471D173597485E8EAE65E2DFD382F41AEB72748273E0F300D0C86A9BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_065324559341109fc54d9d295308a659_amadey_elex_hellokitty_manuscrypt

File Explorer

2026-07-20_065324559341109fc54d9d295308a659_amadey_elex_hellokitty_manuscrypt

.exe 1.2MB

2026-07-20_065324559341109fc54d9d295308a659_amadey_elex_hellokitty_manuscrypt

IMPHASH 1fc8a005796db320016cd81cbfd76f53
SHA256 c048281ce41033aa281c981997b4bf3dba511eca8ea0f759dd96899b18dead68
MD5 065324559341109fc54d9d295308a659
SHA1 84493cd8e36e582edebeebb24820f10bf0f282fd
SHA512 40237d4df15e07f1f4f46e9da01244078ba78149cbbff47de035f3a56a76985f93d8c7fefaf1b093cd34e7e64ef9e1d7feb2b7236d8533ce84c663b7028284e8
SSDEEP 12288:XIUUYryEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLI3RgCd1yx:ZUYWERIk1k7c+vDqGJAAg
TLSH
T14C45120079DA9471D173597485E8EAE65E2DFD382F41AEB72748273E0F300D0C86A9BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9569

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\AsusFanControlService\Release\FanSetup.pdb

kernel32

GetModuleFileNameW WaitForSingleObject Sleep CloseHandle SetCurrentDirectoryW CreateProcessW GetExitCodeProcess WriteConsoleW CreateFileW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx DecodePointer

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_065324559341109fc54d9d295308a659_amadey_elex_hellokitty_manuscrypt

kernel32

shlwapi

generic