2026-08-08_3b3f3262e939f27c5d5054c6b2769726_amadey_elex_hellokitty

General

Target
2026-08-08_3b3f3262e939f27c5d5054c6b2769726_amadey_elex_hellokitty
Size 3.0MB
Sample260808-ecbckszbqg
SHA256 a8670a7c28c4a0b53c3ba9f43b7248ae9dafa9d81f9eefb84077844721960e81
MD5 3b3f3262e939f27c5d5054c6b2769726
SHA1 a5f04e0243a120d37ce6507505d2f8a32e87d62e
SHA512 7a4a6513f2ebc619940eda6af31796278aa2535fdc10e855241cfd7ffb1b4fcd530e469ebe6bbc453441badea1ffbc7b2d894fa50234ece3b3fafd584f72f69a
SSDEEP 49152:JMTUhAwhAJxijF2nY7VwH7jcOg82SaYEwk1LGuwcTztKoNv:GBwhA+jF2nR8Ogj0oLkYZJ
TLSH
T12CE50102BAD08A67D4760BB294708781D734AF2BAB41E6CB74AC765D9F3BBD10C50B35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with Enigma 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Enigma

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_3b3f3262e939f27c5d5054c6b2769726_amadey_elex_hellokitty

File Explorer

2026-08-08_3b3f3262e939f27c5d5054c6b2769726_amadey_elex_hellokitty

.exe 3.0MB

2026-08-08_3b3f3262e939f27c5d5054c6b2769726_amadey_elex_hellokitty

SHA256 a8670a7c28c4a0b53c3ba9f43b7248ae9dafa9d81f9eefb84077844721960e81
MD5 3b3f3262e939f27c5d5054c6b2769726
SHA1 a5f04e0243a120d37ce6507505d2f8a32e87d62e
SHA512 7a4a6513f2ebc619940eda6af31796278aa2535fdc10e855241cfd7ffb1b4fcd530e469ebe6bbc453441badea1ffbc7b2d894fa50234ece3b3fafd584f72f69a
SSDEEP 49152:JMTUhAwhAJxijF2nY7VwH7jcOg82SaYEwk1LGuwcTztKoNv:GBwhA+jF2nR8Ogj0oLkYZJ
TLSH
T12CE50102BAD08A67D4760BB294708781D734AF2BAB41E6CB74AC765D9F3BBD10C50B35
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with Enigma
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

66368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb

Name

.text

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

233KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.enigma1

Size

30.0MB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.enigma2

Size

308KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_3b3f3262e939f27c5d5054c6b2769726_amadey_elex_hellokitty

generic