2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt
Size 1.5MB
Sample260910-jk2lysga98
SHA256 d8b42d043d7ba47308c9d46e2a10a8ec28d24011bb7de25a2eb318cf24ba91ab
MD5 08b0a654459d2f8b33b1b0ccc2380f5a
SHA1 0743a84cf9336a513eb5e39660a922e7b4529f65
SHA512 0c0c3cbb0be851cfada2e9f612897a928e481b9776cf1f4eca29fa775722d9e79a42e05ec4cb36aab28baa0364d4d41ca581557c72d37c2fbc1bfddeca575ccb
SSDEEP 12288:BtfuNoxiHt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vWNoxiNyxknw4FYnshx8OfVe247
TLSH
T1CC65122436C2C471E57616331971BB71866DFD348F708A9FA398262E9E704D0BA3AD37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt

File Explorer

2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt

.exe 1.5MB

2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt

IMPHASH aa8ea29663992ee925ff209490a662d8
SHA256 d8b42d043d7ba47308c9d46e2a10a8ec28d24011bb7de25a2eb318cf24ba91ab
MD5 08b0a654459d2f8b33b1b0ccc2380f5a
SHA1 0743a84cf9336a513eb5e39660a922e7b4529f65
SHA512 0c0c3cbb0be851cfada2e9f612897a928e481b9776cf1f4eca29fa775722d9e79a42e05ec4cb36aab28baa0364d4d41ca581557c72d37c2fbc1bfddeca575ccb
SSDEEP 12288:BtfuNoxiHt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vWNoxiNyxknw4FYnshx8OfVe247
TLSH
T1CC65122436C2C471E57616331971BB71866DFD348F708A9FA398262E9E704D0BA3AD37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\atkexComSvc\Release\AxIns.pdb

kernel32

FindFirstFileA FindNextFileW FindNextFileA WriteConsoleW GetProcessHeap HeapAlloc GetLastError HeapFree GetTickCount CreateProcessA GetProcAddress CloseHandle OutputDebugStringW CopyFileA Sleep WaitForSingleObject GetCurrentProcess GetPrivateProfileStringA WritePrivateProfileStringA FindClose GetModuleFileNameA HeapReAlloc HeapSize SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers CreateFileW GetStringTypeW SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW LCMapStringW MultiByteToWideChar GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW DecodePointer

user32

MessageBoxW

advapi32

RegCloseKey RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExA RegSetValueExA RegQueryInfoKeyA RegOpenKeyExA CloseServiceHandle OpenSCManagerW OpenSCManagerA ControlService StartServiceW QueryServiceStatusEx OpenServiceA

shell32

SHGetFolderPathAndSubDirA

ole32

CoCreateInstance CoInitialize CLSIDFromProgID

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_08b0a654459d2f8b33b1b0ccc2380f5a_amadey_elex_hellokitty_manuscrypt

kernel32

user32

advapi32

shell32

ole32

generic