2026-05-06_82b7d5953addb51da9b3304378545637_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-06_82b7d5953addb51da9b3304378545637_mespinoza
Size 1.4MB
Sample260506-3tvdsaf17r
SHA256 3c4571660b0edd9d21f755e52b5210934d37bb4c4819a245c3eade63591147c9
MD5 82b7d5953addb51da9b3304378545637
SHA1 5e7e861ddcc6b77f7b84605ea6c87fe407d867e5
SHA512 5aa57dc963207b60a1ad5e17b32ca53a5132809e002233d7a6effc49b15030e5d660bd4c63b44dfcb1635af2be1b2281dfefe68978c03df3416eace801f2db04
SSDEEP 24576:yMLXsp/ANHE3hsqjnhMgeiCl7G0nehbGZpbD:o/ANEFDmg27RnWGj
TLSH
T18A65F017F34914FAE49ED1B88B93D232E97178410720B5DF27911A213FABAE86B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-06_82b7d5953addb51da9b3304378545637_mespinoza

File Explorer

2026-05-06_82b7d5953addb51da9b3304378545637_mespinoza

.exe 1.4MB

2026-05-06_82b7d5953addb51da9b3304378545637_mespinoza

IMPHASH 8d1e145b6bc9468a894b370ff51be368
SHA256 3c4571660b0edd9d21f755e52b5210934d37bb4c4819a245c3eade63591147c9
MD5 82b7d5953addb51da9b3304378545637
SHA1 5e7e861ddcc6b77f7b84605ea6c87fe407d867e5
SHA512 5aa57dc963207b60a1ad5e17b32ca53a5132809e002233d7a6effc49b15030e5d660bd4c63b44dfcb1635af2be1b2281dfefe68978c03df3416eace801f2db04
SSDEEP 24576:yMLXsp/ANHE3hsqjnhMgeiCl7G0nehbGZpbD:o/ANEFDmg27RnWGj
TLSH
T18A65F017F34914FAE49ED1B88B93D232E97178410720B5DF27911A213FABAE86B3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

plugin-container.pdb

mozglue

??2@YAPEAX_K@Z ??3@YAXPEAX@Z ??3@YAXPEAX_K@Z ??_U@YAPEAX_K@Z ??_V@YAXPEAX@Z ?DllBlocklist_Initialize@@YAXI@Z ?IsWin32kLockedDown@mozilla@@YA_NXZ ?RegisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?SetGeckoProcessType@mozilla@@YAXPEBD@Z ?UnregisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?sChildProcessType@startup@mozilla@@3W4GeckoProcessType@@A _wcsdup free malloc moz_xmalloc mozalloc_abort realloc

usp10

ScriptBreak ScriptItemize

advapi32

AccessCheck ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid DuplicateToken DuplicateTokenEx EqualSid FreeSid GetAce GetKernelObjectSecurity GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorSacl GetSecurityInfo GetSidSubAuthority GetTokenInformation ImpersonateLoggedOnUser InitializeSid IsValidSid LookupPrivilegeValueW MapGenericMask OpenProcessToken RegCloseKey RegCreateKeyExW RegDisablePredefinedCache RegOpenKeyExW RevertToSelf SetEntriesInAclW SetKernelObjectSecurity SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036

ntdll

NtQueryVirtualMemory RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlNtStatusToDosError RtlSetLastWin32Error RtlVirtualUnwind VerSetConditionMask

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1ios_base@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateThread DebugBreak DeleteCriticalSection DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx ExpandEnvironmentStringsW FlushInstructionCache FreeEnvironmentStringsW FreeLibrary GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileType GetLastError GetLongPathNameW GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHandleCount GetProcessHeaps GetProcessId GetProductInfo GetQueuedCompletionStatus GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetTickCount GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsWow64Process LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile OpenProcess PostQueuedCompletionStatus ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ResetEvent SearchPathW SetDllDirectoryW SetEnvironmentVariableW SetEvent SetHandleInformation SetInformationJobObject SetLastError SetThreadAffinityMask SetUnhandledExceptionFilter SignalObjectAndWait Sleep TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile UnregisterWait UnregisterWaitEx UpdateProcThreadAttribute VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteProcessMemory lstrlenW

vcruntime140

__C_specific_handler __CxxFrameHandler3 __std_terminate _purecall memcmp memcpy memmove memset

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsnwprintf_s __stdio_common_vswprintf _set_fmode

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _crt_atexit _errno _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-string-l1-1-0

_wcsnicmp strlen wcscmp wcslen wcsncmp wcsncpy

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

GetHandleVerifier IsSandboxedProcess TargetConfigureOPMProtectedOutput TargetConfigureOPMProtectedOutput64 TargetCreateNamedPipeW TargetCreateNamedPipeW64 TargetCreateOPMProtectedOutputs TargetCreateOPMProtectedOutputs64 TargetCreateProcessA TargetCreateProcessA64 TargetCreateProcessW TargetCreateProcessW64 TargetCreateThread TargetCreateThread64 TargetDestroyOPMProtectedOutput TargetDestroyOPMProtectedOutput64 TargetEnumDisplayDevicesA TargetEnumDisplayDevicesA64 TargetEnumDisplayMonitors TargetEnumDisplayMonitors64 TargetGdiDllInitialize TargetGdiDllInitialize64 TargetGetCertificate TargetGetCertificate64 TargetGetCertificateByHandle TargetGetCertificateByHandle64 TargetGetCertificateSize TargetGetCertificateSize64 TargetGetCertificateSizeByHandle TargetGetCertificateSizeByHandle64 TargetGetMonitorInfoA TargetGetMonitorInfoA64 TargetGetMonitorInfoW TargetGetMonitorInfoW64 TargetGetOPMInformation TargetGetOPMInformation64 TargetGetOPMRandomNumber TargetGetOPMRandomNumber64 TargetGetStockObject TargetGetStockObject64 TargetGetSuggestedOPMProtectedOutputArraySize TargetGetSuggestedOPMProtectedOutputArraySize64 TargetNtCreateEvent TargetNtCreateEvent64 TargetNtCreateFile TargetNtCreateFile64 TargetNtCreateKey TargetNtCreateKey64 TargetNtCreateSection TargetNtCreateSection64 TargetNtMapViewOfSection TargetNtMapViewOfSection64 TargetNtOpenEvent TargetNtOpenEvent64 TargetNtOpenFile TargetNtOpenFile64 TargetNtOpenKey TargetNtOpenKey64 TargetNtOpenKeyEx TargetNtOpenKeyEx64 TargetNtOpenProcess TargetNtOpenProcess64 TargetNtOpenProcessToken TargetNtOpenProcessToken64 TargetNtOpenProcessTokenEx TargetNtOpenProcessTokenEx64 TargetNtOpenThread TargetNtOpenThread64 TargetNtOpenThreadToken TargetNtOpenThreadToken64 TargetNtOpenThreadTokenEx TargetNtOpenThreadTokenEx64 TargetNtQueryAttributesFile TargetNtQueryAttributesFile64 TargetNtQueryFullAttributesFile TargetNtQueryFullAttributesFile64 TargetNtSetInformationFile TargetNtSetInformationFile64 TargetNtSetInformationThread TargetNtSetInformationThread64 TargetNtUnmapViewOfSection TargetNtUnmapViewOfSection64 TargetRegisterClassW TargetRegisterClassW64 TargetSetOPMSigningKeyAndSequenceNumbers TargetSetOPMSigningKeyAndSequenceNumbers64 g_handles_to_close g_interceptions g_nt g_originals g_shared_IPC_size g_shared_delayed_integrity_level g_shared_delayed_mitigations g_shared_policy_size g_shared_section

Name

.text

Size

228KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-06_82b7d5953addb51da9b3304378545637_mespinoza

mozglue

usp10

advapi32

ntdll

msvcp140

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic