2026-05-10_190b6b10cfc8ce6743bc6a4b82770493_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-10_190b6b10cfc8ce6743bc6a4b82770493_mespinoza
Size 979KB
Sample260510-svd33set2n
SHA256 64b4f1bf6776acb47a3a271b5e03b20c18a9bcf601708875348a48fcc91eb309
MD5 190b6b10cfc8ce6743bc6a4b82770493
SHA1 672d25dacb675c7959deadf74ad43b3be2f266a3
SHA512 e3fd0012fd844b8fc142ac225d729ba641cefe5fc92ed23f92bc3dd4a92a2f2d0f397f3479def3db36f982c9ecd48498a59804575c609e46314b38c731f344fc
SSDEEP 24576:IACDtmAqUU4ntN8tGtLy+24TFr7BHyWEYy:0xaUUatWtGVLrTnNEY
TLSH
T1CA25D05A77A04CF5E566D0388A82D6F6E7B2F8A51F20DB4F66E0836F1F235A06D1C311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-10_190b6b10cfc8ce6743bc6a4b82770493_mespinoza

File Explorer

2026-05-10_190b6b10cfc8ce6743bc6a4b82770493_mespinoza

.exe 979KB

2026-05-10_190b6b10cfc8ce6743bc6a4b82770493_mespinoza

IMPHASH 6554e73b2e80b0c0abefa5b811d08ddf
SHA256 64b4f1bf6776acb47a3a271b5e03b20c18a9bcf601708875348a48fcc91eb309
MD5 190b6b10cfc8ce6743bc6a4b82770493
SHA1 672d25dacb675c7959deadf74ad43b3be2f266a3
SHA512 e3fd0012fd844b8fc142ac225d729ba641cefe5fc92ed23f92bc3dd4a92a2f2d0f397f3479def3db36f982c9ecd48498a59804575c609e46314b38c731f344fc
SSDEEP 24576:IACDtmAqUU4ntN8tGtLy+24TFr7BHyWEYy:0xaUUatWtGVLrTnNEY
TLSH
T1CA25D05A77A04CF5E566D0388A82D6F6E7B2F8A51F20DB4F66E0836F1F235A06D1C311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14956

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\filters\x-none\fltldr.pdb

vcruntime140

__CxxFrameHandler3 wcsrchr __std_terminate __C_specific_handler __telemetry_main_return_trigger __telemetry_main_invoke_trigger memmove memcmp __vcrt_InitializeCriticalSectionEx _CxxThrowException __std_exception_destroy __std_exception_copy wcschr memset memcpy

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table terminate _errno _register_thread_local_exe_atexit_callback _c_exit _cexit _invalid_parameter_noinfo _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _clearfp _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

wcsnlen strncpy_s wcsncpy_s wcscpy_s wcscmp strnlen isdigit strcpy_s

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode malloc free

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vsprintf_s __stdio_common_vswprintf_s __stdio_common_vswprintf

api-ms-win-crt-math-l1-1-0

__setusermatherr expf logf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale __initialize_lconv_for_unsigned_char

gdi32

GetMetaFileBitsEx SetEnhMetaFileBits GetEnhMetaFileBits DeleteEnhMetaFile SetMetaFileBitsEx DeleteMetaFile

kernel32

GetProcessAffinityMask TryEnterCriticalSection InterlockedPushEntrySList WerUnregisterMemoryBlock CloseHandle GetLastError CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleHandleW GetProcAddress LoadLibraryExW GetCommandLineW WideCharToMultiByte QueryPerformanceCounter GetProcessHeap HeapSetInformation GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount VirtualProtect WerRegisterMemoryBlock RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW QueryFullProcessImageNameW OpenProcess ReleaseMutex QueryDepthSList WaitForMultipleObjects RtlCaptureStackBackTrace InterlockedPopEntrySList CreateThread WaitForMultipleObjectsEx GetTickCount64 GetThreadIOPendingFlag GetCurrentThread PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort EncodePointer DecodePointer Sleep FormatMessageW SetLastError RaiseFailFastException MultiByteToWideChar FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObjectEx CreateEventExW GetEnvironmentVariableW CreateFileW ReadFile WriteFile WaitForSingleObject RaiseException GetSystemInfo FindResourceW FreeLibrary LoadLibraryExA CreateEventW GetModuleFileNameA GetModuleFileNameW GetShortPathNameA OutputDebugStringA CreateMemoryResourceNotification GetModuleHandleExW LoadLibraryW IsSystemResumeAutomatic GetSystemPowerStatus CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW GetVersionExW CreateMutexA CreateEventA OpenEventA OpenMutexA CreateSemaphoreA OpenSemaphoreA CreateFileMappingA OpenFileMappingA GlobalAlloc GlobalFree HeapAlloc HeapFree LocalAlloc LocalFree SetWaitableTimerEx CancelWaitableTimer CreateWaitableTimerW LoadResource SizeofResource VirtualQuery

msvcp140

_Thrd_sleep ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z _Xtime_get_ticks

advapi32

CopySid RegOpenKeyExW RegCreateKeyExW GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegCloseKey EventUnregister EventRegister EventWrite RevertToSelf GetLengthSid GetSidSubAuthority IsValidSid AddAccessAllowedAce AddAccessDeniedAce AllocateAndInitializeSid CreateWellKnownSid EqualSid FreeSid GetSecurityDescriptorDacl InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorW OpenThreadToken

ole32

CoRevokeInitializeSpy CoRegisterInitializeSpy CoUninitialize CoCreateGuid CoInitializeEx

Name

.text

Size

189KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

141KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

567KB

Virtual Size

568KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-10_190b6b10cfc8ce6743bc6a4b82770493_mespinoza

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

gdi32

kernel32

msvcp140

advapi32

ole32

generic