2026-05-17_6b7f1b99f627e187443117b0f15d301a_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-17_6b7f1b99f627e187443117b0f15d301a_mespinoza
Size 1.6MB
Sample260517-s6292set7m
SHA256 72e90dc4d313716b63ba2e750d7da0b1914bfdc59389a604b71add77bc93782d
MD5 6b7f1b99f627e187443117b0f15d301a
SHA1 5fd257d39709860c9e89bf968f286bf9aa54f2f6
SHA512 a367fec49d2b7cd75a92b883c06018138881601c9080a9c7fb796d3c0694d7a99a3f701b86b35da64ea639a0ffdc78763b1bb1a4bdca842055715d912cf9b7dd
SSDEEP 24576:vACDtmAWUUlsqjnhMgeiCl7G0nehbGZpbD:5xGUUZDmg27RnWGj
TLSH
T15975E15B73A04CF6E9638078CA92D666E7B2FDA51F20D70F16A1836F2F234A15D2D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-17_6b7f1b99f627e187443117b0f15d301a_mespinoza

File Explorer

2026-05-17_6b7f1b99f627e187443117b0f15d301a_mespinoza

.exe 1.6MB

2026-05-17_6b7f1b99f627e187443117b0f15d301a_mespinoza

IMPHASH 6554e73b2e80b0c0abefa5b811d08ddf
SHA256 72e90dc4d313716b63ba2e750d7da0b1914bfdc59389a604b71add77bc93782d
MD5 6b7f1b99f627e187443117b0f15d301a
SHA1 5fd257d39709860c9e89bf968f286bf9aa54f2f6
SHA512 a367fec49d2b7cd75a92b883c06018138881601c9080a9c7fb796d3c0694d7a99a3f701b86b35da64ea639a0ffdc78763b1bb1a4bdca842055715d912cf9b7dd
SSDEEP 24576:vACDtmAWUUlsqjnhMgeiCl7G0nehbGZpbD:5xGUUZDmg27RnWGj
TLSH
T15975E15B73A04CF6E9638078CA92D666E7B2FDA51F20D70F16A1836F2F234A15D2D311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14956

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\filters\x-none\fltldr.pdb

vcruntime140

__CxxFrameHandler3 wcsrchr __std_terminate __C_specific_handler __telemetry_main_return_trigger __telemetry_main_invoke_trigger memmove memcmp __vcrt_InitializeCriticalSectionEx _CxxThrowException __std_exception_destroy __std_exception_copy wcschr memset memcpy

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table terminate _errno _register_thread_local_exe_atexit_callback _c_exit _cexit _invalid_parameter_noinfo _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _clearfp _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

wcsnlen strncpy_s wcsncpy_s wcscpy_s wcscmp strnlen isdigit strcpy_s

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode malloc free

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vsprintf_s __stdio_common_vswprintf_s __stdio_common_vswprintf

api-ms-win-crt-math-l1-1-0

__setusermatherr expf logf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale __initialize_lconv_for_unsigned_char

gdi32

GetMetaFileBitsEx SetEnhMetaFileBits GetEnhMetaFileBits DeleteEnhMetaFile SetMetaFileBitsEx DeleteMetaFile

kernel32

GetProcessAffinityMask TryEnterCriticalSection InterlockedPushEntrySList WerUnregisterMemoryBlock CloseHandle GetLastError CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleHandleW GetProcAddress LoadLibraryExW GetCommandLineW WideCharToMultiByte QueryPerformanceCounter GetProcessHeap HeapSetInformation GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount VirtualProtect WerRegisterMemoryBlock RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW QueryFullProcessImageNameW OpenProcess ReleaseMutex QueryDepthSList WaitForMultipleObjects RtlCaptureStackBackTrace InterlockedPopEntrySList CreateThread WaitForMultipleObjectsEx GetTickCount64 GetThreadIOPendingFlag GetCurrentThread PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort EncodePointer DecodePointer Sleep FormatMessageW SetLastError RaiseFailFastException MultiByteToWideChar FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObjectEx CreateEventExW GetEnvironmentVariableW CreateFileW ReadFile WriteFile WaitForSingleObject RaiseException GetSystemInfo FindResourceW FreeLibrary LoadLibraryExA CreateEventW GetModuleFileNameA GetModuleFileNameW GetShortPathNameA OutputDebugStringA CreateMemoryResourceNotification GetModuleHandleExW LoadLibraryW IsSystemResumeAutomatic GetSystemPowerStatus CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW GetVersionExW CreateMutexA CreateEventA OpenEventA OpenMutexA CreateSemaphoreA OpenSemaphoreA CreateFileMappingA OpenFileMappingA GlobalAlloc GlobalFree HeapAlloc HeapFree LocalAlloc LocalFree SetWaitableTimerEx CancelWaitableTimer CreateWaitableTimerW LoadResource SizeofResource VirtualQuery

msvcp140

_Thrd_sleep ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z _Xtime_get_ticks

advapi32

CopySid RegOpenKeyExW RegCreateKeyExW GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegCloseKey EventUnregister EventRegister EventWrite RevertToSelf GetLengthSid GetSidSubAuthority IsValidSid AddAccessAllowedAce AddAccessDeniedAce AllocateAndInitializeSid CreateWellKnownSid EqualSid FreeSid GetSecurityDescriptorDacl InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorW OpenThreadToken

ole32

CoRevokeInitializeSpy CoRegisterInitializeSpy CoUninitialize CoCreateGuid CoInitializeEx

Name

.text

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-17_6b7f1b99f627e187443117b0f15d301a_mespinoza

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

gdi32

kernel32

msvcp140

advapi32

ole32

generic