2026-05-24_4b5fe5791a24a72cb0d266b65ec10de4_elex_hijackloader_mespinoza

General

Target
2026-05-24_4b5fe5791a24a72cb0d266b65ec10de4_elex_hijackloader_mespinoza
Size 1.4MB
Sample260524-s9d2mac181
SHA256 cbb800353ddaddb8f393d271c5542854c9d52751faa80156bff641c8cf8b1444
MD5 4b5fe5791a24a72cb0d266b65ec10de4
SHA1 65e28fb0036b80fbaddb493e23f25edd7ae6ed7a
SHA512 e881b3c0d39bb7c20acae7b70c809f7511df420a80ab8c0506d72bfdc0dc40fcc7234f377d48919b3b5690466fabbda139a0b1c5e4c0ea22ebb7a13331be2bae
SSDEEP 24576:GH35DMw2n/qIjtAT3Gf2ROf1IegqutJQ5FeQzcuC4r6HQ2QRl9zauV:O35DMnCIjtAyf2RAR5FeA6w2492+
TLSH
T1DE655A11B7E083FDEDB75231C9A5A636E675BD201930F64F134CE64E5E32E409A27B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-24_4b5fe5791a24a72cb0d266b65ec10de4_elex_hijackloader_mespinoza

File Explorer

2026-05-24_4b5fe5791a24a72cb0d266b65ec10de4_elex_hijackloader_mespinoza

.exe 1.4MB

2026-05-24_4b5fe5791a24a72cb0d266b65ec10de4_elex_hijackloader_mespinoza

SHA256 cbb800353ddaddb8f393d271c5542854c9d52751faa80156bff641c8cf8b1444
MD5 4b5fe5791a24a72cb0d266b65ec10de4
SHA1 65e28fb0036b80fbaddb493e23f25edd7ae6ed7a
SHA512 e881b3c0d39bb7c20acae7b70c809f7511df420a80ab8c0506d72bfdc0dc40fcc7234f377d48919b3b5690466fabbda139a0b1c5e4c0ea22ebb7a13331be2bae
SSDEEP 24576:GH35DMw2n/qIjtAT3Gf2ROf1IegqutJQ5FeQzcuC4r6HQ2QRl9zauV:O35DMnCIjtAyf2RAR5FeA6w2492+
TLSH
T1DE655A11B7E083FDEDB75231C9A5A636E675BD201930F64F134CE64E5E32E409A27B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

177464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\clview.pdb

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-24_4b5fe5791a24a72cb0d266b65ec10de4_elex_hijackloader_mespinoza

generic