2026-05-24_6b22d9d1fd4124ffddabb246508656ef_mespinoza_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-24_6b22d9d1fd4124ffddabb246508656ef_mespinoza_vidar
Size 1.5MB
Sample260524-tkrrvsdy2s
SHA256 572841ef4d0411dcf38d47ea34c13ae866fa7a9d20ae0a4537e0b25f37097f1a
MD5 6b22d9d1fd4124ffddabb246508656ef
SHA1 eb2a6d2fc217fc32110aca82bf379f2a0e606702
SHA512 4fc51cc5b2a3ee8506bff77d35c8de41f4fcfe65a7eafbde6a4c174812fc0659319af8ee7c9821f1bf55cf04cfb3469f5303108a8a1c91e25120c898aa8f7f9f
SSDEEP 24576:gZ/0F8ylaP6Lh79zuGpVYxHy6i1zuxw7ljsarakkqt4nUw3bxM:gZ/7yQPI7BCxHy6i1zuajsauZnJLxM
TLSH
T1D075291A63E802EDDC769138C6654572E671BC612B20F6CF2258A27D6F33ED09D3BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-24_6b22d9d1fd4124ffddabb246508656ef_mespinoza_vidar

File Explorer

2026-05-24_6b22d9d1fd4124ffddabb246508656ef_mespinoza_vidar

.exe 1.5MB

2026-05-24_6b22d9d1fd4124ffddabb246508656ef_mespinoza_vidar

IMPHASH 62802e53dc9829345d2338b9a05d5220
SHA256 572841ef4d0411dcf38d47ea34c13ae866fa7a9d20ae0a4537e0b25f37097f1a
MD5 6b22d9d1fd4124ffddabb246508656ef
SHA1 eb2a6d2fc217fc32110aca82bf379f2a0e606702
SHA512 4fc51cc5b2a3ee8506bff77d35c8de41f4fcfe65a7eafbde6a4c174812fc0659319af8ee7c9821f1bf55cf04cfb3469f5303108a8a1c91e25120c898aa8f7f9f
SSDEEP 24576:gZ/0F8ylaP6Lh79zuGpVYxHy6i1zuxw7ljsarakkqt4nUw3bxM:gZ/7yQPI7BCxHy6i1zuajsauZnJLxM
TLSH
T1D075291A63E802EDDC769138C6654572E671BC612B20F6CF2258A27D6F33ED09D3BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

222744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\clview\x-none\clview.pdb

kernel32

DecodePointer RaiseException GetLastError InitializeCriticalSectionEx DeleteCriticalSection GetCommandLineW GetCurrentThreadId FreeLibrary FindAtomW GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW MultiByteToWideChar GetUserDefaultLCID CreateDirectoryW DeleteFileW FindClose FindFirstFileW GetLongPathNameW ReadFile WriteFile CloseHandle CreateThread CreateProcessW WideCharToMultiByte GetCurrentProcessId ProcessIdToSessionId SetLastError EnterCriticalSection LeaveCriticalSection GetFileSize OutputDebugStringA OutputDebugStringW LocalFree FormatMessageW GetModuleHandleExW LoadLibraryW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW GetTickCount64 FlsAlloc FlsGetValue FlsSetValue FlsFree SetUnhandledExceptionFilter GetVersionExW ReleaseMutex WaitForSingleObject CreateMutexW Sleep CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile GetSystemInfo GetStartupInfoW CreateEventW IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WerRegisterMemoryBlock VirtualProtect GetTickCount GetSystemTimeAsFileTime HeapSetInformation QueryPerformanceCounter LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList VirtualQuery InitializeSListHead GetProcessHeap HeapFree HeapAlloc IsDebuggerPresent FormatMessageA WaitForSingleObjectEx ResetEvent SetEvent EncodePointer

vcruntime140

__std_terminate __CxxFrameHandler3 memset memcpy __vcrt_InitializeCriticalSectionEx wcsstr _CxxThrowException wcschr wcsrchr memcmp __telemetry_main_return_trigger memmove __C_specific_handler __telemetry_main_invoke_trigger

msvcp140

?_Xbad_function_call@std@@YAXXZ ?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _recalloc

api-ms-win-crt-string-l1-1-0

_wcsdup wcscat_s wcscpy_s wcsncpy_s _wcsicmp wcsncat_s strncpy_s

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e exit _crt_atexit _errno _invalid_parameter_noinfo _exit _cexit _register_onexit_function _initialize_onexit_table _invalid_parameter_noinfo_noreturn terminate _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vswprintf _set_fmode __stdio_common_vsnwprintf_s __stdio_common_vswprintf_s __stdio_common_vsnprintf_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale __initialize_lconv_for_unsigned_char

oleaut32

VariantClear SysAllocStringLen VariantInit SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound VariantChangeType SafeArrayDestroy SafeArrayDestroyData SysAllocString VarUI4FromStr SysFreeString SafeArrayGetUBound SafeArrayGetElement

Name

.text

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-24_6b22d9d1fd4124ffddabb246508656ef_mespinoza_vidar

kernel32

vcruntime140

msvcp140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

oleaut32

generic