2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza
Size 1.2MB
Sample260706-ngc7eaas9m
SHA256 6246012937eefd58f588311a8e5048e9454787fe9ec7ab7f56057a87664c0f7f
MD5 af2b9572ad82348c4f48b7a140a76827
SHA1 ce5acd7581ed0d461f2884c23c70132015d9aa54
SHA512 12fb064211b06fed7c09b24fbf8006cc222b4ef8d30cbfd0035383184e4b556299ca2b0407e1e019f29a4489ba69ff0c89051c287210a8e0f2f0bca2fc9ca982
SSDEEP 12288:9QXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:9L743TvRk6NwG
TLSH
T17255120533E504C8F573AE3AC8A14691882AFE615F51EECF87A4620E1D786D4DE39F39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza

File Explorer

2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza

.exe 1.2MB

2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza

IMPHASH 4ce2215a3fc9acbbc4154575e6f8a93f
SHA256 6246012937eefd58f588311a8e5048e9454787fe9ec7ab7f56057a87664c0f7f
MD5 af2b9572ad82348c4f48b7a140a76827
SHA1 ce5acd7581ed0d461f2884c23c70132015d9aa54
SHA512 12fb064211b06fed7c09b24fbf8006cc222b4ef8d30cbfd0035383184e4b556299ca2b0407e1e019f29a4489ba69ff0c89051c287210a8e0f2f0bca2fc9ca982
SSDEEP 12288:9QXI7vgbrWVQhTCYHvRktx/aICF9flefuKaO0VQ/:9L743TvRk6NwG
TLSH
T17255120533E504C8F573AE3AC8A14691882AFE615F51EECF87A4620E1D786D4DE39F39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

O:\src\pywin32\build\temp.win-amd64-3.7\Release\Pythonwin.pdb

mfc140u

ord5552 ord9041 ord5339 ord5555 ord5083 ord5229 ord5062 ord7460 ord7461 ord7450 ord5363 ord7922 ord9941 ord8900 ord8161 ord1504 ord1033 ord296 ord7928 ord6505 ord1489 ord5080 ord6848 ord11901 ord11933 ord7920 ord11921 ord5706 ord3731 ord465 ord6614 ord983 ord1491 ord6122 ord14289 ord6123 ord14290 ord6121 ord14288 ord7719 ord12212 ord14088 ord11664 ord11665 ord2011 ord7668 ord12625 ord2270 ord8167 ord7393 ord1450 ord8084 ord11929 ord10124 ord12544 ord4445 ord8023 ord5183 ord9842 ord2439 ord12223 ord12222 ord14210 ord7650 ord14216 ord9089 ord4011 ord5227 ord3949 ord2212 ord2370

kernel32

GetProcAddress TerminateProcess GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent LeaveCriticalSection EnterCriticalSection CloseHandle QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GetModuleHandleExW SetLastError OutputDebugStringA LoadLibraryW FormatMessageW GetModuleHandleW GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer OutputDebugStringW

user32

UnregisterClassW wsprintfW

oleaut32

SysFreeString

vcruntime140

memmove __std_terminate __CxxFrameHandler3 memset __C_specific_handler __telemetry_main_invoke_trigger __telemetry_main_return_trigger __vcrt_InitializeCriticalSectionEx __std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _recalloc

api-ms-win-crt-runtime-l1-1-0

_cexit _exit _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _initterm exit _set_app_type _seh_filter_exe _c_exit _register_thread_local_exe_atexit_callback _initterm_e _seh_filter_dll _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit terminate _invalid_parameter_noinfo _errno

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_af2b9572ad82348c4f48b7a140a76827_mespinoza

mfc140u

kernel32

user32

oleaut32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic