2026-07-20_241d30c9e77f9a1dc93d5f23348f4391_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_241d30c9e77f9a1dc93d5f23348f4391_mespinoza
Size 847KB
Sample260720-mc3e3ag16w
SHA256 988f84f89595ad466e5927af0f8be12ae4e1201b82ee8301accc21d1849450d7
MD5 241d30c9e77f9a1dc93d5f23348f4391
SHA1 10d59719181921a2e446b9a05430953f18cbc846
SHA512 f8b5e4f4927ee54c43412bf754be17e62d9c17ee58089b4094311efae0b5fb80ed7069db492bedf04ee34e6e42eb9d899b0d63a3b8b862b1571fb5008566379d
SSDEEP 24576:mPCqP8vBSGkw5LfUV8xoS7ZSy7sDlXcqz:m6q6BpkMbUV8xoiZSy7sD1cqz
TLSH
T188057D0AF2B900EDD1B7D1398A565617FBB278161330A7DF41A0466A7F23EE25B7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-20_241d30c9e77f9a1dc93d5f23348f4391_mespinoza

.exe 847KB

2026-07-20_241d30c9e77f9a1dc93d5f23348f4391_mespinoza

IMPHASH 0294ac26acbb023cc699ca0c9237b67b
SHA256 988f84f89595ad466e5927af0f8be12ae4e1201b82ee8301accc21d1849450d7
MD5 241d30c9e77f9a1dc93d5f23348f4391
SHA1 10d59719181921a2e446b9a05430953f18cbc846
SHA512 f8b5e4f4927ee54c43412bf754be17e62d9c17ee58089b4094311efae0b5fb80ed7069db492bedf04ee34e6e42eb9d899b0d63a3b8b862b1571fb5008566379d
SSDEEP 24576:mPCqP8vBSGkw5LfUV8xoS7ZSy7sDlXcqz:m6q6BpkMbUV8xoiZSy7sD1cqz
TLSH
T188057D0AF2B900EDD1B7D1398A565617FBB278161330A7DF41A0466A7F23EE25B7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

2f:ff:63:c4:8f:45:cc:3d:4d:69:36:7d:50:ab:b9:b0:96:5e:89:c5:5d:37:8a:19:01:c3:1d:03:d6:32:35:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=135811-0289439,CN=CheckMAL Inc.,O=CheckMAL Inc.,L=Yongin-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1309596f6e67696e2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Jun 16, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

09:c0:ba:75:f6:69:2e:f0:da:7b:94:8a:3b:b7:25:5f

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 27, 2026 - Feb 24, 2029

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

670168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BuildMachine\Appcheckv3.0\AppCheck\Build\Release\x64\AppCheckB.pdb

kernel32

CreateMutexW WaitForSingleObject ReleaseMutex CreateDirectoryW CopyFileExW CreateFileA DeleteFileA FindFirstFileW FindFirstFileExW GetFileAttributesW GetFileAttributesA GetFileAttributesExW SetFileAttributesW MoveFileW SetFilePointer WriteFile InitializeCriticalSectionAndSpinCount DeleteCriticalSection CompareFileTime GetFileSize SetEndOfFile EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetCurrentProcessId OutputDebugStringW GetEnvironmentVariableW GetPrivateProfileStringW GetLogicalDriveStringsW GetDriveTypeW GetDiskFreeSpaceExW Sleep GetTickCount InitializeCriticalSectionEx RaiseException AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile InitializeCriticalSection GetFullPathNameA UnlockFileEx GetTempPathW UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA FlushViewOfFile LoadLibraryA WaitForSingleObjectEx HeapCompact UnlockFile CreateFileMappingA LockFileEx SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers OpenEventW CreateEventW WaitNamedPipeW SetNamedPipeHandleState GetFileTime FindNextFileW FindClose SetFileTime InitializeSListHead GetStartupInfoW LoadLibraryExW SetDllDirectoryW DeleteFileW LoadLibraryW GetSystemDirectoryW GetModuleFileNameW WideCharToMultiByte LCMapStringW GetUserDefaultLangID MultiByteToWideChar TerminateProcess CreateFileW GetSystemInfo CloseHandle GetLocalTime GetComputerNameW FormatMessageW GetVersionExW GetCurrentProcess HeapDestroy GetModuleHandleW FindResourceExW FindResourceW LoadResource LockResource SizeofResource LocalFree LocalAlloc FreeLibrary GetProcAddress GetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ResetEvent SetEvent IsDebuggerPresent HeapSize

advapi32

RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx GetTokenInformation CryptDecrypt CryptReleaseContext CryptDestroyKey CryptDestroyHash CryptDeriveKey CryptHashData CryptCreateHash CryptAcquireContextW RegQueryValueW RegOpenKeyW FreeSid SetFileSecurityW SetEntriesInAclW AllocateAndInitializeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

SHCreateDirectoryExW SHGetFolderPathW

oleaut32

VarDateFromStr VariantClear VarUdateFromDate

shlwapi

PathFindExtensionW PathIsDirectoryW PathFileExistsW PathRemoveFileSpecW PathAppendW

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

mpr

WNetAddConnection2W WNetCancelConnection2W

vcruntime140

__CxxFrameHandler3 memcmp memcpy _CxxThrowException __std_terminate memmove wcsrchr wcsstr wcschr memset __vcrt_InitializeCriticalSectionEx __C_specific_handler __std_exception_copy __std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _invalid_parameter_noinfo_noreturn terminate _invalid_parameter_noinfo _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _errno _seh_filter_exe _set_app_type _endthreadex _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-string-l1-1-0

_wcsnicmp iswspace isalpha _wcsicmp wcsnlen wcsspn strncmp wcspbrk wcscspn strcspn towupper wmemcpy_s strcmp

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vswprintf_s __p__commode __stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh _msize _recalloc calloc realloc

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

api-ms-win-crt-time-l1-1-0

wcsftime _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

__setusermatherr

Name

.text

Size

656KB

Virtual Size

656KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_241d30c9e77f9a1dc93d5f23348f4391_mespinoza

kernel32

advapi32

shell32

oleaut32

shlwapi

msvcp140

wtsapi32

mpr

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

generic