2026-07-22_9fd0b2ff10eb27b1e2fa36aab3008e27_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_9fd0b2ff10eb27b1e2fa36aab3008e27_mespinoza
Size 1.3MB
Sample260722-x3e3kashpc
SHA256 1669fcc9998b94b35fc9e291127b86701a8500a152bb1d2135dae009922ebc8a
MD5 9fd0b2ff10eb27b1e2fa36aab3008e27
SHA1 ea34ccfe476d4dd79a96be61346b21328e57cd91
SHA512 43cc08dda519195d59d724d64f448976ee7a90a08749031b56b395905aab516d824576896a9a14a480b6cd08039d5cdde6fbd5afde7d0a0c069f19548c1d9827
SSDEEP 12288:ab85aqG8IhYKs9q66hI2dSNAld5lVvYRMFlvZfxTK:nG8i6ANJ5lkoZf1K
TLSH
T13155C441B6A80895FCAE9D7489668675FA32BD9F3D2DB30B1C50B22F1F338D05E25721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_9fd0b2ff10eb27b1e2fa36aab3008e27_mespinoza

File Explorer

2026-07-22_9fd0b2ff10eb27b1e2fa36aab3008e27_mespinoza

.exe 1.3MB

2026-07-22_9fd0b2ff10eb27b1e2fa36aab3008e27_mespinoza

IMPHASH ee94bdd758e15acb340c359c34807497
SHA256 1669fcc9998b94b35fc9e291127b86701a8500a152bb1d2135dae009922ebc8a
MD5 9fd0b2ff10eb27b1e2fa36aab3008e27
SHA1 ea34ccfe476d4dd79a96be61346b21328e57cd91
SHA512 43cc08dda519195d59d724d64f448976ee7a90a08749031b56b395905aab516d824576896a9a14a480b6cd08039d5cdde6fbd5afde7d0a0c069f19548c1d9827
SSDEEP 12288:ab85aqG8IhYKs9q66hI2dSNAld5lVvYRMFlvZfxTK:nG8i6ANJ5lkoZf1K
TLSH
T13155C441B6A80895FCAE9D7489668675FA32BD9F3D2DB30B1C50B22F1F338D05E25721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

225340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\lync\x-none\ucmapi.pdb

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW RegisterTraceGuidsW UnregisterTraceGuids GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags TraceMessage RegNotifyChangeKeyValue RegisterEventSourceW ReportEventW RegQueryValueExW StartTraceW QueryTraceW FlushTraceW ControlTraceW EnableTrace RegOpenKeyExA RegGetValueW EventRegister EventUnregister EventWriteTransfer DeregisterEventSource

kernel32

FindResourceW LoadLibraryW lstrcmpiW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW MultiByteToWideChar FindResourceExW LockResource RtlCaptureContext GetCommandLineW CloseHandle SetUnhandledExceptionFilter SetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess TerminateProcess CreateThread GetCurrentThreadId GetCurrentProcessId GetTickCount CompareStringEx GetACP FileTimeToSystemTime GetSystemTimeAsFileTime FileTimeToLocalFileTime GetModuleFileNameA SizeofResource CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer WriteFile UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateProcessW CreateMutexW ReleaseMutex DuplicateHandle GetFileSize CreateFileW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock SetFilePointerEx DeleteFileW QueryPerformanceFrequency WideCharToMultiByte SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetLocalTime GetSystemTime GetTickCount64 ExpandEnvironmentStringsW MoveFileExW OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry WerRegisterMemoryBlock HeapSetInformation QueryPerformanceCounter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo LoadResource LoadLibraryExW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException DecodePointer OutputDebugStringA GetShortPathNameA GetVersionExW FlsAlloc FlsGetValue FlsSetValue FlsFree

mapi32

ord75 ord19 ord11 ord21 ord23 ord49 ord50 ord17 ord140 ord13 ord36 ord42 ord135 ord139 ord15

ole32

CoCreateInstance CoInitialize StringFromGUID2 CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateStreamOnHGlobal CoAddRefServerProcess StringFromIID

oleaut32

SysStringLen SysFreeString LoadTypeLi LoadRegTypeLi SysAllocString RegisterTypeLi UnRegisterTypeLi SysAllocStringLen SafeArrayCreate SafeArrayDestroy VariantCopy SafeArrayRedim SafeArrayGetUBound SysReAllocStringLen SystemTimeToVariantTime SafeArrayGetLBound SafeArrayLock SafeArrayUnlock VariantInit SysAllocStringByteLen VariantTimeToSystemTime VarUI4FromStr VariantClear SysStringByteLen

vcruntime140

wcschr __telemetry_main_invoke_trigger wcsrchr __vcrt_InitializeCriticalSectionEx __telemetry_main_return_trigger __std_exception_destroy __std_exception_copy _set_purecall_handler memmove memset memcpy memcmp __CxxFrameHandler3 __C_specific_handler _CxxThrowException wcsstr __std_terminate

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z _Thrd_sleep ?_Xlength_error@std@@YAXPEBD@Z _Xtime_get_ticks

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn _resetstkoflw _set_invalid_parameter_handler _errno _invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

_strnicmp strncpy_s strncmp _wcsnicmp wcsncmp iswspace _wcslwr_s _wcsupr_s wcscpy_s wcscat_s wmemcpy_s wcsnlen wcsncpy_s _wcsicmp wcscspn wcsspn isdigit iswascii wcstok_s wcscmp

api-ms-win-crt-heap-l1-1-0

calloc free malloc _recalloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vsnwprintf_s fputs __stdio_common_vsprintf __acrt_iob_func

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char _configthreadlocale

rpcrt4

UuidToStringW RpcStringFreeW

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

Name

.text

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

141KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_9fd0b2ff10eb27b1e2fa36aab3008e27_mespinoza

advapi32

kernel32

mapi32

ole32

oleaut32

vcruntime140

msvcp140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

rpcrt4

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

generic