2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza
Size 1.5MB
Sample260723-la8cvsba86
SHA256 9dd8d0cb6944b5c90ba1ac7c1fc468cb9a7ae07d432b5f54f22c9334be1154b1
MD5 17796dba6034b7cb4beab5dea2ba3370
SHA1 2a6cbaaac9db42362b22ab876c606e60d522f3a4
SHA512 40334b3e6440d239f741bf3133243dd1aaf3a2a99d223d4495f516a466efceecc3b810d63104b24c0e69efd9f43b81f4a71f518a4be73d4459f2c9d33c367d91
SSDEEP 12288:L4WvwR9AtYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Ldukt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T11D75018A6A9554F4D166C13994690F89E262BC40BB00CFDF47707E2D3F7A2E09E3935B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza

File Explorer

2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza

.exe 1.5MB

2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza

IMPHASH 7e85aa0b75083fc1b5318e1dd57b4c06
SHA256 9dd8d0cb6944b5c90ba1ac7c1fc468cb9a7ae07d432b5f54f22c9334be1154b1
MD5 17796dba6034b7cb4beab5dea2ba3370
SHA1 2a6cbaaac9db42362b22ab876c606e60d522f3a4
SHA512 40334b3e6440d239f741bf3133243dd1aaf3a2a99d223d4495f516a466efceecc3b810d63104b24c0e69efd9f43b81f4a71f518a4be73d4459f2c9d33c367d91
SSDEEP 12288:L4WvwR9AtYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Ldukt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T11D75018A6A9554F4D166C13994690F89E262BC40BB00CFDF47707E2D3F7A2E09E3935B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

U:\develop\global\Release64\bin\common\adsubaware.pdb

wininet

InternetGetConnectedState InternetCheckConnectionW

mfc140u

ord2011 ord7668 ord12625 ord3949 ord4011 ord9089 ord14216 ord7650 ord14210 ord12223 ord12222 ord2439 ord5183 ord8023 ord12544 ord8084 ord8167 ord2921 ord285 ord5709 ord4946 ord12240 ord13986 ord8161 ord1665 ord14225 ord2340 ord12030 ord4913 ord1667 ord1670 ord8416 ord14027 ord2396 ord316 ord310 ord1034 ord1674 ord2350 ord2514 ord2270 ord4357 ord2222 ord4914 ord4948 ord12241 ord300 ord12445 ord280 ord11813 ord10704 ord11085 ord3951 ord3308 ord3307 ord3071 ord6000 ord13397 ord2697 ord11854 ord8901 ord4343 ord8731 ord10727 ord1369 ord878 ord2149 ord1033 ord286 ord10163 ord7233 ord9159 ord3713 ord3599 ord6121 ord2187 ord1489 ord1042 ord990 ord1454 ord6231 ord8900 ord9946 ord7922 ord5227 ord7450 ord7461 ord7460 ord5916 ord5062 ord5229 ord5083 ord5582 ord5339 ord11664 ord5552 ord5363 ord5080 ord11850 ord3172 ord3278 ord3279 ord3812 ord11806 ord2629 ord5723 ord13354 ord11406 ord6631 ord14217 ord7651 ord14211 ord2967 ord4352 ord9384 ord4360 ord4828 ord4767 ord4752 ord4814 ord4859 ord4782 ord4837 ord4853 ord4794 ord4800 ord4806 ord4788 ord4843 ord4776 ord1755 ord1734 ord2370 ord1491 ord6848 ord446 ord1089 ord3244 ord3053 ord1748 ord1722 ord1700 ord11940 ord11944 ord13513 ord3173 ord8947 ord10691 ord6729 ord11902 ord8656 ord14209 ord11625 ord3718 ord11771 ord8830 ord11415 ord11414 ord5451 ord9979 ord14290 ord6123 ord14289 ord11665 ord6122 ord3731 ord5706 ord11921 ord11929 ord14088 ord7920 ord12212 ord7719 ord10124 ord11933 ord11901 ord12606 ord5555 ord9941 ord6614 ord6505 ord1501 ord261 ord265 ord12087 ord14278 ord266 ord8449 ord4445 ord4655 ord296 ord7716 ord1450 ord983 ord7393 ord10070 ord2344 ord2346 ord6619 ord2311 ord13864 ord9041 ord4726 ord4656 ord14288 ord4181 ord2212 ord1503 ord9975 ord9977 ord9978 ord9976 ord14360 ord2698 ord7913 ord3209 ord3212 ord13401 ord6002 ord2909

kernel32

WaitForSingleObject OutputDebugStringW GetExitCodeThread ReleaseMutex CloseHandle SetThreadPriority GetLastError InitializeCriticalSectionEx DeleteCriticalSection GetModuleFileNameW LoadLibraryW GetProcAddress FreeLibrary LoadLibraryExW Sleep WideCharToMultiByte GetVersionExW IsWow64Process GetCurrentProcess GetLocaleInfoW CreateMutexW ResumeThread GetEnvironmentVariableW EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW

user32

EnableWindow MessageBoxW LoadCursorW DefWindowProcW IsWindow SetForegroundWindow GetLastActivePopup FindWindowW UnregisterClassW PostMessageW GetClientRect GetSystemMetrics IsIconic SendMessageW LoadIconW DrawIcon

comctl32

ord17

shlwapi

PathUnquoteSpacesW PathFileExistsW PathRemoveArgsW

ole32

CoTaskMemFree StringFromCLSID CLSIDFromProgID CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SafeArrayLock SafeArrayUnlock SafeArrayCreate SafeArrayDestroy SafeArrayGetUBound SafeArrayGetLBound SafeArrayCopy SafeArrayGetVartype VariantInit VariantClear SysAllocString SysFreeString

vcruntime140

__std_terminate memset __C_specific_handler __CxxFrameHandler3 __vcrt_InitializeCriticalSectionEx memcpy

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo _initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback _cexit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _errno _set_app_type _seh_filter_exe _crt_atexit terminate __p___wargv __p___argc _c_exit

api-ms-win-crt-string-l1-1-0

strncmp _strlwr_s _wcsicmp

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s _waccess _wsplitpath_s

api-ms-win-crt-convert-l1-1-0

_wtol _ultoa_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

advapi32

RegCloseKey RegGetValueW RegOpenKeyExW RegEnumValueW

Name

.text

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_17796dba6034b7cb4beab5dea2ba3370_mespinoza

wininet

mfc140u

kernel32

user32

comctl32

shlwapi

ole32

oleaut32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

advapi32

generic