2026-07-29_7f1ae1e35c99426d7ef5ca1850ea74a5_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_7f1ae1e35c99426d7ef5ca1850ea74a5_elex_mespinoza
Size 1.7MB
Sample260730-aceyjsha25
SHA256 fb1419cd8cdb01efa2efb4889e9bf2ff8479d579c782ef21e1783299ade202ce
MD5 7f1ae1e35c99426d7ef5ca1850ea74a5
SHA1 fcd1fa66a0a78fc26e87b705ddc206a3645b9331
SHA512 3c52c9da58bc98a8a123490aa2a51ad64edb80ed10e0e9347bdc003ad309511da5605d7e6738feb9b58006f1925459aa10eb86d2f6e3bd5c3b24d7f1df5586a0
SSDEEP 24576:YFkLxd0i1L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ekLoixLNiXicJFFRGNzj3
TLSH
T1B285F142660077B9D89728F9641DAB3BA4734D144F124EC3CFF4FD4AEE286D21A7584E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_7f1ae1e35c99426d7ef5ca1850ea74a5_elex_mespinoza

File Explorer

2026-07-29_7f1ae1e35c99426d7ef5ca1850ea74a5_elex_mespinoza

.exe 1.7MB

2026-07-29_7f1ae1e35c99426d7ef5ca1850ea74a5_elex_mespinoza

IMPHASH c5596ca4210f5f3474b68d7d54a73d16
SHA256 fb1419cd8cdb01efa2efb4889e9bf2ff8479d579c782ef21e1783299ade202ce
MD5 7f1ae1e35c99426d7ef5ca1850ea74a5
SHA1 fcd1fa66a0a78fc26e87b705ddc206a3645b9331
SHA512 3c52c9da58bc98a8a123490aa2a51ad64edb80ed10e0e9347bdc003ad309511da5605d7e6738feb9b58006f1925459aa10eb86d2f6e3bd5c3b24d7f1df5586a0
SSDEEP 24576:YFkLxd0i1L/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ekLoixLNiXicJFFRGNzj3
TLSH
T1B285F142660077B9D89728F9641DAB3BA4734D144F124EC3CFF4FD4AEE286D21A7584E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

210052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

z:\build\build\src\obj-firefox\browser\app\firefox.pdb

mozglue

?DllBlocklist_Initialize@@YAXI@Z ?MapRemoteViewOfFile@mozilla@@YAPAXPAX0_K0KKK@Z ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z _wcsdup free malloc moz_xmalloc realloc strdup

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CreateEventW CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateThread DebugBreak DecodePointer DeleteCriticalSection DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection ExpandEnvironmentStringsW FlushInstructionCache FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileType GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHandleCount GetProcessHeaps GetProcessId GetQueuedCompletionStatus GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetTickCount GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW GetVolumePathNameW HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA PostQueuedCompletionStatus ProcessIdToSessionId QueryPerformanceCounter RaiseException ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ResetEvent ResumeThread SearchPathW SetDllDirectoryW SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetUnhandledExceptionFilter SignalObjectAndWait Sleep TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoA VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile WriteProcessMemory lstrlenW

advapi32

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateRestrictedToken CreateWellKnownSid DuplicateToken DuplicateTokenEx EqualSid GetAce GetKernelObjectSecurity GetLengthSid GetSecurityDescriptorSacl GetSecurityInfo GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDisablePredefinedCache RegGetValueW RegOpenKeyExW RegQueryValueExW RevertToSelf SetEntriesInAclW SetKernelObjectSecurity SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036

ntdll

NtQueryVirtualMemory NtUnmapViewOfSection

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0ios_base@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1ios_base@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?good@ios_base@std@@QBE_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

vcruntime140

_CxxThrowException __CxxFrameHandler3 __std_exception_copy __std_exception_destroy _except_handler3 _except_handler4_common _purecall memcmp memcpy memmove memset strrchr wcschr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _controlfp_s _crt_atexit _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vfprintf __stdio_common_vsnprintf_s __stdio_common_vsnwprintf_s __stdio_common_vsprintf __stdio_common_vswprintf _dup _set_fmode _wfopen fclose fgets

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-environment-l1-1-0

__p__environ _putenv _wgetenv getenv

api-ms-win-crt-convert-l1-1-0

_ltoa wcstoul

api-ms-win-crt-string-l1-1-0

_stricmp _strnicmp _wcsicmp _wcsnicmp strcpy strlen towlower towupper wcscmp wcscpy wcscpy_s wcslen wcspbrk wcstok_s

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

GetHandleVerifier IsSandboxedProcess NativeNtBlockSet_Write _TargetConfigureOPMProtectedOutput@20 _TargetCreateNamedPipeW@36 _TargetCreateOPMProtectedOutputs@24 _TargetCreateProcessA@44 _TargetCreateProcessW@44 _TargetCreateThread@28 _TargetDestroyOPMProtectedOutput@8 _TargetEnumDisplayDevicesA@20 _TargetEnumDisplayMonitors@20 _TargetGdiDllInitialize@12 _TargetGetCertificate@20 _TargetGetCertificateByHandle@20 _TargetGetCertificateSize@16 _TargetGetCertificateSizeByHandle@16 _TargetGetMonitorInfoA@12 _TargetGetMonitorInfoW@12 _TargetGetOPMInformation@16 _TargetGetOPMRandomNumber@12 _TargetGetStockObject@8 _TargetGetSuggestedOPMProtectedOutputArraySize@12 _TargetNtCreateEvent@24 _TargetNtCreateFile@48 _TargetNtCreateKey@32 _TargetNtMapViewOfSection@44 _TargetNtOpenEvent@16 _TargetNtOpenFile@28 _TargetNtOpenKey@16 _TargetNtOpenKeyEx@20 _TargetNtOpenProcess@20 _TargetNtOpenProcessToken@16 _TargetNtOpenProcessTokenEx@20 _TargetNtOpenThread@20 _TargetNtOpenThreadToken@20 _TargetNtOpenThreadTokenEx@24 _TargetNtQueryAttributesFile@12 _TargetNtQueryFullAttributesFile@12 _TargetNtSetInformationFile@24 _TargetNtSetInformationThread@20 _TargetNtUnmapViewOfSection@12 _TargetRegisterClassW@8 _TargetSetOPMSigningKeyAndSequenceNumbers@12 g_handles_to_close g_interceptions g_nt g_originals g_shared_IPC_size g_shared_delayed_integrity_level g_shared_delayed_mitigations g_shared_policy_size g_shared_section

Name

.text

Size

203KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_7f1ae1e35c99426d7ef5ca1850ea74a5_elex_mespinoza

mozglue

kernel32

advapi32

ntdll

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic