2026-08-04_d9d7e7b4158ae20b81d4d91f77465d0e_elex_mespinoza_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_d9d7e7b4158ae20b81d4d91f77465d0e_elex_mespinoza_virut
Size 325KB
Sample260804-fx8dgssale
SHA256 c0c69984323d6cf49ca2066f66639f8685b3363d92474cb63e59cc34c858ec42
MD5 d9d7e7b4158ae20b81d4d91f77465d0e
SHA1 aa22dc0a900e3064d8101bb8683a4cac6141979d
SHA512 476a60c5925af33604b63293f68fb9eb68390d9adf16c7b3f7ea89815e80015e86075c2557ac2906071bb2a121309dc623ab195fb7acd124f3c6a9e7693702dc
SSDEEP 3072:2vtuOBxpTy6e60RkGf7hxsaWoxWo6z+FhFR0B78XeoCOb1fEl2J7lprvA:IWbMgFQ2IBoXeIf7lprvA
TLSH
T185649E40BACE8A72E9A3027158B89B76C037FF30AB5145D7F354BA5E29743C11A31E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-04_d9d7e7b4158ae20b81d4d91f77465d0e_elex_mespinoza_virut

File Explorer

2026-08-04_d9d7e7b4158ae20b81d4d91f77465d0e_elex_mespinoza_virut

.exe 325KB

2026-08-04_d9d7e7b4158ae20b81d4d91f77465d0e_elex_mespinoza_virut

IMPHASH 4730fefbf28d72839387fe8e61465f61
SHA256 c0c69984323d6cf49ca2066f66639f8685b3363d92474cb63e59cc34c858ec42
MD5 d9d7e7b4158ae20b81d4d91f77465d0e
SHA1 aa22dc0a900e3064d8101bb8683a4cac6141979d
SHA512 476a60c5925af33604b63293f68fb9eb68390d9adf16c7b3f7ea89815e80015e86075c2557ac2906071bb2a121309dc623ab195fb7acd124f3c6a9e7693702dc
SSDEEP 3072:2vtuOBxpTy6e60RkGf7hxsaWoxWo6z+FhFR0B78XeoCOb1fEl2J7lprvA:IWbMgFQ2IBoXeIf7lprvA
TLSH
T185649E40BACE8A72E9A3027158B89B76C037FF30AB5145D7F354BA5E29743C11A31E5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

be:2b:12:55:98:f6:68:79:1b:d0:de:87:ec:61:76:6b:74:6b:26:94:00:18:a6:02:86:4e:d4:53:ed:d8:78:3c

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Dec 25, 2024

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

10:60:14:b2:54:b4:7c:f7:bd:62:44:36:87:09:82:5b:9b:31:b7:7f

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Dec 25, 2024

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Serial Number

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 2, 2023 - Oct 30, 2034

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Serial Number

0d:6a:73:d0:15:d3:84:9c:e5:43:01:d1:77:5c:08:f4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 20, 2023 - Oct 22, 2026

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

345281

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\baidu\netdisk\pc-yunbrowser\output\pdb\HelpUtility.pdb

bull140u

?AssertOut@BULL@@YAJPB_WH_N0@Z ?CreateObjectNative@BULL@@YAJABU_GUID@@0PAPAX@Z ?GetNamedObject@BULL@@YAJPA_WABU_GUID@@1PAPAX@Z ?tgz@BULL@@YAJPB_WPAUIGeneralArray@1@@Z ?EnableNamedObject@BULL@@YAJPA_WABU_GUID@@@Z

apputil

?TransformUtf8BufferToBSTR@Misc@AppUtil@@YAJPAUIGeneralBuffer@BULL@@PAPA_W@Z GetInt64FromJsonDataShim ?Parse@JsonLib@@YAJPA_WPAPAUIGeneralData@BULL@@@Z

kernel32

RaiseException LocalFree GetPrivateProfileIntW InitializeCriticalSection GetSystemTime GetCurrentThreadId TlsFree TlsAlloc TlsGetValue WriteConsoleW SetConsoleTextAttribute FreeConsole GetConsoleScreenBufferInfo GetStdHandle AllocConsole OutputDebugStringW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource DeleteCriticalSection FindResourceW FindResourceExW CreateProcessW WaitForSingleObject CloseHandle GetSystemDirectoryW EnterCriticalSection GetModuleFileNameW LeaveCriticalSection MultiByteToWideChar GetProcAddress GetModuleHandleW FreeLibrary lstrcmpiW LoadLibraryExW CreateFileW ReadFile GetFileSize GetTempPathW WideCharToMultiByte DeleteFileW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId InitializeCriticalSectionAndSpinCount GetLastError DecodePointer SetErrorMode MoveFileExW LoadResource ResetEvent WaitForSingleObjectEx QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW SetEvent

user32

CharNextW DispatchMessageW TranslateMessage GetMessageW PostQuitMessage DefWindowProcW

advapi32

RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegCloseKey RegQueryInfoKeyW RegDeleteValueW

shell32

CommandLineToArgvW

ole32

OleInitialize CoTaskMemFree CoTaskMemRealloc CoInitializeEx OleUninitialize CoCreateInstance CoInitializeSecurity CoUninitialize CoTaskMemAlloc

oleaut32

VarUI4FromStr SysStringLen SysFreeString SysAllocString LoadTypeLi LoadRegTypeLi

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ

vcruntime140

_except_handler4_common memset _CxxThrowException __CxxFrameHandler3 __vcrt_InitializeCriticalSectionEx wcsrchr __std_exception_copy __std_exception_destroy memcpy _purecall __std_terminate memmove wcsstr

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _errno _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate _invalid_parameter_noinfo _set_app_type _controlfp_s _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _seh_filter_exe _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-stdio-l1-1-0

_set_fmode fclose __p__commode __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vfwprintf fflush __stdio_common_vswprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf_s _wfsopen

api-ms-win-crt-string-l1-1-0

wcsnlen wcsspn wcscspn wcsncpy_s _wcslwr_s wmemcpy_s _wcsicmp strnlen

api-ms-win-crt-time-l1-1-0

wcsftime _time64 _localtime64_s _mktime64

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode _recalloc free malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-filesystem-l1-1-0

_waccess

Name

.text

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

201KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_d9d7e7b4158ae20b81d4d91f77465d0e_elex_mespinoza_virut

PE Signature issue

PE Signature issue

bull140u

apputil

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic