2026-08-04_b0058fee378d5058a670348540c2139d_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_b0058fee378d5058a670348540c2139d_elex_mespinoza
Size 1.2MB
Sample260804-xd4pmack41
SHA256 7597ea85fddc4667ce070e5d1273c70fe295b69594fd9563549fb0c244efaf39
MD5 b0058fee378d5058a670348540c2139d
SHA1 4fbdc13d8b1e880c513f9540e5a6ce664bb5b631
SHA512 ce8bb9cc036ff7457638efffc6d1220bd0c93e4053a38a55553a63f130fb6c25650e1a1a18590e087584d5c5a9ee285d2467060f581dc035aa0e3e7a8974992c
SSDEEP 12288:4iWeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4iWtNyBo4kx929bL3Hnx
TLSH
T14D4523126A4C9136FA693FB069759554CC3DBC860F6592DBDB5248BB44FCEE28D30207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_b0058fee378d5058a670348540c2139d_elex_mespinoza

File Explorer

2026-08-04_b0058fee378d5058a670348540c2139d_elex_mespinoza

.exe 1.2MB

2026-08-04_b0058fee378d5058a670348540c2139d_elex_mespinoza

IMPHASH 0183a17540f408bbd19a3b320db17aaa
SHA256 7597ea85fddc4667ce070e5d1273c70fe295b69594fd9563549fb0c244efaf39
MD5 b0058fee378d5058a670348540c2139d
SHA1 4fbdc13d8b1e880c513f9540e5a6ce664bb5b631
SHA512 ce8bb9cc036ff7457638efffc6d1220bd0c93e4053a38a55553a63f130fb6c25650e1a1a18590e087584d5c5a9ee285d2467060f581dc035aa0e3e7a8974992c
SSDEEP 12288:4iWeLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:4iWtNyBo4kx929bL3Hnx
TLSH
T14D4523126A4C9136FA693FB069759554CC3DBC860F6592DBDB5248BB44FCEE28D30207
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13665

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\jenkins\workspace\realplayer_loc_25_0_0\rpupdatesvc\rel32\RealPlayerUpdateSvc.pdb

advapi32

RegSetValueExW CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceStatus RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW

kernel32

HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx FindClose FindFirstFileW FindNextFileW CloseHandle EnterCriticalSection LeaveCriticalSection CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer FreeLibrary GetProcAddress LoadLibraryW LocalFree RaiseException GetLocalTime SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetModuleFileNameW Sleep DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError

shlwapi

PathCombineW PathRemoveFileSpecW

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z

userenv

GetAllUsersProfileDirectoryW

vcruntime140

__std_exception_destroy memset __CxxFrameHandler3 _CxxThrowException _except_handler4_common __telemetry_main_return_trigger __std_exception_copy __telemetry_main_invoke_trigger __vcrt_InitializeCriticalSectionEx memmove memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vfwprintf __stdio_common_vfwprintf_s __acrt_iob_func fclose __stdio_common_vfprintf __p__commode _set_fmode _wfopen

api-ms-win-crt-string-l1-1-0

wcsnlen _wcsicmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-runtime-l1-1-0

terminate _initterm_e _register_thread_local_exe_atexit_callback _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv exit _set_app_type _c_exit __p___wargv _cexit _crt_atexit _register_onexit_function _initialize_onexit_table __p___argc _seh_filter_exe _controlfp_s _initterm _invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo _exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

crypt32

CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptMsgClose

Name

.text

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_b0058fee378d5058a670348540c2139d_elex_mespinoza

advapi32

kernel32

shlwapi

msvcp140

userenv

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

crypt32

generic