2026-08-07_f0c7a6f3ba31ab5f222aa6ae9601d501_mespinoza

Resubmissions

07/08/2026, 20:17

260807-y2zagscj9z10

07/08/2026, 11:02

260807-m5ejpsfd4710

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_f0c7a6f3ba31ab5f222aa6ae9601d501_mespinoza
Size 1.3MB
Sample260807-m5ejpsfd47
SHA256 9ee8006dd0084e2445086f5f90412b227ef3db569af4e5525ef2fb2935e13805
MD5 f0c7a6f3ba31ab5f222aa6ae9601d501
SHA1 de46cc47e48ad861f53eb2d1a1781bbb606710bd
SHA512 94c5df456fe83b0e4ffac338c550c8562af4006f276e2b23cb07ed1905239a3b929bbec45242ae4a65b2bd9b54cd2f4fc1a5d8e835f10677b9e91d410c09953f
SSDEEP 12288:CPGjteG/ahMws9mKqxdglUNEld5lVvYRMFlvZDTep:mG/GKoyD5lkoZX8
TLSH
T13C55C441B6A80895FCAE9D7489668675FA32BD9F3D2DB30B1C50B22F1F338D05E25721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_f0c7a6f3ba31ab5f222aa6ae9601d501_mespinoza

File Explorer

2026-08-07_f0c7a6f3ba31ab5f222aa6ae9601d501_mespinoza

.exe 1.3MB

2026-08-07_f0c7a6f3ba31ab5f222aa6ae9601d501_mespinoza

IMPHASH ee94bdd758e15acb340c359c34807497
SHA256 9ee8006dd0084e2445086f5f90412b227ef3db569af4e5525ef2fb2935e13805
MD5 f0c7a6f3ba31ab5f222aa6ae9601d501
SHA1 de46cc47e48ad861f53eb2d1a1781bbb606710bd
SHA512 94c5df456fe83b0e4ffac338c550c8562af4006f276e2b23cb07ed1905239a3b929bbec45242ae4a65b2bd9b54cd2f4fc1a5d8e835f10677b9e91d410c09953f
SSDEEP 12288:CPGjteG/ahMws9mKqxdglUNEld5lVvYRMFlvZDTep:mG/GKoyD5lkoZX8
TLSH
T13C55C441B6A80895FCAE9D7489668675FA32BD9F3D2DB30B1C50B22F1F338D05E25721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

225340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\lync\x-none\ucmapi.pdb

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW RegisterTraceGuidsW UnregisterTraceGuids GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags TraceMessage RegNotifyChangeKeyValue RegisterEventSourceW ReportEventW RegQueryValueExW StartTraceW QueryTraceW FlushTraceW ControlTraceW EnableTrace RegOpenKeyExA RegGetValueW EventRegister EventUnregister EventWriteTransfer DeregisterEventSource

kernel32

FindResourceW LoadLibraryW lstrcmpiW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW MultiByteToWideChar FindResourceExW LockResource RtlCaptureContext GetCommandLineW CloseHandle SetUnhandledExceptionFilter SetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess TerminateProcess CreateThread GetCurrentThreadId GetCurrentProcessId GetTickCount CompareStringEx GetACP FileTimeToSystemTime GetSystemTimeAsFileTime FileTimeToLocalFileTime GetModuleFileNameA SizeofResource CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer WriteFile UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateProcessW CreateMutexW ReleaseMutex DuplicateHandle GetFileSize CreateFileW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock SetFilePointerEx DeleteFileW QueryPerformanceFrequency WideCharToMultiByte SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetLocalTime GetSystemTime GetTickCount64 ExpandEnvironmentStringsW MoveFileExW OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry WerRegisterMemoryBlock HeapSetInformation QueryPerformanceCounter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo LoadResource LoadLibraryExW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException DecodePointer OutputDebugStringA GetShortPathNameA GetVersionExW FlsAlloc FlsGetValue FlsSetValue FlsFree

mapi32

ord75 ord19 ord11 ord21 ord23 ord49 ord50 ord17 ord140 ord13 ord36 ord42 ord135 ord139 ord15

ole32

CoCreateInstance CoInitialize StringFromGUID2 CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateStreamOnHGlobal CoAddRefServerProcess StringFromIID

oleaut32

SysStringLen SysFreeString LoadTypeLi LoadRegTypeLi SysAllocString RegisterTypeLi UnRegisterTypeLi SysAllocStringLen SafeArrayCreate SafeArrayDestroy VariantCopy SafeArrayRedim SafeArrayGetUBound SysReAllocStringLen SystemTimeToVariantTime SafeArrayGetLBound SafeArrayLock SafeArrayUnlock VariantInit SysAllocStringByteLen VariantTimeToSystemTime VarUI4FromStr VariantClear SysStringByteLen

vcruntime140

wcschr __telemetry_main_invoke_trigger wcsrchr __vcrt_InitializeCriticalSectionEx __telemetry_main_return_trigger __std_exception_destroy __std_exception_copy _set_purecall_handler memmove memset memcpy memcmp __CxxFrameHandler3 __C_specific_handler _CxxThrowException wcsstr __std_terminate

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z _Thrd_sleep ?_Xlength_error@std@@YAXPEBD@Z _Xtime_get_ticks

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn _resetstkoflw _set_invalid_parameter_handler _errno _invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

_strnicmp strncpy_s strncmp _wcsnicmp wcsncmp iswspace _wcslwr_s _wcsupr_s wcscpy_s wcscat_s wmemcpy_s wcsnlen wcsncpy_s _wcsicmp wcscspn wcsspn isdigit iswascii wcstok_s wcscmp

api-ms-win-crt-heap-l1-1-0

calloc free malloc _recalloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vsnwprintf_s fputs __stdio_common_vsprintf __acrt_iob_func

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char _configthreadlocale

rpcrt4

UuidToStringW RpcStringFreeW

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

Name

.text

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

141KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_f0c7a6f3ba31ab5f222aa6ae9601d501_mespinoza

advapi32

kernel32

mapi32

ole32

oleaut32

vcruntime140

msvcp140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

rpcrt4

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

generic