2026-08-08_cce155ee20401818797ec91f3c07e1f5_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_cce155ee20401818797ec91f3c07e1f5_mespinoza
Size 1.3MB
Sample260808-szh8latvez
SHA256 bade6aaaf1fb5ef850c1c0bf862f3868bbfe25fc770208b7f23c2ec7c3aef8ab
MD5 cce155ee20401818797ec91f3c07e1f5
SHA1 e4532e825c3d8174bf2359c7a0c9ad5cb281ee0e
SHA512 78f85c091ffc78e56ac0184ee1a5e506a3ee930628c2edefe131b29e155feb0ed70ebb1c5e0e26f1c930bda91a67073ca00bcbf1c963e72e569e4570b2982563
SSDEEP 12288:7wkE8iG/Zd9ms9ynwsGJppNgld5lVvYRMFlvZ1:OG/Knn4u5lkoZ1
TLSH
T18A55C541B6A80895FCAE9D7489668675FA32BD9F3D2DB30F1C50B22F1E338D05E25721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_cce155ee20401818797ec91f3c07e1f5_mespinoza

File Explorer

2026-08-08_cce155ee20401818797ec91f3c07e1f5_mespinoza

.exe 1.3MB

2026-08-08_cce155ee20401818797ec91f3c07e1f5_mespinoza

IMPHASH ee94bdd758e15acb340c359c34807497
SHA256 bade6aaaf1fb5ef850c1c0bf862f3868bbfe25fc770208b7f23c2ec7c3aef8ab
MD5 cce155ee20401818797ec91f3c07e1f5
SHA1 e4532e825c3d8174bf2359c7a0c9ad5cb281ee0e
SHA512 78f85c091ffc78e56ac0184ee1a5e506a3ee930628c2edefe131b29e155feb0ed70ebb1c5e0e26f1c930bda91a67073ca00bcbf1c963e72e569e4570b2982563
SSDEEP 12288:7wkE8iG/Zd9ms9ynwsGJppNgld5lVvYRMFlvZ1:OG/Knn4u5lkoZ1
TLSH
T18A55C541B6A80895FCAE9D7489668675FA32BD9F3D2DB30F1C50B22F1E338D05E25721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

225340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\lync\x-none\ucmapi.pdb

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW RegisterTraceGuidsW UnregisterTraceGuids GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags TraceMessage RegNotifyChangeKeyValue RegisterEventSourceW ReportEventW RegQueryValueExW StartTraceW QueryTraceW FlushTraceW ControlTraceW EnableTrace RegOpenKeyExA RegGetValueW EventRegister EventUnregister EventWriteTransfer DeregisterEventSource

kernel32

FindResourceW LoadLibraryW lstrcmpiW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW MultiByteToWideChar FindResourceExW LockResource RtlCaptureContext GetCommandLineW CloseHandle SetUnhandledExceptionFilter SetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess TerminateProcess CreateThread GetCurrentThreadId GetCurrentProcessId GetTickCount CompareStringEx GetACP FileTimeToSystemTime GetSystemTimeAsFileTime FileTimeToLocalFileTime GetModuleFileNameA SizeofResource CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer WriteFile UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateProcessW CreateMutexW ReleaseMutex DuplicateHandle GetFileSize CreateFileW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock SetFilePointerEx DeleteFileW QueryPerformanceFrequency WideCharToMultiByte SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetLocalTime GetSystemTime GetTickCount64 ExpandEnvironmentStringsW MoveFileExW OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry WerRegisterMemoryBlock HeapSetInformation QueryPerformanceCounter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo LoadResource LoadLibraryExW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException DecodePointer OutputDebugStringA GetShortPathNameA GetVersionExW FlsAlloc FlsGetValue FlsSetValue FlsFree

mapi32

ord75 ord19 ord11 ord21 ord23 ord49 ord50 ord17 ord140 ord13 ord36 ord42 ord135 ord139 ord15

ole32

CoCreateInstance CoInitialize StringFromGUID2 CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateStreamOnHGlobal CoAddRefServerProcess StringFromIID

oleaut32

SysStringLen SysFreeString LoadTypeLi LoadRegTypeLi SysAllocString RegisterTypeLi UnRegisterTypeLi SysAllocStringLen SafeArrayCreate SafeArrayDestroy VariantCopy SafeArrayRedim SafeArrayGetUBound SysReAllocStringLen SystemTimeToVariantTime SafeArrayGetLBound SafeArrayLock SafeArrayUnlock VariantInit SysAllocStringByteLen VariantTimeToSystemTime VarUI4FromStr VariantClear SysStringByteLen

vcruntime140

wcschr __telemetry_main_invoke_trigger wcsrchr __vcrt_InitializeCriticalSectionEx __telemetry_main_return_trigger __std_exception_destroy __std_exception_copy _set_purecall_handler memmove memset memcpy memcmp __CxxFrameHandler3 __C_specific_handler _CxxThrowException wcsstr __std_terminate

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z _Thrd_sleep ?_Xlength_error@std@@YAXPEBD@Z _Xtime_get_ticks

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn _resetstkoflw _set_invalid_parameter_handler _errno _invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

_strnicmp strncpy_s strncmp _wcsnicmp wcsncmp iswspace _wcslwr_s _wcsupr_s wcscpy_s wcscat_s wmemcpy_s wcsnlen wcsncpy_s _wcsicmp wcscspn wcsspn isdigit iswascii wcstok_s wcscmp

api-ms-win-crt-heap-l1-1-0

calloc free malloc _recalloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vsnwprintf_s fputs __stdio_common_vsprintf __acrt_iob_func

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char _configthreadlocale

rpcrt4

UuidToStringW RpcStringFreeW

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

Name

.text

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

141KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_cce155ee20401818797ec91f3c07e1f5_mespinoza

advapi32

kernel32

mapi32

ole32

oleaut32

vcruntime140

msvcp140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

rpcrt4

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

generic