2026-08-09_7379a91bf76505d6408d6f8749f37176_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_7379a91bf76505d6408d6f8749f37176_mespinoza
Size 5.7MB
Sample260809-239pdser51
SHA256 f141f36388c1883d74996005ac061a588a0369c16990486f92759a4efaff1784
MD5 7379a91bf76505d6408d6f8749f37176
SHA1 f900a47814ea7217de27b8e4f0b650f185608471
SHA512 95fd65eb37d5fd330f77d40c863ac22cd28b3b63ac6f823ba1b869d8af808488ef8a938178d3cbfef1b99644f4f07091c3a26de664f06648a5d4bc37905a6760
SSDEEP 24576:ZSAK0ApAL+3fmChKMRBc9b6xjOkHbs8Rvi6w3y8:ZBHySbDkH+y8
TLSH
T18E56834E7807E561E81F0AF6CD11DBF0982CFCCE28969B46B88BFBBD653609159025C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_7379a91bf76505d6408d6f8749f37176_mespinoza

File Explorer

2026-08-09_7379a91bf76505d6408d6f8749f37176_mespinoza

.exe 5.7MB

2026-08-09_7379a91bf76505d6408d6f8749f37176_mespinoza

IMPHASH 07395fc7069c6a2ef328b52c0f75eb00
SHA256 f141f36388c1883d74996005ac061a588a0369c16990486f92759a4efaff1784
MD5 7379a91bf76505d6408d6f8749f37176
SHA1 f900a47814ea7217de27b8e4f0b650f185608471
SHA512 95fd65eb37d5fd330f77d40c863ac22cd28b3b63ac6f823ba1b869d8af808488ef8a938178d3cbfef1b99644f4f07091c3a26de664f06648a5d4bc37905a6760
SSDEEP 24576:ZSAK0ApAL+3fmChKMRBc9b6xjOkHbs8Rvi6w3y8:ZBHySbDkH+y8
TLSH
T18E56834E7807E561E81F0AF6CD11DBF0982CFCCE28969B46B88BFBBD653609159025C7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

242424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\click2run\x-none\officec2rclient.pdb

advapi32

RegCloseKey RegCreateKeyExW OpenProcessToken GetTokenInformation LookupAccountNameW ConvertSidToStringSidW RegOpenKeyExW RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegDeleteTreeW RegOpenKeyExA RegQueryValueExA DeregisterEventSource RegisterEventSourceW ReportEventW CreateProcessAsUserW CloseServiceHandle ControlService IsValidSid GetSidSubAuthorityCount GetSidSubAuthority StartServiceW QueryServiceStatusEx OpenServiceW OpenSCManagerW EnumDependentServicesW

gdi32

GetStockObject DeleteObject GetDeviceCaps CreateSolidBrush

ole32

CoTaskMemFree CoCreateGuid CoInitializeEx CoUninitialize CoCreateInstance PropVariantClear StringFromIID

kernel32

SystemTimeToFileTime GetTimeFormatEx GetDateFormatEx CreateProcessW GetSystemTimeAsFileTime GetModuleFileNameA GetShortPathNameA OpenProcess SystemTimeToTzSpecificLocalTime GetNativeSystemInfo MulDiv GetSystemTime ExpandEnvironmentStringsA ResetEvent LocalFree QueryActCtxW FindActCtxSectionStringW LoadLibraryExA DeactivateActCtx GetSystemInfo RaiseException OpenEventW GetLocaleInfoEx CreateThread GetSystemDefaultLCID GetUserGeoID GetExitCodeThread ProcessIdToSessionId ExpandEnvironmentStringsW SetFilePointerEx ReadFile GetTempFileNameW MoveFileExW lstrcmpW SetFileAttributesW RemoveDirectoryW GetFileAttributesExW FindNextFileW FindFirstFileW DeleteFileW GetPriorityClass GetExitCodeProcess CreateWaitableTimerW WaitForMultipleObjects GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW WaitForSingleObjectEx HeapFree HeapAlloc WerRegisterMemoryBlock VirtualProtect GetTickCount HeapSetInformation GetProcessHeap QueryPerformanceCounter ActivateActCtx CreateActCtxW LoadLibraryW LoadLibraryExW GetProcAddress GetModuleHandleExW GetModuleHandleW FreeLibrary Sleep SetErrorMode SetLastError OutputDebugStringA FindFirstFileExW FindClose LocaleNameToLCID TerminateProcess GetTimeFormatW FileTimeToSystemTime GetDriveTypeW MultiByteToWideChar VerifyVersionInfoW VerSetConditionMask GetModuleFileNameW GetCurrentThreadId GetCurrentProcessId CreateEventExW CreateMutexW SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection CloseHandle CompareStringEx IsWow64Process GetCurrentProcess GetLastError VirtualQuery

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

wer

WerReportSubmit WerReportAddDump WerReportCloseHandle WerReportCreate WerReportSetParameter

vcruntime140

__telemetry_main_invoke_trigger __vcrt_InitializeCriticalSectionEx __telemetry_main_return_trigger __std_terminate memmove _CxxThrowException __CxxFrameHandler3 memcpy memset _set_se_translator __C_specific_handler

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function terminate _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _cexit _invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

wcscpy_s towlower _stricmp isdigit wcsncpy_s wcscmp

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf_s __stdio_common_vsnwprintf_s

api-ms-win-crt-convert-l1-1-0

_wtoi64 wcstoul wcstol _wtoi _i64tow_s _ui64tow_s _itow_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale __initialize_lconv_for_unsigned_char

apiclient

?QueueUpdate@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z ?GetClickToRunData@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WK@Z ?ModifyOfficeProducts@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1111KH@Z

rpcrt4

RpcBindingFromStringBindingW RpcStringBindingComposeW RpcStringFreeW RpcMgmtIsServerListening RpcBindingSetAuthInfoW NdrClientCall2 RpcBindingFree

Name

.text

Size

469KB

Virtual Size

468KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=8, id=109, productName=VS2005 build 50727, version=50727,

count=1, id=125, productName=VS2005 build 50727, version=50727,

count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=257, version=23013,

count=2, id=259, version=23013,

count=27, id=261, version=23013,

count=12, id=260, version=23013,

count=2, id=261, version=22816,

count=2, id=260, version=22816,

count=1, id=259, version=22816,

count=1, id=245, version=40116,

count=7, id=244, version=40116,

count=27, id=239, version=40116,

count=630, id=1, productName=Unmarked objects,

count=137, id=261, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,