2026-08-09_80b4e6afce69ddbc41778568f585d1e0_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_80b4e6afce69ddbc41778568f585d1e0_mespinoza
Size 5.7MB
Sample260809-23frbazzg1
SHA256 a15107230079501121bac5e0ede75824f229575fa23252798f10270efda0d436
MD5 80b4e6afce69ddbc41778568f585d1e0
SHA1 daf307bd11530811edf890035e4db860789ea1a8
SHA512 e928f26064381f45a09d36ccc80de336aadcb908dceca2709fbd16d236f8305a53f74b478820f41c21fd383fa4998008550361b705d159aa093de9ec5eb59a2a
SSDEEP 24576:ZSAK0ApAL+3fmChKMRBc9b6xjOkHes8R1i6w3y8:ZBHySbDkHpy8
TLSH
T1E756834E7807E561E81F0AF6CD11DBF0982CFCCE28969B46B88BFBBD653609159025C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_80b4e6afce69ddbc41778568f585d1e0_mespinoza

File Explorer

2026-08-09_80b4e6afce69ddbc41778568f585d1e0_mespinoza

.exe 5.7MB

2026-08-09_80b4e6afce69ddbc41778568f585d1e0_mespinoza

IMPHASH 07395fc7069c6a2ef328b52c0f75eb00
SHA256 a15107230079501121bac5e0ede75824f229575fa23252798f10270efda0d436
MD5 80b4e6afce69ddbc41778568f585d1e0
SHA1 daf307bd11530811edf890035e4db860789ea1a8
SHA512 e928f26064381f45a09d36ccc80de336aadcb908dceca2709fbd16d236f8305a53f74b478820f41c21fd383fa4998008550361b705d159aa093de9ec5eb59a2a
SSDEEP 24576:ZSAK0ApAL+3fmChKMRBc9b6xjOkHes8R1i6w3y8:ZBHySbDkHpy8
TLSH
T1E756834E7807E561E81F0AF6CD11DBF0982CFCCE28969B46B88BFBBD653609159025C7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

242424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\click2run\x-none\officec2rclient.pdb

advapi32

RegCloseKey RegCreateKeyExW OpenProcessToken GetTokenInformation LookupAccountNameW ConvertSidToStringSidW RegOpenKeyExW RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegDeleteTreeW RegOpenKeyExA RegQueryValueExA DeregisterEventSource RegisterEventSourceW ReportEventW CreateProcessAsUserW CloseServiceHandle ControlService IsValidSid GetSidSubAuthorityCount GetSidSubAuthority StartServiceW QueryServiceStatusEx OpenServiceW OpenSCManagerW EnumDependentServicesW

gdi32

GetStockObject DeleteObject GetDeviceCaps CreateSolidBrush

ole32

CoTaskMemFree CoCreateGuid CoInitializeEx CoUninitialize CoCreateInstance PropVariantClear StringFromIID

kernel32

SystemTimeToFileTime GetTimeFormatEx GetDateFormatEx CreateProcessW GetSystemTimeAsFileTime GetModuleFileNameA GetShortPathNameA OpenProcess SystemTimeToTzSpecificLocalTime GetNativeSystemInfo MulDiv GetSystemTime ExpandEnvironmentStringsA ResetEvent LocalFree QueryActCtxW FindActCtxSectionStringW LoadLibraryExA DeactivateActCtx GetSystemInfo RaiseException OpenEventW GetLocaleInfoEx CreateThread GetSystemDefaultLCID GetUserGeoID GetExitCodeThread ProcessIdToSessionId ExpandEnvironmentStringsW SetFilePointerEx ReadFile GetTempFileNameW MoveFileExW lstrcmpW SetFileAttributesW RemoveDirectoryW GetFileAttributesExW FindNextFileW FindFirstFileW DeleteFileW GetPriorityClass GetExitCodeProcess CreateWaitableTimerW WaitForMultipleObjects GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW WaitForSingleObjectEx HeapFree HeapAlloc WerRegisterMemoryBlock VirtualProtect GetTickCount HeapSetInformation GetProcessHeap QueryPerformanceCounter ActivateActCtx CreateActCtxW LoadLibraryW LoadLibraryExW GetProcAddress GetModuleHandleExW GetModuleHandleW FreeLibrary Sleep SetErrorMode SetLastError OutputDebugStringA FindFirstFileExW FindClose LocaleNameToLCID TerminateProcess GetTimeFormatW FileTimeToSystemTime GetDriveTypeW MultiByteToWideChar VerifyVersionInfoW VerSetConditionMask GetModuleFileNameW GetCurrentThreadId GetCurrentProcessId CreateEventExW CreateMutexW SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection CloseHandle CompareStringEx IsWow64Process GetCurrentProcess GetLastError VirtualQuery

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

wer

WerReportSubmit WerReportAddDump WerReportCloseHandle WerReportCreate WerReportSetParameter

vcruntime140

__telemetry_main_invoke_trigger __vcrt_InitializeCriticalSectionEx __telemetry_main_return_trigger __std_terminate memmove _CxxThrowException __CxxFrameHandler3 memcpy memset _set_se_translator __C_specific_handler

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function terminate _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _cexit _invalid_parameter_noinfo_noreturn

api-ms-win-crt-string-l1-1-0

wcscpy_s towlower _stricmp isdigit wcsncpy_s wcscmp

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf_s __stdio_common_vsnwprintf_s

api-ms-win-crt-convert-l1-1-0

_wtoi64 wcstoul wcstol _wtoi _i64tow_s _ui64tow_s _itow_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale __initialize_lconv_for_unsigned_char

apiclient

?QueueUpdate@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W@Z ?GetClickToRunData@@YAJV?$shared_ptr@VORpcClient@@@std@@HPEB_WPEA_WK@Z ?ModifyOfficeProducts@@YAJV?$shared_ptr@VORpcClient@@@std@@PEB_W1111KH@Z

rpcrt4

RpcBindingFromStringBindingW RpcStringBindingComposeW RpcStringFreeW RpcMgmtIsServerListening RpcBindingSetAuthInfoW NdrClientCall2 RpcBindingFree

Name

.text

Size

469KB

Virtual Size

468KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=8, id=109, productName=VS2005 build 50727, version=50727,

count=1, id=125, productName=VS2005 build 50727, version=50727,

count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=257, version=23013,

count=2, id=259, version=23013,

count=27, id=261, version=23013,

count=12, id=260, version=23013,

count=2, id=261, version=22816,

count=2, id=260, version=22816,

count=1, id=259, version=22816,

count=1, id=245, version=40116,

count=7, id=244, version=40116,

count=27, id=239, version=40116,

count=630, id=1, productName=Unmarked objects,

count=137, id=261, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,