2026-08-09_8e2624e89fd7f7c6ed4e7169dde7d87b_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_8e2624e89fd7f7c6ed4e7169dde7d87b_mespinoza
Size 10.4MB
Sample260809-jmdynstbpe
SHA256 31b49327d2f28119119b44cf6ee3053c01683bf79772a61d3ce27e48e17872e1
MD5 8e2624e89fd7f7c6ed4e7169dde7d87b
SHA1 45bc1bb76f40c7162f2154f23ff586cd88c67b0b
SHA512 4cf3b2c6bbdb5418c6cdede02c13c8d41351ada67248a138dd357b664dcc211fcd807c27c6eb9e54a35a2f9d491400bc35087666754c0f318bf8871c9d932e22
SSDEEP 196608:/wdnBzAUhup3rM/i/QU7L0SH3nB3qX7mngecAXzmK7A2Vf9Ii1u:4TAfxrciIU7L0SXnB3c7WgermCfVOi1u
TLSH
T1B2B6338679D695BDD597CA36D1940BF9FD4038C0FCBA242B6FC2971D29709A2CF80728
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_8e2624e89fd7f7c6ed4e7169dde7d87b_mespinoza

File Explorer

2026-08-09_8e2624e89fd7f7c6ed4e7169dde7d87b_mespinoza

.exe 10.4MB

2026-08-09_8e2624e89fd7f7c6ed4e7169dde7d87b_mespinoza

IMPHASH 66d2fe74d96fe2c9d13e9164597a0d7d
SHA256 31b49327d2f28119119b44cf6ee3053c01683bf79772a61d3ce27e48e17872e1
MD5 8e2624e89fd7f7c6ed4e7169dde7d87b
SHA1 45bc1bb76f40c7162f2154f23ff586cd88c67b0b
SHA512 4cf3b2c6bbdb5418c6cdede02c13c8d41351ada67248a138dd357b664dcc211fcd807c27c6eb9e54a35a2f9d491400bc35087666754c0f318bf8871c9d932e22
SSDEEP 196608:/wdnBzAUhup3rM/i/QU7L0SH3nB3qX7mngecAXzmK7A2Vf9Ii1u:4TAfxrciIU7L0SXnB3c7WgermCfVOi1u
TLSH
T1B2B6338679D695BDD597CA36D1940BF9FD4038C0FCBA242B6FC2971D29709A2CF80728
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9215265

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\workspace\metatrader5\Build\Installers\Distributive Core\Release64\core.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl DosDateTimeToFileTime EncodePointer EnterCriticalSection EnumResourceNamesW EnumSystemLocalesW ExitProcess ExitThread FileTimeToDosDateTime FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetActiveProcessorCount GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileSize GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetTickCount64 GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultUILanguage GetVersionExW GetVolumeInformationW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetProcessImageFileNameW K32GetProcessMemoryInfo LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess OpenThread OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFileAttributesW SetFilePointer SetFilePointerEx SetLastError SetStdHandle SetThreadStackGuarantee SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SuspendThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread Thread32First Thread32Next UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW lstrcmpiW lstrlenW

user32

BeginPaint BringWindowToTop CallWindowProcW CharLowerW CharNextW CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DrawFocusRect DrawTextW EnableWindow EndDialog EndPaint FillRect GetActiveWindow GetCapture GetClassInfoExW GetClassNameW GetClientRect GetCursorPos GetDC GetDlgCtrlID GetDlgItem GetFocus GetMonitorInfoW GetParent GetSysColor GetSystemMetrics GetTopWindow GetWindow GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InvalidateRect IsWindow IsWindowEnabled IsWindowVisible KillTimer LoadBitmapW LoadCursorW LoadIconW LoadImageW LoadStringW MapWindowPoints MessageBeep MessageBoxW MonitorFromWindow MoveWindow OffsetRect PostMessageA PostMessageW PostQuitMessage PtInRect RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SendMessageW SetCapture SetClassLongPtrW SetCursor SetFocus SetForegroundWindow SetRectEmpty SetTimer SetWindowLongPtrW SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackMouseEvent UnregisterClassW UpdateWindow

shell32

SHBrowseForFolderW SHChangeNotify SHGetFileInfoW SHGetFolderPathW SHGetKnownFolderPath SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetSpecialFolderPathW ShellExecuteExW ShellExecuteW

advapi32

AllocateAndInitializeSid CloseServiceHandle ControlService EnumServicesStatusW EqualSid FreeSid GetAce GetAclInformation GetFileSecurityW GetSecurityDescriptorDacl GetTokenInformation OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatus RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegQueryValueW RegSetValueExW SetEntriesInAclW SetNamedSecurityInfoW

ws2_32

FreeAddrInfoW GetAddrInfoW InetNtopW InetPtonW WSACleanup WSAConnect WSAGetLastError WSARecv WSASend WSASocketW WSAStartup bind closesocket htonl htons ioctlsocket ntohl recv select send setsockopt shutdown

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBitmap CreateFontIndirectW CreateFontW CreateSolidBrush DeleteDC DeleteObject EnumFontFamiliesExW ExtTextOutW GetDIBits GetObjectW GetStockObject GetTextExtentPoint32W RestoreDC SaveDC SelectObject SetBkColor SetBkMode SetTextColor TextOutW

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUninitialize CreateStreamOnHGlobal

oleaut32

SysAllocString SysFreeString VarUI4FromStr VariantClear

crypt32

CertGetNameStringW

shlwapi

PathCanonicalizeW PathFindExtensionW

comctl32

CreatePropertySheetPageW DestroyPropertySheetPage ImageList_AddMasked ImageList_Create ImageList_Destroy ImageList_Draw ImageList_GetImageCount ImageList_GetImageInfo ImageList_SetBkColor InitCommonControlsEx PropertySheetW

iphlpapi

GetAdaptersAddresses GetAdaptersInfo SendARP

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipFree GdiplusShutdown GdiplusStartup

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust

bcrypt

BCryptGenRandom

Name

.text

Size

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

679KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

25B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cod0

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.cod1

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cod2

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

155KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_8e2624e89fd7f7c6ed4e7169dde7d87b_mespinoza

kernel32

user32

shell32

advapi32

ws2_32

gdi32

ole32

oleaut32

crypt32

shlwapi

comctl32

iphlpapi

gdiplus

wintrust

bcrypt

generic