2026-08-09_eb0bd301872e5f7e78711c2ba929bf9e_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_eb0bd301872e5f7e78711c2ba929bf9e_mespinoza
Size 481KB
Sample260809-lp174acq7t
SHA256 ae42a69361e2067ce0496fdf703d93dbb965d90b1fc6dea9b74753cd3986974d
MD5 eb0bd301872e5f7e78711c2ba929bf9e
SHA1 2e9994283eaeb34ecc1bf810f7f185eb7fe19923
SHA512 25b4ed2bfff9db068409cde86aca6db0c6e13924823caea6aaf01fc6b391379228987e783608eaf4022ce59cb6e18386ebb15959f2900218daef420f2f6afb6f
SSDEEP 12288:k0b03OXFHHzTU3i1eiYchubHudCWCyDbn9MsS4B:k0b03OXFHHzTU3i1eiYchgOdDnbnxS4B
TLSH
T11FA4960C7E0D9C6EE048CCB0974B4B93596031CB16B6B9ABC7C668722E6F67C5F36605
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_eb0bd301872e5f7e78711c2ba929bf9e_mespinoza

File Explorer

2026-08-09_eb0bd301872e5f7e78711c2ba929bf9e_mespinoza

.exe 481KB

2026-08-09_eb0bd301872e5f7e78711c2ba929bf9e_mespinoza

IMPHASH 66769ebd5be099b2eff28f401d14a661
SHA256 ae42a69361e2067ce0496fdf703d93dbb965d90b1fc6dea9b74753cd3986974d
MD5 eb0bd301872e5f7e78711c2ba929bf9e
SHA1 2e9994283eaeb34ecc1bf810f7f185eb7fe19923
SHA512 25b4ed2bfff9db068409cde86aca6db0c6e13924823caea6aaf01fc6b391379228987e783608eaf4022ce59cb6e18386ebb15959f2900218daef420f2f6afb6f
SSDEEP 12288:k0b03OXFHHzTU3i1eiYchubHudCWCyDbn9MsS4B:k0b03OXFHHzTU3i1eiYchgOdDnbnxS4B
TLSH
T11FA4960C7E0D9C6EE048CCB0974B4B93596031CB16B6B9ABC7C668722E6F67C5F36605
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

346176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

user32

CloseClipboard CloseDesktop GetClipboardData GetKeyboardLayoutList OpenClipboard

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize StringFromGUID2

oleaut32

SysAllocStringByteLen SysFreeString SysStringByteLen

ws2_32

ntohl ntohs

shell32

SHGetFolderPathW

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1ios_base@std@@UEAA@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?fail@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

kernel32

AcquireSRWLockExclusive CloseHandle CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW DeleteProcThreadAttributeList ExitProcess FindClose FindFirstFileW FindNextFileW FreeConsole GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDynamicTimeZoneInformation GetFileAttributesW GetFileSize GetFileSizeEx GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetSystemDefaultUILanguage GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetTickCount64 GetUserDefaultUILanguage GetUserPreferredUILanguages GetVersionExW GlobalLock GlobalUnlock HeapAlloc HeapFree InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LoadLibraryA LocalFree MoveFileExW MultiByteToWideChar QueryPerformanceCounter ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResumeThread SetFileAttributesW SetUnhandledExceptionFilter SleepConditionVariableSRW SuspendThread TerminateProcess TerminateThread UnhandledExceptionFilter UpdateProcThreadAttribute WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteFile

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate memcmp memcpy memmove memset

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf __stdio_common_vswprintf_s _set_fmode

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _invoke_watson _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-string-l1-1-0

_wcsicmp isalnum isalpha isxdigit strlen towlower wcscmp wcslen

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

339KB

Virtual Size

339KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_eb0bd301872e5f7e78711c2ba929bf9e_mespinoza

bcrypt

user32

ole32

oleaut32

ws2_32

shell32

msvcp140

ntdll

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic