2026-08-20_5588c1b132c0faf81344d49d2bc7cfef_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_5588c1b132c0faf81344d49d2bc7cfef_mespinoza
Size 1.4MB
Sample260820-wfx47aserc
SHA256 baa440aa7ff9c70e233801a40e6c849030f31f9988f4771651c59279c4b4176d
MD5 5588c1b132c0faf81344d49d2bc7cfef
SHA1 187afc880f011374138b7285dd47adfecf471332
SHA512 3e9acf73ebbfe5340e4d7681f9ceddc16651c087c41186e70cef353ad62318e3fddae2a0b28ebfbd5c22dd5aa5b606f5d80580e29fee7688fb668c9eb0283e24
SSDEEP 24576:MzAA254QToaJv0h9DJqZR/TdMnfhLCfHLHUvB60yM/0s+1Krl:qAA254QTvJv0h91qZR/RSfhLCfYvBHys
TLSH
T1C6659E167BF841E4E17691398EA2C696F6B2B8512F30C7CF1160432E2F37AD58D79B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_5588c1b132c0faf81344d49d2bc7cfef_mespinoza

File Explorer

2026-08-20_5588c1b132c0faf81344d49d2bc7cfef_mespinoza

.exe 1.4MB

2026-08-20_5588c1b132c0faf81344d49d2bc7cfef_mespinoza

IMPHASH 1118fc4bd988c7c03f9c6bb402941202
SHA256 baa440aa7ff9c70e233801a40e6c849030f31f9988f4771651c59279c4b4176d
MD5 5588c1b132c0faf81344d49d2bc7cfef
SHA1 187afc880f011374138b7285dd47adfecf471332
SHA512 3e9acf73ebbfe5340e4d7681f9ceddc16651c087c41186e70cef353ad62318e3fddae2a0b28ebfbd5c22dd5aa5b606f5d80580e29fee7688fb668c9eb0283e24
SSDEEP 24576:MzAA254QToaJv0h9DJqZR/TdMnfhLCfHLHUvB60yM/0s+1Krl:qAA254QTvJv0h91qZR/RSfhLCfYvBHys
TLSH
T1C6659E167BF841E4E17691398EA2C696F6B2B8512F30C7CF1160432E2F37AD58D79B21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

432456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\proj_20190520_RtkAudUService_HuiWei_DontRestoreDefVol\20190520_modify\Release\x64\RtkAudUService64.pdb

oleaut32

SafeArrayAccessData SafeArrayUnaccessData SysAllocStringLen SafeArrayPutElement SafeArrayCreateVector SysAllocString LPSAFEARRAY_UserMarshal BSTR_UserMarshal SysFreeString BSTR_UserUnmarshal LPSAFEARRAY_UserFree LPSAFEARRAY_UserUnmarshal LPSAFEARRAY_UserSize BSTR_UserFree VariantInit VariantCopy BSTR_UserSize VariantClear

rpcrt4

NdrClientCall2 NdrServerCall2 RpcEpUnregister RpcServerUseProtseqEpW RpcServerRegisterIf3 RpcServerInqBindings RpcEpRegisterW RpcServerListen RpcServerUnregisterIf RpcBindingVectorFree

api-ms-win-core-com-l1-1-0

CoInitializeEx CoUninitialize CLSIDFromString CoFreeUnusedLibrariesEx CoCreateInstance PropVariantClear CoTaskMemFree CoSetProxyBlanket StringFromGUID2 CoInitializeSecurity

api-ms-win-core-heap-l1-1-0

HeapSize HeapReAlloc HeapDestroy HeapFree HeapAlloc GetProcessHeap

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW lstrcmpW

api-ms-win-core-file-l1-1-0

GetFileAttributesW CreateFileW DeleteFileW QueryDosDeviceW FileTimeToLocalFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW GetModuleHandleW LockResource LoadResource GetProcAddress FindResourceExW GetModuleHandleA GetModuleFileNameW LoadStringW FreeLibrary SizeofResource

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx WaitForSingleObjectEx InitializeCriticalSection DeleteCriticalSection WaitForSingleObject CreateMutexW EnterCriticalSection InitializeCriticalSectionAndSpinCount CreateEventW LeaveCriticalSection TryEnterCriticalSection ResetEvent CreateEventExW SetEvent CancelWaitableTimer SetWaitableTimer

api-ms-win-core-libraryloader-l1-2-1

FindResourceW LoadLibraryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar GetStringTypeW WideCharToMultiByte

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken ProcessIdToSessionId CreateProcessW GetCurrentThreadId GetCurrentProcess CreateThread CreateProcessAsUserW TlsFree TlsSetValue TlsGetValue GetCurrentProcessId TlsAlloc TerminateProcess GetStartupInfoW GetExitCodeProcess

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-debug-l1-1-0

OutputDebugStringW OutputDebugStringA IsDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegGetValueW RegSetKeySecurity RegNotifyChangeKeyValue RegOpenKeyExW RegDeleteValueW RegCloseKey RegGetKeySecurity RegSetValueExW RegEnumValueW RegQueryValueExW RegCreateKeyExW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-0

SetLastError GetLastError UnhandledExceptionFilter RaiseException SetUnhandledExceptionFilter

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetFolderPathW SHGetSpecialFolderPathW

api-ms-win-core-privateprofile-l1-1-0

GetProfileIntW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemDirectoryW GetLocalTime GetSystemTimeAsFileTime

api-ms-win-core-registry-l2-1-0

RegCreateKeyW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-localization-l1-2-0

LCMapStringW FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects CreateWaitableTimerW

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus WTSGetActiveConsoleSessionId

api-ms-win-security-base-l1-1-0

FreeSid AllocateAndInitializeSid AddAce GetAce AddAccessAllowedAceEx InitializeAcl GetLengthSid AdjustTokenPrivileges SetTokenInformation DuplicateTokenEx GetAclInformation CreateWellKnownSid GetSecurityDescriptorDacl InitializeSecurityDescriptor SetSecurityDescriptorDacl

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

bcrypt

BCryptCloseAlgorithmProvider BCryptEncrypt BCryptImportKeyPair BCryptDestroyKey BCryptOpenAlgorithmProvider

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW

api-ms-win-service-management-l1-1-0

OpenSCManagerW DeleteService CreateServiceW OpenServiceW CloseServiceHandle

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus ControlService

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW K32GetModuleBaseNameW K32EnumProcessModules K32EnumProcesses

api-ms-win-appmodel-runtime-l1-1-1

FindPackagesByPackageFamily

api-ms-win-mm-misc-l1-1-0

mmioRead mmioSetInfo mmioAdvance mmioSeek mmioGetInfo mmioCreateChunk mmioOpenW mmioDescend mmioClose mmioAscend mmioWrite

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32NextW Process32FirstW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

userenv

CreateEnvironmentBlock

api-ms-win-core-memory-l1-1-0

ReadProcessMemory

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork SubmitThreadpoolWork

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle TraceMessage RegisterTraceGuidsW

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInstanceIdW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDevicePropertyW

wtsapi32

WTSQueryUserToken WTSRegisterSessionNotification

kernel32

WinExec WriteProfileStringW

user32

SendMessageW SetWinEventHook FindWindowExW GetClassNameA SetTimer ShowWindow UnhookWinEvent CreateWindowExW LoadCursorW LoadIconW DefWindowProcW SendInput GetMessageW TranslateMessage DispatchMessageW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx UnregisterDeviceNotification RegisterDeviceNotificationW KillTimer RegisterClassW

advapi32

GetUserNameW ReportEventW DeregisterEventSource RegisterEventSourceW

ole32

CoInitialize

avrt

AvSetMmThreadCharacteristicsW AvRevertMmThreadCharacteristics

ntdll

NtQueryInformationProcess

oleacc

AccessibleObjectFromEvent

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetOpenUrlW

api-ms-win-crt-runtime-l1-1-0

abort exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _register_thread_local_exe_atexit_callback _seh_filter_exe _invalid_parameter_noinfo _initialize_onexit_table _register_onexit_function _crt_atexit _c_exit _errno _cexit _exit _invalid_parameter_noinfo_noreturn terminate

api-ms-win-crt-string-l1-1-0

_wcsupr_s strcpy_s wcscpy_s _wcsdup isupper islower wcstok_s _wcsicmp wmemcpy_s iswspace wcscat_s wcsnlen wcsncmp towupper strcspn __strncnt strcmp

api-ms-win-crt-stdio-l1-1-0

fputws ungetwc _set_fmode fputwc fflush __acrt_iob_func __stdio_common_vfwprintf __stdio_common_vfprintf_s __stdio_common_vfprintf fgetwc fputs __stdio_common_vswprintf __p__commode __stdio_common_vswprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_s _flushall fwrite _wfopen_s _wfsopen ungetc setvbuf _fseeki64 fsetpos fputc fgetpos fgetc _get_stream_buffer_pointers fseek fgets fclose

api-ms-win-crt-heap-l1-1-0

calloc _malloc_base free _callnewh malloc _recalloc realloc _set_new_mode _free_base _calloc_base

api-ms-win-crt-convert-l1-1-0

wcstol wcstoul _wtoi

api-ms-win-crt-math-l1-1-0

powf frexp __setusermatherr asinf atan2f log10f

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func __pctype_func ___lc_codepage_func ___mb_cur_max_func _lock_locales _unlock_locales _configthreadlocale setlocale localeconv

api-ms-win-crt-multibyte-l1-1-0

_mbschr _ismbblead _mbsstr

shlwapi

PathFileExistsW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind RtlUnwindEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

Name

.text

Size

479KB

Virtual Size

478KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

281KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_5588c1b132c0faf81344d49d2bc7cfef_mespinoza

oleaut32

rpcrt4

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-security-base-l1-2-2

api-ms-win-security-provider-l1-1-0

api-ms-win-core-registry-l1-1-1

bcrypt

api-ms-win-service-core-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-appmodel-runtime-l1-1-1

api-ms-win-mm-misc-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

userenv

api-ms-win-core-memory-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-classicprovider-l1-1-0

setupapi

wtsapi32

kernel32

user32

advapi32

ole32

avrt

ntdll

oleacc

wininet

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

shlwapi

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic