2026-08-30_73d70fc0f136505242a6443e73799272_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-30_73d70fc0f136505242a6443e73799272_mespinoza
Size 1.3MB
Sample260831-lnhpcsff88
SHA256 21a022c627766ba867285acddf7cb379ee61e6692a4f8a2849da00e035e211cd
MD5 73d70fc0f136505242a6443e73799272
SHA1 65d912c2ac3b1b219d657b0529a631710bea5498
SHA512 7f41ead7ff7984997c7fdf946c7139b39e8b6390f9b5d0974c5dba503c9063c4f99a6b61ae7aaafc5266b747e611b601ec1e73958e58f7b7fe4c6b55ecca2939
SSDEEP 12288:MTW/0CGnkiQGs9vx9xmCjFNcld5lVvYRMFlvZDBCe:LGnOxTvo5lkoZDBCe
TLSH
T12F55C441B6A80895FCAE9D7489668675FA32BD9F3D2DB30B1C50B22F1F338D05E25721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_73d70fc0f136505242a6443e73799272_mespinoza

File Explorer

2026-08-30_73d70fc0f136505242a6443e73799272_mespinoza

.exe 1.3MB

2026-08-30_73d70fc0f136505242a6443e73799272_mespinoza

IMPHASH ee94bdd758e15acb340c359c34807497
SHA256 21a022c627766ba867285acddf7cb379ee61e6692a4f8a2849da00e035e211cd
MD5 73d70fc0f136505242a6443e73799272
SHA1 65d912c2ac3b1b219d657b0529a631710bea5498
SHA512 7f41ead7ff7984997c7fdf946c7139b39e8b6390f9b5d0974c5dba503c9063c4f99a6b61ae7aaafc5266b747e611b601ec1e73958e58f7b7fe4c6b55ecca2939
SSDEEP 12288:MTW/0CGnkiQGs9vx9xmCjFNcld5lVvYRMFlvZDBCe:LGnOxTvo5lkoZDBCe
TLSH
T12F55C441B6A80895FCAE9D7489668675FA32BD9F3D2DB30B1C50B22F1F338D05E25721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

225340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\lync\x-none\ucmapi.pdb

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW RegisterTraceGuidsW UnregisterTraceGuids GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags TraceMessage RegNotifyChangeKeyValue RegisterEventSourceW ReportEventW RegQueryValueExW StartTraceW QueryTraceW FlushTraceW ControlTraceW EnableTrace RegOpenKeyExA RegGetValueW EventRegister EventUnregister EventWriteTransfer DeregisterEventSource

kernel32

FindResourceW LoadLibraryW lstrcmpiW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW MultiByteToWideChar FindResourceExW LockResource RtlCaptureContext GetCommandLineW CloseHandle SetUnhandledExceptionFilter SetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess TerminateProcess CreateThread GetCurrentThreadId GetCurrentProcessId GetTickCount CompareStringEx GetACP FileTimeToSystemTime GetSystemTimeAsFileTime FileTimeToLocalFileTime GetModuleFileNameA SizeofResource CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer WriteFile UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateProcessW CreateMutexW ReleaseMutex DuplicateHandle GetFileSize CreateFileW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock SetFilePointerEx DeleteFileW QueryPerformanceFrequency WideCharToMultiByte SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetLocalTime GetSystemTime GetTickCount64 ExpandEnvironmentStringsW MoveFileExW OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry WerRegisterMemoryBlock HeapSetInformation QueryPerformanceCounter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo LoadResource LoadLibraryExW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException DecodePointer OutputDebugStringA GetShortPathNameA GetVersionExW FlsAlloc FlsGetValue FlsSetValue FlsFree

mapi32

ord75 ord19 ord11 ord21 ord23 ord49 ord50 ord17 ord140 ord13 ord36 ord42 ord135 ord139 ord15

ole32

CoCreateInstance CoInitialize StringFromGUID2 CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateStreamOnHGlobal CoAddRefServerProcess StringFromIID

oleaut32

SysStringLen SysFreeString LoadTypeLi LoadRegTypeLi SysAllocString RegisterTypeLi UnRegisterTypeLi SysAllocStringLen SafeArrayCreate SafeArrayDestroy VariantCopy SafeArrayRedim SafeArrayGetUBound SysReAllocStringLen SystemTimeToVariantTime SafeArrayGetLBound SafeArrayLock SafeArrayUnlock VariantInit SysAllocStringByteLen VariantTimeToSystemTime VarUI4FromStr VariantClear SysStringByteLen

vcruntime140

wcschr __telemetry_main_invoke_trigger wcsrchr __vcrt_InitializeCriticalSectionEx __telemetry_main_return_trigger __std_exception_destroy __std_exception_copy _set_purecall_handler memmove memset memcpy memcmp __CxxFrameHandler3 __C_specific_handler _CxxThrowException wcsstr __std_terminate

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z _Thrd_sleep ?_Xlength_error@std@@YAXPEBD@Z _Xtime_get_ticks

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn _resetstkoflw _set_invalid_parameter_handler _errno _invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

_strnicmp strncpy_s strncmp _wcsnicmp wcsncmp iswspace _wcslwr_s _wcsupr_s wcscpy_s wcscat_s wmemcpy_s wcsnlen wcsncpy_s _wcsicmp wcscspn wcsspn isdigit iswascii wcstok_s wcscmp

api-ms-win-crt-heap-l1-1-0

calloc free malloc _recalloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vsnwprintf_s fputs __stdio_common_vsprintf __acrt_iob_func

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char _configthreadlocale

rpcrt4

UuidToStringW RpcStringFreeW

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

Name

.text

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

141KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-30_73d70fc0f136505242a6443e73799272_mespinoza

advapi32

kernel32

mapi32

ole32

oleaut32

vcruntime140

msvcp140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

rpcrt4

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

generic