2026-09-04_92001b34db44c5569523ac89387ff8ec_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_92001b34db44c5569523ac89387ff8ec_mespinoza
Size 1.3MB
Sample260905-dx72lsdr8x
SHA256 065d0783304675bad8af98bf67bbcfc1c6d730e12ef1e8ca1618857e5d23dc54
MD5 92001b34db44c5569523ac89387ff8ec
SHA1 d731336dd3ffd94df56e743307187bb245745892
SHA512 5235fa6765a3c88e5e9735aa6494c5e202f878a4048d6a6c9bf8057a3b4d5eb449ba90c850da6656292af0317c5cf63158e32c04fb17f63d6041887dd8b77d62
SSDEEP 12288:lovNXKGJgE3vs9bwcljBBCN4ld5lVvYRMFlvZ/hki:XGJcwOt95lkoZT
TLSH
T1EA55C541B6A80895FC6E9D7489668675FA32BD9F3E2DB30E1C50B22F1F338D05E25721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_92001b34db44c5569523ac89387ff8ec_mespinoza

File Explorer

2026-09-04_92001b34db44c5569523ac89387ff8ec_mespinoza

.exe 1.3MB

2026-09-04_92001b34db44c5569523ac89387ff8ec_mespinoza

IMPHASH ee94bdd758e15acb340c359c34807497
SHA256 065d0783304675bad8af98bf67bbcfc1c6d730e12ef1e8ca1618857e5d23dc54
MD5 92001b34db44c5569523ac89387ff8ec
SHA1 d731336dd3ffd94df56e743307187bb245745892
SHA512 5235fa6765a3c88e5e9735aa6494c5e202f878a4048d6a6c9bf8057a3b4d5eb449ba90c850da6656292af0317c5cf63158e32c04fb17f63d6041887dd8b77d62
SSDEEP 12288:lovNXKGJgE3vs9bwcljBBCN4ld5lVvYRMFlvZ/hki:XGJcwOt95lkoZT
TLSH
T1EA55C541B6A80895FC6E9D7489668675FA32BD9F3E2DB30E1C50B22F1F338D05E25721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

225340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\Target\x64\ship\lync\x-none\ucmapi.pdb

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW RegisterTraceGuidsW UnregisterTraceGuids GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags TraceMessage RegNotifyChangeKeyValue RegisterEventSourceW ReportEventW RegQueryValueExW StartTraceW QueryTraceW FlushTraceW ControlTraceW EnableTrace RegOpenKeyExA RegGetValueW EventRegister EventUnregister EventWriteTransfer DeregisterEventSource

kernel32

FindResourceW LoadLibraryW lstrcmpiW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW MultiByteToWideChar FindResourceExW LockResource RtlCaptureContext GetCommandLineW CloseHandle SetUnhandledExceptionFilter SetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess TerminateProcess CreateThread GetCurrentThreadId GetCurrentProcessId GetTickCount CompareStringEx GetACP FileTimeToSystemTime GetSystemTimeAsFileTime FileTimeToLocalFileTime GetModuleFileNameA SizeofResource CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer WriteFile UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateProcessW CreateMutexW ReleaseMutex DuplicateHandle GetFileSize CreateFileW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock SetFilePointerEx DeleteFileW QueryPerformanceFrequency WideCharToMultiByte SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetLocalTime GetSystemTime GetTickCount64 ExpandEnvironmentStringsW MoveFileExW OutputDebugStringW GetStartupInfoW IsDebuggerPresent InitializeSListHead WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry WerRegisterMemoryBlock HeapSetInformation QueryPerformanceCounter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo LoadResource LoadLibraryExW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException DecodePointer OutputDebugStringA GetShortPathNameA GetVersionExW FlsAlloc FlsGetValue FlsSetValue FlsFree

mapi32

ord75 ord19 ord11 ord21 ord23 ord49 ord50 ord17 ord140 ord13 ord36 ord42 ord135 ord139 ord15

ole32

CoCreateInstance CoInitialize StringFromGUID2 CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateStreamOnHGlobal CoAddRefServerProcess StringFromIID

oleaut32

SysStringLen SysFreeString LoadTypeLi LoadRegTypeLi SysAllocString RegisterTypeLi UnRegisterTypeLi SysAllocStringLen SafeArrayCreate SafeArrayDestroy VariantCopy SafeArrayRedim SafeArrayGetUBound SysReAllocStringLen SystemTimeToVariantTime SafeArrayGetLBound SafeArrayLock SafeArrayUnlock VariantInit SysAllocStringByteLen VariantTimeToSystemTime VarUI4FromStr VariantClear SysStringByteLen

vcruntime140

wcschr __telemetry_main_invoke_trigger wcsrchr __vcrt_InitializeCriticalSectionEx __telemetry_main_return_trigger __std_exception_destroy __std_exception_copy _set_purecall_handler memmove memset memcpy memcmp __CxxFrameHandler3 __C_specific_handler _CxxThrowException wcsstr __std_terminate

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z _Thrd_sleep ?_Xlength_error@std@@YAXPEBD@Z _Xtime_get_ticks

api-ms-win-crt-runtime-l1-1-0

terminate _initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _invalid_parameter_noinfo_noreturn _resetstkoflw _set_invalid_parameter_handler _errno _invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

_strnicmp strncpy_s strncmp _wcsnicmp wcsncmp iswspace _wcslwr_s _wcsupr_s wcscpy_s wcscat_s wmemcpy_s wcsnlen wcsncpy_s _wcsicmp wcscspn wcsspn isdigit iswascii wcstok_s wcscmp

api-ms-win-crt-heap-l1-1-0

calloc free malloc _recalloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vsnwprintf_s fputs __stdio_common_vsprintf __acrt_iob_func

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char _configthreadlocale

rpcrt4

UuidToStringW RpcStringFreeW

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-multibyte-l1-1-0

_mbsstr

Name

.text

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

141KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_92001b34db44c5569523ac89387ff8ec_mespinoza

advapi32

kernel32

mapi32

ole32

oleaut32

vcruntime140

msvcp140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

rpcrt4

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

generic