2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza
Size 1.6MB
Sample260916-23f23sfd34
SHA256 a76ca8a6d2e9af5c38e0f71195197a502daabd006adff4d4f0bc2ce8a729f77d
MD5 288cba8b414942b2b1a4bbf1bd8c4344
SHA1 38ca55d56cf29526c1ad8688e5f4380990af00f2
SHA512 8e9d37a72e2524b91e4fcb9af5b26521bc942e46897685a55459b49b44ea682550a9492489d969e6956ee8fd01846aa7b6cbac24239d138ceaa0ea1fada3ce72
SSDEEP 24576:Cz9EOG/a+R0gXe4i7ojhsP5Lgrk1TWb4AN5:5s+1e30jaNf1TWbdz
TLSH
T14A85F131360684B5F7C643B058A9FBB954A8AE780B8085CFE3B87E3969714D31A7351F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza

File Explorer

2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza

.exe 1.6MB

2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza

IMPHASH a5793d3f750346276a5adf648c6578fc
SHA256 a76ca8a6d2e9af5c38e0f71195197a502daabd006adff4d4f0bc2ce8a729f77d
MD5 288cba8b414942b2b1a4bbf1bd8c4344
SHA1 38ca55d56cf29526c1ad8688e5f4380990af00f2
SHA512 8e9d37a72e2524b91e4fcb9af5b26521bc942e46897685a55459b49b44ea682550a9492489d969e6956ee8fd01846aa7b6cbac24239d138ceaa0ea1fada3ce72
SSDEEP 24576:Cz9EOG/a+R0gXe4i7ojhsP5Lgrk1TWb4AN5:5s+1e30jaNf1TWbdz
TLSH
T14A85F131360684B5F7C643B058A9FBB954A8AE780B8085CFE3B87E3969714D31A7351F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

125999

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\workplace\AndroidEmulator\7KMarket_Git_Release64\Basic\Client\Output\Binfinal\AppMarket\QMEmulatorService.pdb

ws2_32

htonl htons

kernel32

LockResource LoadResource FindResourceW FindResourceExW GetCurrentProcess CloseHandle CreateFileW DeviceIoControl GetTickCount WriteFile SetFilePointer ReadFile WideCharToMultiByte GetFileAttributesExW GetLogicalDrives GetDriveTypeW GetDiskFreeSpaceExW MoveFileW GetLocalTime FreeLibrary GetCurrentThreadId LoadLibraryW EnterCriticalSection LeaveCriticalSection CreateThread CreateToolhelp32Snapshot SizeofResource ProcessIdToSessionId Process32NextW OpenProcess K32EnumProcesses K32GetProcessImageFileNameW RaiseException InitializeCriticalSection GetSystemInfo GetVersionExW VirtualQuery GetSystemDefaultLangID LoadLibraryA SwitchToThread SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy Sleep DeleteFileW GetFileAttributesW GetModuleHandleW GetProcAddress GetPrivateProfileSectionW GetPrivateProfileIntW GetPrivateProfileStringW GetCommandLineW GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionEx GetLastError TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime Process32FirstW InitializeSListHead WaitForSingleObjectEx ResetEvent SetEvent OutputDebugStringW IsDebuggerPresent

advapi32

DuplicateTokenEx LookupPrivilegeValueW GetTokenInformation OpenProcessToken RegQueryValueExA RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW CreateProcessAsUserW

shell32

SHCreateDirectoryExW CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CoCreateGuid

shlwapi

PathAppendW PathRemoveFileSpecW PathFileExistsW

msvcp140

?_BADOFF@std@@3_JB ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_function_call@std@@YAXXZ _Xtime_get_ticks _Mtx_init_in_situ _Mtx_destroy_in_situ _Mtx_lock _Mtx_unlock ?_Throw_C_error@std@@YAXH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ

userenv

CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

psapi

GetProcessMemoryInfo

vcruntime140

wcsstr __std_exception_copy __std_exception_destroy memmove _purecall wcsrchr __std_terminate _CxxThrowException __CxxFrameHandler3 memcpy memset __vcrt_InitializeCriticalSectionEx _except_handler4_common

api-ms-win-crt-string-l1-1-0

wcscpy_s strnlen toupper wcsnlen _wcsupr_s _wcslwr_s wmemcpy_s _wcsicmp wcsncpy_s

api-ms-win-crt-runtime-l1-1-0

_errno _invalid_parameter_noinfo _register_thread_local_exe_atexit_callback _controlfp_s _initialize_onexit_table _register_onexit_function _crt_atexit _cexit terminate _seh_filter_exe _set_app_type _invalid_parameter_noinfo_noreturn _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _c_exit

api-ms-win-crt-heap-l1-1-0

_callnewh _recalloc malloc _set_new_mode free calloc

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-convert-l1-1-0

strtoull _wtoi strtoll strtod

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf __p__commode __stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vsprintf_s __stdio_common_vswscanf

api-ms-win-crt-math-l1-1-0

__setusermatherr _dsign _dtest

Name

.text

Size

131KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_288cba8b414942b2b1a4bbf1bd8c4344_elex_mespinoza

ws2_32

kernel32

advapi32

shell32

ole32

shlwapi

msvcp140

userenv

wtsapi32

psapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

generic