2026-11-01_bda7e043b367cbf86d8d9b0d2a7ab5d3_amadey_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_bda7e043b367cbf86d8d9b0d2a7ab5d3_amadey_mespinoza
Size 762KB
Sample261102-l5vp9agy21
SHA256 cd86aea4c370f4f755ddda5e9f046936ec161a8fb75d43e7167b707938213e89
MD5 bda7e043b367cbf86d8d9b0d2a7ab5d3
SHA1 6a102c525186f8d6e7f1ad18d29efce7ad49eaeb
SHA512 fb967fa6baca4f782a0d070bee7836845d51e1837bcc01829a3ed7973ef153b4b591cb00636d7982d0758dad3c4e1d3520c62e9edc58377d4f24ce937700f0dc
SSDEEP 12288:wPxzAlDBlJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:+KlVlJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D1F4E0DBB65CA2D6E0618E3A8992D5E6E333BC305F2057CF1240535E6E336D48E39726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_bda7e043b367cbf86d8d9b0d2a7ab5d3_amadey_mespinoza

File Explorer

2026-11-01_bda7e043b367cbf86d8d9b0d2a7ab5d3_amadey_mespinoza

.exe 762KB

2026-11-01_bda7e043b367cbf86d8d9b0d2a7ab5d3_amadey_mespinoza

IMPHASH e978ac91805a29d55356a59f013594d2
SHA256 cd86aea4c370f4f755ddda5e9f046936ec161a8fb75d43e7167b707938213e89
MD5 bda7e043b367cbf86d8d9b0d2a7ab5d3
SHA1 6a102c525186f8d6e7f1ad18d29efce7ad49eaeb
SHA512 fb967fa6baca4f782a0d070bee7836845d51e1837bcc01829a3ed7973ef153b4b591cb00636d7982d0758dad3c4e1d3520c62e9edc58377d4f24ce937700f0dc
SSDEEP 12288:wPxzAlDBlJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kw:+KlVlJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D1F4E0DBB65CA2D6E0618E3A8992D5E6E333BC305F2057CF1240535E6E336D48E39726
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\A\_work\2183\s\core-setup\Bin\obj\win-x64.Release\corehost\cli\exe\apphost\Release\apphost.pdb

kernel32

GetEnvironmentVariableW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW CloseHandle GetLastError GetCurrentProcess IsWow64Process GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryExW MultiByteToWideChar WideCharToMultiByte FreeLibrary RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter TerminateProcess IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent SetEvent LCMapStringW GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW

api-ms-win-crt-runtime-l1-1-0

__p___wargv _invalid_parameter_noinfo_noreturn __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment abort _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _errno _cexit _crt_atexit terminate _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr frexp

api-ms-win-crt-heap-l1-1-0

malloc free _free_base _callnewh _calloc_base _set_new_mode calloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf _set_fmode __acrt_iob_func fputwc __p__commode __stdio_common_vsprintf_s fflush

api-ms-win-crt-string-l1-1-0

strcpy_s wcsnlen memset strcspn _wcsdup

api-ms-win-crt-locale-l1-1-0

__pctype_func localeconv ___mb_cur_max_func setlocale ___lc_codepage_func _unlock_locales _lock_locales _configthreadlocale ___lc_locale_name_func

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-multibyte-l1-1-0

_ismbblead

Name

.text

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_bda7e043b367cbf86d8d9b0d2a7ab5d3_amadey_mespinoza

kernel32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

generic