2026-11-03_7e43a5a6fc7ceed90a8acfe8612ff5bd_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_7e43a5a6fc7ceed90a8acfe8612ff5bd_mespinoza
Size 2.1MB
Sample261104-tbeqyabt21
SHA256 da28c6754f526c87e1b4997f54146e0e6a8db59aa6acf86b79d935a662c3f87f
MD5 7e43a5a6fc7ceed90a8acfe8612ff5bd
SHA1 31f299f8234ba8c77bda5f2f53050ca6b51d8686
SHA512 75f2914740b64481e21d43b648deadc06ce8ea234245479011b4df16dfde69f231c991fb77123f1a113a61e5f8ce214e7b8fd3565bf70338485e0157cae77e3b
SSDEEP 49152:h/hXbSkXb3C6eYzPhaAfrWOfHsa0btldNzR6i8j2KROFQDgeIn3GG503RejK4Gmt:nXbSVKplb4PvAmPikjq
TLSH
T136A5F117F64520DEC4AEC1B6979AAA11B8B1B80B4771BCDB138087713E67EE45B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_7e43a5a6fc7ceed90a8acfe8612ff5bd_mespinoza

File Explorer

2026-11-03_7e43a5a6fc7ceed90a8acfe8612ff5bd_mespinoza

.exe 2.1MB

2026-11-03_7e43a5a6fc7ceed90a8acfe8612ff5bd_mespinoza

IMPHASH 4c7c048d26a9b37bcc19291acb3c1edd
SHA256 da28c6754f526c87e1b4997f54146e0e6a8db59aa6acf86b79d935a662c3f87f
MD5 7e43a5a6fc7ceed90a8acfe8612ff5bd
SHA1 31f299f8234ba8c77bda5f2f53050ca6b51d8686
SHA512 75f2914740b64481e21d43b648deadc06ce8ea234245479011b4df16dfde69f231c991fb77123f1a113a61e5f8ce214e7b8fd3565bf70338485e0157cae77e3b
SSDEEP 49152:h/hXbSkXb3C6eYzPhaAfrWOfHsa0btldNzR6i8j2KROFQDgeIn3GG503RejK4Gmt:nXbSVKplb4PvAmPikjq
TLSH
T136A5F117F64520DEC4AEC1B6979AAA11B8B1B80B4771BCDB138087713E67EE45B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

652676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:/buildbot/src/out/build/debug_info/crashpad_handler.pdb

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CloseHandle ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateNamedPipeW CreateProcessW CreateSemaphoreW CreateThread DeleteCriticalSection DeleteFileW DisconnectNamedPipe DuplicateHandle EnterCriticalSection FindClose FindFirstFileExW FindNextFileW FlushInstructionCache FormatMessageA FormatMessageW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetExitCodeThread GetFileAttributesW GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleW GetNamedPipeInfo GetProcAddress GetProcessId GetProcessTimes GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetSystemDefaultLCID GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetThreadLocale GetTimeZoneInformation GetUserDefaultLCID GetVersion InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsWow64Process LeaveCriticalSection LoadLibraryW LocalFree LockFileEx MoveFileExW OpenProcess OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter RaiseException ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetEvent SetFilePointerEx SetLastError SetNamedPipeHandleState SetProcessShutdownParameters SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SuspendThread TerminateProcess TransactNamedPipe TryEnterCriticalSection UnhandledExceptionFilter UnlockFileEx UnregisterWaitEx VerSetConditionMask VerifyVersionInfoW VirtualAllocEx VirtualProtectEx VirtualQueryEx WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WerRegisterRuntimeExceptionModule Wow64GetThreadContext WriteFile WriteProcessMemory

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1ios_base@std@@UEAA@XZ ??4?$_Yarn@_W@std@@QEAAAEAV01@PEB_W@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

advapi32

BuildExplicitAccessWithNameW BuildSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW ImpersonateNamedPipeClient RegCloseKey RegOpenKeyExW RegQueryValueExA RegQueryValueExW RevertToSelf SystemFunction036

user32

CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetMessageW GetWindowLongPtrW PostMessageW RegisterClassW SetWindowLongPtrW TranslateMessage UnregisterClassW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpWriteData

powrprof

CallNtPowerInformation

vcruntime140

_CxxThrowException __C_specific_handler __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_type_info_destroy_list _purecall memchr memcmp memcpy memmove memset strchr

api-ms-win-crt-time-l1-1-0

_W_Getdays _W_Getmonths _time64

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_p __stdio_common_vsscanf _set_fmode fflush fputs

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _errno _execute_onexit_table _exit _get_initial_wide_environment _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invoke_watson _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_dll _seh_filter_exe _set_app_type abort exit signal terminate

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _callnewh _set_new_mode calloc free malloc

api-ms-win-crt-string-l1-1-0

_wcsicmp isalnum isspace strlen strncmp strnlen tolower wcscmp wcslen wcsncmp wcsnlen

api-ms-win-crt-filesystem-l1-1-0

_wstat64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr ldexp

api-ms-win-crt-convert-l1-1-0

strtol strtoll strtoul strtoull

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

641KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_7e43a5a6fc7ceed90a8acfe8612ff5bd_mespinoza

kernel32

msvcp140

advapi32

user32

winhttp

powrprof

vcruntime140

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic