2026-11-03_5fae24a1280949101d4bd4ff5657244a_elex_expiro_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_5fae24a1280949101d4bd4ff5657244a_elex_expiro_mespinoza
Size 1.3MB
Sample261104-xws1vae17n
SHA256 b22971bca0952b6caaafb6549872b6edb516bcde0e81bda4c92355f9e15b3ca0
MD5 5fae24a1280949101d4bd4ff5657244a
SHA1 e6a2b461faa1947fa024cf0fcbc1ad3fdd5ebf90
SHA512 d836790eab2b360a16e94f125e9584cffd68dfea242e42e6f53ea3a4b3c885084cb8450fdaa105c95859f9d620a7ad883e700e07b6d5edc43750eacc3e3a0f77
SSDEEP 12288:lx0kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lx0ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T177551211795851F5DC2620B256D8EB3E9C266E3A2F2009C3FF866CE69FF41E0463E157
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_5fae24a1280949101d4bd4ff5657244a_elex_expiro_mespinoza

File Explorer

2026-11-03_5fae24a1280949101d4bd4ff5657244a_elex_expiro_mespinoza

.exe 1.3MB

2026-11-03_5fae24a1280949101d4bd4ff5657244a_elex_expiro_mespinoza

IMPHASH 6beb65b585b7760e128d02445a357b47
SHA256 b22971bca0952b6caaafb6549872b6edb516bcde0e81bda4c92355f9e15b3ca0
MD5 5fae24a1280949101d4bd4ff5657244a
SHA1 e6a2b461faa1947fa024cf0fcbc1ad3fdd5ebf90
SHA512 d836790eab2b360a16e94f125e9584cffd68dfea242e42e6f53ea3a4b3c885084cb8450fdaa105c95859f9d620a7ad883e700e07b6d5edc43750eacc3e3a0f77
SSDEEP 12288:lx0kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lx0ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T177551211795851F5DC2620B256D8EB3E9C266E3A2F2009C3FF866CE69FF41E0463E157
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

plugin-container.pdb

mozglue

??2@YAPAXI@Z ??3@YAXPAX@Z ??3@YAXPAXI@Z ??_U@YAPAXI@Z ??_V@YAXPAX@Z ?DllBlocklist_Initialize@@YAXI@Z ?InvalidArrayIndex_CRASH@detail@mozilla@@YAXII@Z ?IsWin32kLockedDown@mozilla@@YA_NXZ ?RegisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?SetGeckoChildID@mozilla@@YAXPBD@Z ?SetGeckoProcessType@mozilla@@YAXPBD@Z ?UnregisterRuntimeExceptionModule@CrashReporter@@YAXXZ ?sChildProcessType@startup@mozilla@@3W4GeckoProcessType@@A free malloc moz_xmalloc mozalloc_abort realloc

advapi32

AddMandatoryAce DuplicateTokenEx GetAce GetLengthSid GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo InitializeAcl IsValidAcl IsValidSecurityDescriptor IsValidSid OpenProcessToken RegCloseKey RegDisablePredefinedCache RegOpenKeyExW RegQueryValueExW RevertToSelf SetSecurityInfo SetTokenInformation

ntdll

NtQueryVirtualMemory RtlNtStatusToDosError RtlSetLastWin32Error

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0ios_base@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1ios_base@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Xlength_error@std@@YAXPBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?good@ios_base@std@@QBE_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

kernel32

AcquireSRWLockExclusive CloseHandle CreateEventW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx ExpandEnvironmentStringsW FlushInstructionCache FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetLastError GetModuleHandleA GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessHandleCount GetProcessHeaps GetProcessId GetProductInfo GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsWow64Process LeaveCriticalSection LoadLibraryExA LoadLibraryW LocalFree QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive SetDefaultDllDirectories SetDllDirectoryW SetEnvironmentVariableW SetHandleInformation SetLastError SetProcessDEPPolicy SetProcessMitigationPolicy SetThreadAffinityMask SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte

vcruntime140

__current_exception __current_exception_context _except_handler3 _except_handler4_common memcpy memmove memset

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _c_exit _cexit _configure_wide_argv _controlfp_s _crt_atexit _errno _exit _get_initial_wide_environment _initialize_onexit_table _initialize_wide_environment _initterm _initterm_e _invalid_parameter_noinfo_noreturn _invoke_watson _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil ldexp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

_wcsnicmp strlen wcscmp wcslen wcsncmp wcstok_s

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Name

.text

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

10B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_5fae24a1280949101d4bd4ff5657244a_elex_expiro_mespinoza

mozglue

advapi32

ntdll

msvcp140

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic