2026-11-07_c764128790c090f7637d88bb5e6e9a89_elex_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_c764128790c090f7637d88bb5e6e9a89_elex_mespinoza
Size 13.8MB
Sample261107-ma4v4see97
SHA256 3dd013c59e4e611e1dc7109eb4cc5b4f3c504b7b9cd0c9a7ffcd16372b5b127d
MD5 c764128790c090f7637d88bb5e6e9a89
SHA1 d5b719ee8bd0a46121fe0c55ac876ba2649edac4
SHA512 c416fd30846de67bbb8ee1b78f5cca32aad5cec63a2d7bd5d3f3b680140eed02114ccb17a113eb3a5b52a11f76e90360f5e986067e42d6fae0e658883d88787b
SSDEEP 393216:s+MR7/xRX3oT8l8RnAPU6fDdFxtLvKfE1HbpD0D6taWoFk:s+M1Qn8U6fnLvKM1HbpDS6tPoFk
TLSH
T10EE6331CA7F82419F134B8F90EE79DA4DBCE7CE8724D0A67007466CF5A60641EEB11E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-07_c764128790c090f7637d88bb5e6e9a89_elex_mespinoza

.exe 13.8MB

2026-11-07_c764128790c090f7637d88bb5e6e9a89_elex_mespinoza

SHA256 3dd013c59e4e611e1dc7109eb4cc5b4f3c504b7b9cd0c9a7ffcd16372b5b127d
MD5 c764128790c090f7637d88bb5e6e9a89
SHA1 d5b719ee8bd0a46121fe0c55ac876ba2649edac4
SHA512 c416fd30846de67bbb8ee1b78f5cca32aad5cec63a2d7bd5d3f3b680140eed02114ccb17a113eb3a5b52a11f76e90360f5e986067e42d6fae0e658883d88787b
SSDEEP 393216:s+MR7/xRX3oT8l8RnAPU6fDdFxtLvKfE1HbpD0D6taWoFk:s+M1Qn8U6fnLvKM1HbpDS6tPoFk
TLSH
T10EE6331CA7F82419F134B8F90EE79DA4DBCE7CE8724D0A67007466CF5A60641EEB11E6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

56:70:af:ac:9f:cf:11:35:53:ea:ae:39:41:eb:1d:1d:78:e1:ec:a9:61:3d:ae:9a:7e:a5:a4:ca:05:0f:5a:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=SC587160,CN=Woita Ltd,O=Woita Ltd,L=Edinburgh,ST=Scotland,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13094564696e6275726768,1.3.6.1.4.1.311.60.2.1.2=#130853636f746c616e64,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Jul 12, 2020

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

8d:29:3c:54:10:73:e2:01:8f:9a:8d:d3:10:5e:04:15:38:55:54:8b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 12, 2020

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

Serial Number

22:63:15:71:fe:4c:70:6e:ef:bc:df:e3:5e:59:ce:0e

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 28, 2019 - Aug 27, 2020

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

691KB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

157KB

Virtual Size

568KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

5KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

12.4MB

Virtual Size

20.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

53KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sec8

Size

495KB

Virtual Size

496KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sec9

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_c764128790c090f7637d88bb5e6e9a89_elex_mespinoza

generic