2026-11-12_58c759e207fc85677eba7bfd904114f9_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_58c759e207fc85677eba7bfd904114f9_mespinoza
Size 1.6MB
Sample261113-c1bbday12q
SHA256 3049dd6725a58e0c172ead17982a82ef40a44a45bf36001887859ff9d786e318
MD5 58c759e207fc85677eba7bfd904114f9
SHA1 f74f6775ac84c5b6e6773446048147272beab885
SHA512 a084ba63dfb4c11172f66f4cfaabe9182e556695a80e2587e3d269b9350b7106cf31c5479b511f516d2ea44d52f5e4bb53c95737a6959d392bcca1960b7c18b7
SSDEEP 12288:Y/GsHOvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OG6OvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T151756C92F20959D8EC3A03B699677D251E53BDBDE431496E10DE702E2AF3392006FD4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_58c759e207fc85677eba7bfd904114f9_mespinoza

File Explorer

2026-11-12_58c759e207fc85677eba7bfd904114f9_mespinoza

.exe 1.6MB

2026-11-12_58c759e207fc85677eba7bfd904114f9_mespinoza

IMPHASH c74b7684abae1d1dfd5082df18c402e5
SHA256 3049dd6725a58e0c172ead17982a82ef40a44a45bf36001887859ff9d786e318
MD5 58c759e207fc85677eba7bfd904114f9
SHA1 f74f6775ac84c5b6e6773446048147272beab885
SHA512 a084ba63dfb4c11172f66f4cfaabe9182e556695a80e2587e3d269b9350b7106cf31c5479b511f516d2ea44d52f5e4bb53c95737a6959d392bcca1960b7c18b7
SSDEEP 12288:Y/GsHOvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OG6OvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T151756C92F20959D8EC3A03B699677D251E53BDBDE431496E10DE702E2AF3392006FD4B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

U:\develop\global\Release64\bin\common\DwgCheckStandards.pdb

userdata

?SetWorkingDirectory@@YAXXZ acudInitProductParams

mfc140u

ord6122 ord14289 ord6123 ord14290 ord6121 ord14288 ord7719 ord12212 ord14088 ord11665 ord11664 ord2011 ord11709 ord7668 ord12625 ord3949 ord4011 ord9089 ord14216 ord7650 ord2270 ord12223 ord12222 ord2439 ord983 ord8023 ord4445 ord12544 ord12606 ord10124 ord11929 ord8084 ord1450 ord7393 ord8167 ord11901 ord11933 ord7920 ord11921 ord5706 ord3731 ord2212 ord5080 ord5363 ord5552 ord9041 ord5339 ord5555 ord5083 ord6614 ord5229 ord5183 ord5062 ord7460 ord7461 ord7450 ord6505 ord365 ord11719 ord11718 ord1059 ord8058 ord12563 ord4510 ord1670 ord1667 ord1503 ord1033 ord290 ord286 ord296 ord4946 ord5709 ord285 ord2921 ord265 ord8900 ord9941 ord7922 ord14210 ord5227 ord1491 ord2370

kernel32

OutputDebugStringW InitializeCriticalSectionEx GetModuleFileNameW GetStdHandle FormatMessageW GetLastError TerminateProcess GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetProcAddress GetModuleHandleW CreateEventW CloseHandle CreateProcessW DeleteCriticalSection LocalFree LoadLibraryW

user32

MessageBoxW

advapi32

InitializeSecurityDescriptor

vcruntime140

memset __C_specific_handler __CxxFrameHandler3 __vcrt_InitializeCriticalSectionEx

api-ms-win-crt-string-l1-1-0

_wcsdup _wcsicmp

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _register_onexit_function _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _crt_atexit terminate _cexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

600B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

400KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_58c759e207fc85677eba7bfd904114f9_mespinoza

userdata

mfc140u

kernel32

user32

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic