SPEC02781[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SPEC02781.exe
Size 272KB
Sample230503-m19jaaed67
SHA256 f6a2d28af9b92a8c15d4afeef24e99d1c908787e68602c8bb944b50b3485e31f
MD5 7f8f46c40b2fe1e636a9c1627328f2e1
SHA1 a494146eb403a23fc41cad4bf88c4bc4d600fd20
SHA512 5f22a2283d1491fea1166548e2418fef3a0c1c3050651fa8f9f5b77a9263c20a269670db48bd13aed1465a1ac8cf90224c799df07397ce75fecec9f03e90359b
SSDEEP 6144:o6dLyT7K5sKtRVDLJINxC2koT4VskSFqutDpPN4rhs0Cl:wTqt/LyxTwJSFquN4rW0U
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

SPEC02781.exe

.exe 272KB

SPEC02781.exe

IMPHASH e9c0657252137ac61c1eeeba4c021000
SHA256 f6a2d28af9b92a8c15d4afeef24e99d1c908787e68602c8bb944b50b3485e31f
MD5 7f8f46c40b2fe1e636a9c1627328f2e1
SHA1 a494146eb403a23fc41cad4bf88c4bc4d600fd20
SHA512 5f22a2283d1491fea1166548e2418fef3a0c1c3050651fa8f9f5b77a9263c20a269670db48bd13aed1465a1ac8cf90224c799df07397ce75fecec9f03e90359b
SSDEEP 6144:o6dLyT7K5sKtRVDLJINxC2koT4VskSFqutDpPN4rhs0Cl:wTqt/LyxTwJSFquN4rW0U
MD5 SHA1 SHA512 SSDEEP

windows x86

NSIS installer

installer

PE Signature issue

Digest

6c:41:07:53:f4:64:98:55:82:2c:4c:a6:72:5b:c4:f9:0c:13:99:2b:d4:76:ed:1f:0c:42:ea:1e:ea:cc:5a:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

PE Signature issue

Digest

05:6e:1e:f8:da:b6:a7:cf:d8:72:a4:8e:12:80:20:b1:26:72:02:9d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Subject

OU=Neutralities Hyrden\ ,O=Unbarrelled,L=Greenville,ST=Texas,C=US,1.2.840.113549.1.9.1=#0c1f53636170756c6f74686f7261636963405373746572646174746572732e4a65

Serial Number

2b:a7:4e:12:17:43:4c:18:93:a8:15:e5:a3:03:ae:93:1e:c8:0c:4e

Issuer

OU=Neutralities Hyrden\ ,O=Unbarrelled,L=Greenville,ST=Texas,C=US,1.2.840.113549.1.9.1=#0c1f53636170756c6f74686f7261636963405373746572646174746572732e4a65

Timespan

Aug 8, 2022 - Aug 7, 2025

Subject

OU=Neutralities Hyrden\ ,O=Unbarrelled,L=Greenville,ST=Texas,C=US,1.2.840.113549.1.9.1=#0c1f53636170756c6f74686f7261636963405373746572646174746572732e4a65

Serial Number

2b:a7:4e:12:17:43:4c:18:93:a8:15:e5:a3:03:ae:93:1e:c8:0c:4e

Issuer

OU=Neutralities Hyrden\ ,O=Unbarrelled,L=Greenville,ST=Texas,C=US,1.2.840.113549.1.9.1=#0c1f53636170756c6f74686f7261636963405373746572646174746572732e4a65

Timespan

Aug 8, 2022 - Aug 7, 2025

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

12853

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetFileAttributesA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance