^{��,>�i(B�Tly� �RK/�$���Ib�=Q�e�j�t@ј}����P| M�N��%:0�������6���K�L!=S�q��Ĩ:aC��4�=^p!���y����g�Kg�\?p��[���zuQ#P��p�)4S<�����;@7j@���M��`C�W��p%�#-��|�DTK�#���3�-���ٿ�`2��S�M:EV�P%28dH(iAd�8��ǫByd/�����\��p�|�} '?�(��\7ʑ8��F_�u�>��ZB��<�}���A튻��k�bn5��8���Wόj��aω�t3xG�Ƚ�1���M�9�`��I�x�.D��[�s�/d"���3*��e�Z�5L��iZ0�����;%�� ���$y'�`PӘ['xH#7���qH�����I@����^5��ѥ�<!��^L�7�z�S�gJ{eR[�� �Wg~iòXv�2�W��H��QaFqΠ*����n�]]g�Q�`��0��2��fBJ�y�j=�#+�tW�I[���:d��<j]ތ��Z��Jb�J(�X?�q�H�b��#Ƣ]�4�PH�K��s�����i�����p$"������džQ��"��+���`�d2�0�<��!�ƾӾ̖�*�u�����.\��#m�l���c�,���V�? hw_�Ќ������k�9��=��׳s'4��(;ia�8�I�Zk2��� <g��ЇG"��v�JiNY��6z;V��j�N�8���6�Kw��ۂ�PV�W���I��~��ST9S�y���Cy�(^�2=J&G�L���=8�z�2�H�2����y��H9Y��I�[<)͎���]�P� �4�Q�V��k+�s~A�igD�I�]����?���.����0xɗ�K����oͥ'��^Ŝc�'�E��bb�hͻ��S'#v!0���E'%�-������~|0ԇ;��N@�h1�Д��O�O#;��ԩ(b5}Y E��#63��� l���:�I�_f3kkD<c2ڻ=�������@�+v�D_ri.J��1:���$n��Bn�C���]:�b�drJ���Q*��s⛦M�2E��N���D�)T�w_)�-tJr �|�Y7f. �~P�5ae�����)s+�����Q����#��Ŀة~����`O���-ԫ�dOL۬B��迌H(�Ԍ#t��]�����+�7M��h �,���F��ܹ~��T����:ps���-.�o���$�$���<V@c��xa�� L��j��1�¥_�Tѷ�ԯ�,(퀠����l[З��^9���<rja�B�����/9�,-r����Z�h�l�^:����=a�1���������Y��A�A�6s0�a��Ow�J##�����)��)_QQFdDu��O��=>;F�*�jKd�i=���8-��;��w=��I�S��-��ݾ�A�j_�G���(+<c,x�$��#v%�mk���ݸ?=��Wk}�t�v�yϨU���S 9� �4��m�Į�:wԋ��۞ �������36��bI�3�|�/� ���Ȓ�3P���=:�hBy���:$� �top���D��Ρ>�2m�c�?ypS����;�K������J�r͟�/��ag��b�(�Uu��@-Ͳ��qC{��Ԋa�Z���ͺ��O�����IP1ڮ�>d�D��Ϫmv91����1il���5r�A�[ܴ�a��Ut��-I�����s-:GW��n���$���'��^��*�\lϕ;]����c�u�-�ȏ^�Dr��@h���ʁ���Kt�[ೄ�lW�����S8]�Я�mIJ��(8y&2l��Sl�N��W#f��'�ҬȦ IΝ���짧�D��A0m�K4Wt�z (Y���� �/�N@�Q�h;��4��7�*��&T�F���(�C�A1���b;p0+�c-�P�����^٭�;�6[�!,<Dg\��µJ������:�m?���kk�j�e�嵟NC�]���j@_ �M��Rg�����HH����>Z� �| O ����z{>���cY���`�_ [[���%��������$"�jM�S�6�u�IfR᜶�������g��D����O��(iU���|��yZi/{�r�|#X�r"ީb[;ϱ�@�EJ.z<��}뼊��=t`"_!�����Ӹ�A��aS!��鐷J���kގ��g+�cT+�Th�ԑ<K��4�?pg�'}n����M����O���E#Z�_ۛ�*yd�~���>�^�餬hw�y��cr��I���ބu�ITc�m=�����wY����ӻ�F��<]�6�iN�@$�m�Ot5LR��H�a�"��Nģ�LJ�zP�vG4iJ�rv���6S�x�FTebf��ܘ^?�g]+���g��&��m¥��?�&�����x���d������A�]yDzq�&!�4`E~���՟��7�����^J�s���$1�w�Y� ���z�+����%Ыfj���`�p��g�4�����M6�}ެ2Q�X����k��]�Ix�[�)���X%Dx�&��ǂV)0U���SL�yX�{(�� ��dǙ�~�£ʗ�zA]�U�� ��+�ʵ�Z�z�������zR��y��Wq��Y�ȹґwW�݉Y�a>� ���w�I�ͭ�$��nW�5��`�acpv�+F�幫령5h�'���0���G/�� 3�a�P6'��7��x����������=)Y�i��+g���N4�� q�b��y�A�i�<��L�(�#�d�`��u-��ΉM�\ ��I8*"�u]���1��D��}g��N��w��s8�����^W.��}" <7Ѱ�&���b��Q�~�� ��'�Pv�N�6Jp��CZ�R92ˏx*l �Cb� �j>+�W�!�80E�!����e���#�s;z?�Q�Ђ�2L���m��*�he�kBU+�`HC�V�xIV� ����9�8�6BR������y�H��d<����?ז��V�[�6���X�&��� m�x����;*��-�qYFf��rd�+,aZ��$���%~���D��
Static task
static1
Behavioral task
behavioral1
Sample
SpectrumLoader.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
SpectrumLoader.exe
Resource
win10v2004-20231023-en
General
-
Target
SpectrumLoader.exe
-
Size
21.6MB
-
MD5
73649688c49bb1009e1ad669ddaed618
-
SHA1
f889afe12b68db4bdc16a02da8ce37fee4ca8148
-
SHA256
4cae74ebde7ea7d0104fb96ad57ac68c007687482e5de72440ec788d6119166f
-
SHA512
d1564045f77ff676f597ea223c24cad72b37f27ed6ccbf6696cacbf4a3a1423e1c5b05f0d20419e8391ccc7ce195a454cf6e8bc79e9f7f9d7c6c52ca644b9821
-
SSDEEP
393216:3i4poo2WbuPPKP6xwML46ejLjC+bosTEeTYdQsQtpZ35ueHhL2VXpFLq:SsoxQuPSSxS6ejLe+brf8esQTuHL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SpectrumLoader.exe
Files
-
SpectrumLoader.exe.exe windows:6 windows x86
3f5fc70f6429d570b07fa6a1c0a29519
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoCreateInstance
crypt32
CertOpenSystemStoreW
kernel32
GlobalLock
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
CharUpperBuffW
advapi32
CryptSetHashParam
oleaut32
VariantClear
ws2_32
connect
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
d3dcompiler_43
D3DCompile
ntdll
ZwRaiseHardError
imm32
ImmReleaseContext
Exports
Exports
Sections
.text Size: - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 885KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.spect0 Size: - Virtual size: 16.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.spect1 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.spect2 Size: 21.6MB - Virtual size: 21.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ