spectral[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
spectral.exe
Size 4.9MB
Sample260724-tp164ahd99
SHA256 a8a40f76c696c5d810e4eec824ff0507792159f8179db59145c27d90ccf58bb0
MD5 672055203bbf97cc4e58f9a44108abcb
SHA1 f5057720c052dc4703ed0dbbeabe1f955c3bb248
SHA512 088d3ce7c1f5de000d5298f7f96b6acc9dcdaafe2b51c56f10996aafb36eb472cbd44753d23a2430ded060b4338d82accd455efc6d169b91e3882fca1878e230
SSDEEP 49152:2n/k167CUZJWfgbsUzdD00KcCVYt2VBDGbsuR8d73CTdzsRa5tqaXMnTIlMzTmFt:J6zyUoB+GCTebTIlMzTmFW794N4N969
TLSH
T14B364C6DD1A820A9E1D6F97ECB88D813C672B861632551EB11878F632F2F7D5D638F00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
spectral.exe

File Explorer

spectral.exe

.exe 4.9MB

spectral.exe

IMPHASH ebd65b602f7ec17a48a229707beb8581
SHA256 a8a40f76c696c5d810e4eec824ff0507792159f8179db59145c27d90ccf58bb0
MD5 672055203bbf97cc4e58f9a44108abcb
SHA1 f5057720c052dc4703ed0dbbeabe1f955c3bb248
SHA512 088d3ce7c1f5de000d5298f7f96b6acc9dcdaafe2b51c56f10996aafb36eb472cbd44753d23a2430ded060b4338d82accd455efc6d169b91e3882fca1878e230
SSDEEP 49152:2n/k167CUZJWfgbsUzdD00KcCVYt2VBDGbsuR8d73CTdzsRa5tqaXMnTIlMzTmFt:J6zyUoB+GCTebTIlMzTmFW794N4N969
TLSH
T14B364C6DD1A820A9E1D6F97ECB88D813C672B861632551EB11878F632F2F7D5D638F00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2809348

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpSetTimeouts WinHttpReadData

kernel32

Module32First DuplicateHandle GetLastError lstrcpynW CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA GetCurrentProcess FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree GetSystemDirectoryW LoadLibraryW SleepEx MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW FormatMessageA GetLocaleInfoEx CreateDirectoryW VirtualQueryEx FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI Module32Next GetFileInformationByHandleEx ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW GetCurrentThreadId InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW VirtualProtectEx GetTickCount64 WriteProcessMemory Process32FirstW Process32NextW K32GetModuleFileNameExA OpenProcess ReadProcessMemory GetTickCount ExitProcess CloseHandle Process32Next Sleep CreateToolhelp32Snapshot GetSystemInfo K32EnumProcessModules Process32First GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar FlushInstructionCache VirtualAllocEx SwitchToThread GetCurrentThread SetThreadPriority SetThreadAffinityMask GetConsoleWindow GetCurrentProcessId GetConsoleMode SetCurrentConsoleFontEx GetLocaleInfoA GetModuleHandleA SetLastError CreateFileW InitializeCriticalSectionEx GetProcessId SetConsoleMode GetStdHandle SetConsoleTextAttribute DeleteCriticalSection GetModuleHandleW FindClose

user32

SetWindowLongA PeekMessageA UnregisterClassW GetSystemMetrics CreateWindowExW PostQuitMessage DestroyWindow GetWindowRect ShowWindow DispatchMessageA DefWindowProcW SendMessageA EnumWindows UpdateWindow SetWindowTextA SetForegroundWindow GetWindowLongA GetWindowTextA FindWindowA RegisterClassExW GetClassNameA GetWindowThreadProcessId GetAsyncKeyState OpenClipboard SendInput CloseClipboard TranslateMessage MapVirtualKeyA keybd_event EmptyClipboard IsWindow ShowCursor GetDesktopWindow LoadImageW AppendMenuW LoadIconA GetClipboardData SetClipboardData GetKeyState DestroyMenu GetMessageExtraInfo DefWindowProcA TrackPopupMenu LoadCursorA CreatePopupMenu SendMessageW PostMessageA MonitorFromWindow GetMessageA ScreenToClient GetCapture ClientToScreen SetWindowDisplayAffinity TrackMouseEvent SetLayeredWindowAttributes GetLastInputInfo MoveWindow GetKeyboardLayout GetForegroundWindow SetCapture GetCursorPos SetCursor SetCursorPos GetClientRect SetProcessDPIAware IsWindowUnicode GetMonitorInfoA ReleaseCapture

advapi32

CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash SystemFunction036 CryptDestroyKey CryptImportKey CryptEncrypt OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges

shell32

ShellExecuteA Shell_NotifyIconW

d3dcompiler_43

D3DCompile

msvcp140

_Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_detach _Thrd_join ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ _Cnd_unregister_at_thread_exit ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z _Cnd_register_at_thread_exit _Cnd_wait _Cnd_broadcast ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Random_device@std@@YAIXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ _Xtime_get_ticks ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??1_Lockit@std@@QEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

ws2_32

getsockopt send closesocket WSAGetLastError inet_pton ntohs WSASetLastError bind connect WSACloseEvent getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto WSAEnumNetworkEvents getpeername WSAEventSelect inet_ntop gethostname WSACreateEvent ioctlsocket

winmm

timeGetTime timeEndPeriod timeBeginPeriod

crypt32

CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension PFXImportCertStore CertGetNameStringW CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CryptQueryObject CertOpenStore CertCloseStore

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy strstr strchr _purecall strrchr longjmp memcpy memmove memset memchr memcmp __std_exception_destroy _CxxThrowException wcschr __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free calloc _set_new_mode realloc

api-ms-win-crt-runtime-l1-1-0

terminate _beginthreadex _invoke_watson system _errno exit __sys_errlist __sys_nerr _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _configure_narrow_argv _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment abort

api-ms-win-crt-math-l1-1-0

log fmodf _fdopen _dsign powf sqrtf _dclass _fdclass acosf asinf fminf logf fmaxf atan2f __setusermatherr ldexp ceilf roundf cosf copysignf expf floorf pow sinf round

api-ms-win-crt-string-l1-1-0

wcscpy_s strcpy_s _stricmp _strdup strcmp wcsncpy strpbrk strncpy tolower strncmp strcspn wcspbrk strspn wcsncmp

api-ms-win-crt-convert-l1-1-0

strtol atoi atof strtoul strtoll wcstombs strtod strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf _lseeki64 ftell fwrite _wfopen _wopen __stdio_common_vsprintf fread __p__commode __stdio_common_vsscanf fseek _read __stdio_common_vsprintf_s _write _fileno _close __acrt_iob_func fputs fgets fclose fflush _set_fmode _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos fgetc fputc feof

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s strftime _gmtime64

api-ms-win-crt-environment-l1-1-0

getenv _dupenv_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file _wstat64 _unlink _fstat64

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.spectra

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

245KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

spectral.exe

d3d11

winhttp

kernel32

user32

advapi32

shell32

d3dcompiler_43

msvcp140

dwmapi

imm32

ws2_32

winmm

crypt32

bcrypt

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic