spectacle[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
spectacle.exe
Size 8.3MB
Sample260810-3jynfsbq91
SHA256 89dd75736c785557181188ae8f6a39976c06195734f3bda461681c512d41be96
MD5 8276e49f7d2878a1f8d7ad9fb68b1c2e
SHA1 88d067872ca477bdd36af34d404981acd76a4586
SHA512 455ce2fcc4b57d75087ad890073b00521f773ecedcfa3584cfdc0799f3e0f9087822bc87281bc7ff583c03a2f1a121f7d18959501c6c661d718ca960a91a09f9
SSDEEP 196608:7M8RGmbheQZuXe0/IPAVC9z1wTvglUy5uVCATDM:TAmbheQZuXe0/C9zMgq4uV1f
TLSH
T1CC961217F3A246DDC6679538C663E717E2B278141732C2CF23B48952AF976D08EBA341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
spectacle.exe

File Explorer

spectacle.exe

.exe 8.3MB

spectacle.exe

IMPHASH 9cd6fc13bb8589882a1da34abccd3f49
SHA256 89dd75736c785557181188ae8f6a39976c06195734f3bda461681c512d41be96
MD5 8276e49f7d2878a1f8d7ad9fb68b1c2e
SHA1 88d067872ca477bdd36af34d404981acd76a4586
SHA512 455ce2fcc4b57d75087ad890073b00521f773ecedcfa3584cfdc0799f3e0f9087822bc87281bc7ff583c03a2f1a121f7d18959501c6c661d718ca960a91a09f9
SSDEEP 196608:7M8RGmbheQZuXe0/IPAVC9z1wTvglUy5uVCATDM:TAmbheQZuXe0/C9zMgq4uV1f
TLSH
T1CC961217F3A246DDC6679538C663E717E2B278141732C2CF23B48952AF976D08EBA341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

1500388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

NtSetInformationThread NtQueryInformationProcess NtQuerySystemInformation VerSetConditionMask RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

winhttp

WinHttpQueryDataAvailable WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle

kernel32

WaitForSingleObject GetSystemDirectoryW LocalFree CreateProcessW GetExitCodeProcess OutputDebugStringW GetCurrentProcess Thread32Next Thread32First GetCurrentThread GetThreadContext ExitProcess GetCurrentProcessId OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent AddVectoredExceptionHandler HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CreateThread VirtualProtect CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA QueryFullProcessImageNameW GetModuleHandleW FormatMessageW ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection GetCommandLineW LoadLibraryW SleepEx GetSystemInfo FreeLibrary MoveFileExW WaitForSingleObjectEx GetFileType ReadFile VerifyVersionInfoW WakeAllConditionVariable AreFileApisANSI GetFileInformationByHandleEx WriteProcessMemory GetTickCount QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA GetModuleHandleA GlobalUnlock GlobalLock GlobalFree GetProcAddress LoadLibraryA GetFileAttributesA GetEnvironmentVariableA FlushFileBuffers SetFilePointerEx GetWindowsDirectoryW CreateFileW GetTempPathW GetModuleFileNameW WriteFile GetFullPathNameW GetFileSizeEx SetConsoleTitleW AllocConsole GetConsoleWindow WriteConsoleW WaitForMultipleObjects GlobalAlloc MultiByteToWideChar LeaveCriticalSection CreateDirectoryA GetStdHandle K32EnumProcessModules UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SwitchToThread GetLastError Sleep GetFileAttributesW ExpandEnvironmentStringsW SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetSystemTimeAsFileTime InitializeSListHead CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx WideCharToMultiByte ReadProcessMemory K32GetModuleInformation K32GetModuleBaseNameA CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess GetEnvironmentVariableW GetTickCount64 FormatMessageA GetCurrentThreadId SleepConditionVariableSRW SetLastError PeekNamedPipe

user32

MapWindowPoints PostMessageW SetWindowLongW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SetWindowLongPtrW FindWindowA GetWindowTextA GetWindowLongPtrW MessageBoxA MoveWindow SetLayeredWindowAttributes LoadIconW LoadCursorW PostQuitMessage CharUpperBuffW CharLowerBuffW BringWindowToTop SetForegroundWindow mouse_event GetAsyncKeyState GetWindowThreadProcessId DefWindowProcW GetWindowRect DestroyWindow GetDC IsWindowVisible SetWindowPos MessageBoxW PeekMessageW GetMonitorInfoW DispatchMessageW IsWindow ReleaseDC UpdateWindow GetClientRect PrintWindow FindWindowW ShowWindow RegisterClassExW GetSystemMetrics CreateWindowExW UnregisterClassW EnumDisplayMonitors EnumWindows TranslateMessage

gdi32

DeleteObject SetStretchBltMode DeleteDC GetStockObject StretchBlt CreateCompatibleDC CreateDIBSection SelectObject BitBlt SetBrushOrgEx

advapi32

OpenProcessToken RegEnumKeyExW RegDeleteTreeW RegDeleteValueW RegEnumValueW RegCloseKey RegOpenKeyExW RegQueryValueExW AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash SystemFunction036 CryptDestroyKey CryptImportKey CryptEncrypt RegQueryInfoKeyW

shell32

SHGetKnownFolderPath ShellExecuteW CommandLineToArgvW ShellExecuteA

ole32

CoTaskMemFree CoUninitialize CoCreateInstance CoInitializeEx

d3dcompiler_43

D3DCompile

d3dx10_43

D3DXVec3Transform

msvcp140

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??Bios_base@std@@QEBA_NXZ _Xtime_get_ticks ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??7ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?always_noconv@codecvt_base@std@@QEBA_NXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Random_device@std@@YAIXZ _Mtx_lock _Mtx_unlock ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?good@ios_base@std@@QEBA_NXZ _Thrd_id _Thrd_join ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertCloseStore CertFreeCertificateContext CertFindCertificateInStore CertOpenStore CertEnumCertificatesInStore

ws2_32

ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt recv htons getsockname getpeername connect bind WSAStartup inet_ntop WSASetLastError ntohs inet_pton WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect gethostname WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt WSACleanup

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memmove memcpy memcmp memchr _CxxThrowException strchr strstr wcsrchr __std_terminate __std_exception_copy __std_exception_destroy strrchr __C_specific_handler wcschr __current_exception __current_exception_context

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh calloc realloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

fgetpos _lseeki64 fwrite fgetc __stdio_common_vsscanf fclose fflush _wopen fputc __stdio_common_vsprintf feof fputs fseek __stdio_common_vsnwprintf_s __stdio_common_vfprintf _wfopen_s __acrt_iob_func __stdio_common_vfwprintf _set_fmode _popen _pclose ftell setvbuf __p__commode ungetc _read _write fsetpos fread _fileno _close _fseeki64 fgets _wfopen _get_stream_buffer_pointers freopen_s __stdio_common_vswprintf_s

api-ms-win-crt-runtime-l1-1-0

system exit _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm __sys_errlist __sys_nerr _invoke_watson _get_wide_winmain_command_line _beginthreadex abort _invalid_parameter_noinfo _initialize_wide_environment _resetstkoflw _configure_wide_argv _set_app_type _seh_filter_exe terminate _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _errno

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-time-l1-1-0

strftime _gmtime64 _localtime64 _time64 _gmtime64_s _localtime64_s

api-ms-win-crt-string-l1-1-0

isspace _wcsdup strcspn wcsncpy_s wcspbrk wcsncmp strspn strcmp wcscpy_s _wcsnicmp isdigit strncpy _strdup _wcsicmp strcpy_s strncmp wcsncpy strpbrk tolower

api-ms-win-crt-convert-l1-1-0

strtoll atof atoi strtoul wcstombs strtol strtoull strtod

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _unlock_file _lock_file _wstat64 _unlink

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-conio-l1-1-0

_getwch

api-ms-win-crt-math-l1-1-0

powf __setusermatherr fmodf atan2f _fdopen log acosf logf ceilf _fdclass llround pow sinf cosf _dclass sqrtf _dsign