spectre[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
spectre.exe
Size 3.7MB
Sample261026-t71chsbe36
SHA256 98c327d5fa6c8fbde3a424eb45d36b1955e2bb4820cb988b52466b63bc955c9d
MD5 173ed3a5c5b65821a4b767190ca57ac0
SHA1 3d84212d6edb5c822381de443704bf0a32883191
SHA512 41ad8bff6bff978acf736ff3c151d32871a575d7423b723f7fe27ad08e23f2ff3a3a16dda73e9fd14b0c848c7941f0775ce598c53483cda9ed8b13a273493d17
SSDEEP 49152:bGC6bZ3su4ltLsW8QvAqoSyYuHG/URcGbPIUXk1mMMyyKaHh9Ui2md1tJIXCnYIH:WHcPUYtUHT7y/aH9n+u
TLSH
T1B0069D03E69881E8D0AEC074C75B9637EBB2B88A1A30B29F16D45B553F27FA05F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
spectre.exe

File Explorer

spectre.exe

.exe 3.7MB

spectre.exe

IMPHASH e1d724593a597c5f4890cca89634f4c4
SHA256 98c327d5fa6c8fbde3a424eb45d36b1955e2bb4820cb988b52466b63bc955c9d
MD5 173ed3a5c5b65821a4b767190ca57ac0
SHA1 3d84212d6edb5c822381de443704bf0a32883191
SHA512 41ad8bff6bff978acf736ff3c151d32871a575d7423b723f7fe27ad08e23f2ff3a3a16dda73e9fd14b0c848c7941f0775ce598c53483cda9ed8b13a273493d17
SSDEEP 49152:bGC6bZ3su4ltLsW8QvAqoSyYuHG/URcGbPIUXk1mMMyyKaHh9Ui2md1tJIXCnYIH:WHcPUYtUHT7y/aH9n+u
TLSH
T1B0069D03E69881E8D0AEC074C75B9637EBB2B88A1A30B29F16D45B553F27FA05F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2860996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

spectre.pdb

kernel32

FlushFileBuffers GetTickCount GetSystemTime GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile DeleteFileA FreeLibrary GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW AreFileApisANSI GlobalMemoryStatusEx GetProcessTimes GetProcessIoCounters GetSystemTimes OpenProcess GetProcAddress GetModuleHandleA FindNextFileW SetFilePointerEx GetProcessHeap HeapFree SetWaitableTimer CreateWaitableTimerExW GetSystemInfo CopyFileExW GetTempPathW GetExitCodeProcess WaitForMultipleObjects DuplicateHandle GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CancelIo CreateEventW ExitProcess CreateDirectoryW GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx SetFileTime FindFirstFileExW GetFullPathNameW CreateThread SetHandleInformation WriteFileEx ReadFileEx GetModuleHandleW SleepEx FlsSetValue IsThreadAFiber FlsFree FlsAlloc WriteConsoleW WaitForSingleObject GetConsoleOutputCP Beep IsDebuggerPresent GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA GetCommandLineW WaitForSingleObjectEx GetFileInformationByHandle Sleep CancelIoEx SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SetLastError TerminateProcess IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentThread SetThreadStackGuarantee SwitchToThread SetConsoleTitleW WriteFile CreateFileW GetCurrentProcess AddVectoredExceptionHandler HeapReAlloc LocalFree GetCurrentProcessId lstrlenW DeviceIoControl GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW LoadLibraryA WideCharToMultiByte FormatMessageW MultiByteToWideChar GetModuleHandleExW HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW SetFileInformationByHandle GetLastError DeleteFileW ReadProcessMemory FindClose VirtualQueryEx CloseHandle K32GetPerformanceInfo InitializeSListHead CreateFileA GetComputerNameExW DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection LoadLibraryExA MapViewOfFile CreateFileMappingW FormatMessageA SystemTimeToFileTime HeapDestroy HeapCompact LoadLibraryW FlushViewOfFile OutputDebugStringW HeapSize HeapValidate UnmapViewOfFile OutputDebugStringA HeapCreate RaiseException

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

RegOpenKeyExW SystemFunction036 OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegDeleteValueW RegSetValueExW GetTokenInformation CopySid IsValidSid GetLengthSid

ws2_32

freeaddrinfo setsockopt bind getsockopt connect ioctlsocket WSAStartup closesocket recv WSAIoctl send shutdown WSASend WSASocketW getsockname WSAGetLastError getpeername getaddrinfo

ntdll

RtlGetVersion NtQueryInformationProcess NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile RtlNtStatusToDosError NtReadFile NtWriteFile NtCancelIoFileEx NtQuerySystemInformation NtCreateFile

oleaut32

SysStringLen SysFreeString GetErrorInfo

user32

GetForegroundWindow GetKeyState ReleaseDC RemovePropW IsWindowVisible ShowWindow ChangeDisplaySettingsW EnumDisplaySettingsW EnumWindows MessageBoxW PostThreadMessageW UnhookWindowsHookEx GetWindowTextW SystemParametersInfoW CallNextHookEx SetPropW CreateWindowExW FindWindowExW FindWindowW GetDlgItem EnumDisplaySettingsExW GetMonitorInfoW EnumDisplayMonitors SetWindowsHookExW KillTimer DispatchMessageW TranslateMessage GetMessageW SetTimer PostQuitMessage DestroyWindow SendMessageW RegisterClassExW SetWindowTextW GetClientRect FillRect DefWindowProcW SetFocus GetPropW GetDC keybd_event

gdi32

DeleteObject GetObjectW GetDIBits StretchBlt SetStretchBltMode SetGraphicsMode SetWorldTransform CreateFontW CreateSolidBrush SetTextColor SetBkColor SelectObject CreateCompatibleBitmap CreateDCW GetDeviceCaps DeleteDC CreateCompatibleDC

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteW

crypt32

CryptUnprotectData

ole32

CoTaskMemFree

bcrypt

BCryptGenRandom

psapi

GetModuleFileNameExW

powrprof

CallNtPowerInformation

pdh

PdhCloseQuery PdhOpenQueryA PdhRemoveCounter PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCollectQueryData

vcruntime140

__current_exception __C_specific_handler strrchr memcpy strchr memset __CxxFrameHandler3 memcmp memmove memchr __current_exception_context

api-ms-win-crt-string-l1-1-0

strspn strcmp wcslen strlen strcspn strncmp

api-ms-win-crt-math-l1-1-0

fabs _dclass __setusermatherr pow log round roundf log2

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode realloc malloc calloc free

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_exit terminate _initialize_onexit_table _crt_atexit __p___argc _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit _set_app_type _beginthreadex _cexit _endthreadex __p___argv _wassert exit _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale