setup_think-cell_35474[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

setup_think-cell_35474.exe
Size

93.2MB
MD5

fdd04bf461f8ec2c7d0a4658049b4836
SHA1

d3b7445cf39e183cfafb5bf8ce7f095d310479fe
SHA256

6272a2aad6044529a99e3827c5d06c937bbc813544a9d8f4abe352131a581270
SHA512

7aa3aec9a77f9f81845dfbd5df99b7db062677ab1c0e5b7518bd1e9424f532afec5c784f40dc991411c4cd2006c4a5eab07dc37bbe9e0dd18b6877d4222a701d
SSDEEP

1572864:+aK/bPdIuOztkSOVLTmfpPqvVk4RbqbTX7r34g7u3dJ/f6sqfdLO8dmf1iIVQzfD:+aK/jauqknLaqvGAITP3J7sdJ/xgw1id

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup_think-cell_35474.exe

Files

setup_think-cell_35474.exe
.exe windows:6 windows x86 arch:x86

8f8efb2bceb9e763747e4bfb23244445

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

S:\tcaddin\Output\setup.pdb

Imports

userenv

GetProfileType

kernel32

GetEnvironmentVariableW
CreateDirectoryW
GetTempPathW
GetSystemDirectoryW
LoadResource
LockResource
SizeofResource
FindResourceW
IsDebuggerPresent
GetLocaleInfoEx
GetCommandLineW
CreateFileW
DeleteFileW
SetFileInformationByHandle
CompareStringEx
CompareStringOrdinal
GetFileAttributesW
RemoveDirectoryW
SetFileAttributesW
MoveFileExW
WaitForSingleObject
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
FindClose
FindNextFileW
OpenMutexW
CreateEventExW
CreatePrivateNamespaceW
OpenPrivateNamespaceW
ClosePrivateNamespace
CreateBoundaryDescriptorW
AddSIDToBoundaryDescriptor
DeleteBoundaryDescriptor
LocalAlloc
AddIntegrityLabelToBoundaryDescriptor
GetDriveTypeW
GetFullPathNameW
GetVolumeInformationW
GetVolumePathNameW
SetEvent
TerminateProcess
VerSetConditionMask
FreeLibrary
ExpandEnvironmentStringsW
GetSystemInfo
GetTimeZoneInformation
GetTickCount
MultiByteToWideChar
K32EnumProcessModules
ReadFile
WriteFile
GetOverlappedResult
CreateEventW
DuplicateHandle
ConnectNamedPipe
CreateNamedPipeW
CancelIo
CreateProcessW
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetFileInformationByHandle
FlushFileBuffers
SetEndOfFile
SetFilePointerEx
DeviceIoControl
AreFileApisANSI
SetStdHandle
GetFileType
LoadLibraryExW
RtlUnwind
GetVersionExW
InterlockedExchange
InitializeSListHead
GetProcessHeap
TlsSetValue
TlsGetValue
VirtualQuery
GetModuleHandleExW
GetCurrentProcess
WaitForMultipleObjects
VirtualFree
VirtualProtect
VirtualAlloc
GetCurrentThreadId
GetUserPreferredUILanguages
LoadLibraryW
GetModuleFileNameW
DeleteCriticalSection
SetLastError
RaiseException
DecodePointer
OutputDebugStringA
WideCharToMultiByte
FormatMessageW
FormatMessageA
LocalFree
GetProcAddress
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsAlloc
GetCurrentProcessId
InitializeCriticalSectionEx
PeekNamedPipe
GetLastError
CloseHandle
RtlCaptureContext
WriteConsoleW
LCMapStringEx
LoadLibraryExA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
OutputDebugStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCPInfo
GetStringTypeW
EncodePointer
HeapSize
HeapReAlloc
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
GetStdHandle
ExitProcess
GetConsoleCP
ReadConsoleW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetConsoleMode

user32

GetUserObjectInformationW
RegisterWindowMessageW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation

advapi32

CreateRestrictedToken
CreateProcessAsUserW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteTreeW
RegDeleteValueW
CheckTokenMembership
RegQueryValueExW
RegEnumValueW
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
SetEntriesInAclW
SetSecurityDescriptorSacl
SetSecurityDescriptorControl
InitializeAcl
GetTokenInformation
AddMandatoryAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
CreateWellKnownSid

shell32

ShellExecuteExW
SHGetKnownFolderPath

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree

oleaut32

SysStringLen
SysFreeString
GetErrorInfo
SetErrorInfo

ws2_32

WSACleanup
WSAStartup

msi

ord92
ord151
ord153
ord78
ord125
ord160
ord159
ord32
ord8
ord20
ord163

Sections

.text
Size: 525KB - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tcreport
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 92.4MB - Virtual size: 92.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f8efb2bceb9e763747e4bfb23244445

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

userenv

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

msi

Sections

.text Size: 525KB - Virtual size: 525KB

.rdata Size: 159KB - Virtual size: 159KB

.data Size: 73KB - Virtual size: 79KB

tcreport Size: 16KB - Virtual size: 15KB

.rsrc Size: 92.4MB - Virtual size: 92.4MB

.text
Size: 525KB - Virtual size: 525KB

.rdata
Size: 159KB - Virtual size: 159KB

.data
Size: 73KB - Virtual size: 79KB

tcreport
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 92.4MB - Virtual size: 92.4MB