setup_think-cell_35490_1260n[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

setup_think-cell_35490_1260n.exe
Size

93.9MB
MD5

59577bc9104565f637bbd0890c18a48b
SHA1

575cae6f9e55eceb63b8b3ffecc1dfe153391533
SHA256

15956ed5edcd89641c85d4138397c19b48143726c46553d831ca5664489d1cea
SHA512

84cf066e0501eac13a3e854d37c551baa7a574ead80358589e4a9f7cc67b5a8e131ec69a7aee84ba972773dd9414a8e58c9f74d38e9ab3bd8b6586a0ee93fa88
SSDEEP

1572864:4xcxAn2Lmug1JDSLht3e5awjgIeGmHEraObiRura8mg7Ew1ZW7mGQ1U6lTjb7rV6:bxAn2yuyDSLrECI/mkf4Gf8MVdf7aDrb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
setup_think-cell_35490_1260n.exe

Files

setup_think-cell_35490_1260n.exe
.exe windows:6 windows x86 arch:x86

8f8efb2bceb9e763747e4bfb23244445

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

S:\tcaddin\Output\setup.pdb

Imports

userenv

GetProfileType

kernel32

GetEnvironmentVariableW
CreateDirectoryW
GetTempPathW
GetSystemDirectoryW
LoadResource
LockResource
SizeofResource
FindResourceW
IsDebuggerPresent
GetLocaleInfoEx
GetCommandLineW
CreateFileW
DeleteFileW
SetFileInformationByHandle
CompareStringEx
CompareStringOrdinal
GetFileAttributesW
RemoveDirectoryW
SetFileAttributesW
MoveFileExW
WaitForSingleObject
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
FindClose
FindNextFileW
OpenMutexW
CreateEventExW
CreatePrivateNamespaceW
OpenPrivateNamespaceW
ClosePrivateNamespace
CreateBoundaryDescriptorW
AddSIDToBoundaryDescriptor
DeleteBoundaryDescriptor
LocalAlloc
AddIntegrityLabelToBoundaryDescriptor
GetDriveTypeW
GetFullPathNameW
GetVolumeInformationW
GetVolumePathNameW
SetEvent
TerminateProcess
VerSetConditionMask
FreeLibrary
ExpandEnvironmentStringsW
GetSystemInfo
GetTimeZoneInformation
GetTickCount
MultiByteToWideChar
K32EnumProcessModules
ReadFile
WriteFile
GetOverlappedResult
CreateEventW
DuplicateHandle
ConnectNamedPipe
CreateNamedPipeW
CancelIo
CreateProcessW
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetFileInformationByHandle
FlushFileBuffers
SetEndOfFile
SetFilePointerEx
DeviceIoControl
AreFileApisANSI
SetStdHandle
GetFileType
LoadLibraryExW
RtlUnwind
GetVersionExW
InterlockedExchange
InitializeSListHead
GetProcessHeap
TlsSetValue
TlsGetValue
VirtualQuery
GetModuleHandleExW
GetCurrentProcess
WaitForMultipleObjects
VirtualFree
VirtualProtect
VirtualAlloc
GetCurrentThreadId
GetUserPreferredUILanguages
LoadLibraryW
GetModuleFileNameW
DeleteCriticalSection
SetLastError
RaiseException
DecodePointer
OutputDebugStringA
WideCharToMultiByte
FormatMessageW
FormatMessageA
LocalFree
GetProcAddress
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsAlloc
GetCurrentProcessId
InitializeCriticalSectionEx
PeekNamedPipe
GetLastError
CloseHandle
RtlCaptureContext
WriteConsoleW
LCMapStringEx
LoadLibraryExA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
OutputDebugStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCPInfo
GetStringTypeW
EncodePointer
HeapSize
HeapReAlloc
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
GetStdHandle
ExitProcess
GetConsoleCP
ReadConsoleW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetConsoleMode

user32

GetUserObjectInformationW
RegisterWindowMessageW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation

advapi32

CreateRestrictedToken
CreateProcessAsUserW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteTreeW
RegDeleteValueW
CheckTokenMembership
RegQueryValueExW
RegEnumValueW
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
SetEntriesInAclW
SetSecurityDescriptorSacl
SetSecurityDescriptorControl
InitializeAcl
GetTokenInformation
AddMandatoryAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
CreateWellKnownSid

shell32

ShellExecuteExW
SHGetKnownFolderPath

ole32

CoInitializeEx
CoUninitialize
CoTaskMemFree

oleaut32

SysStringLen
SysFreeString
GetErrorInfo
SetErrorInfo

ws2_32

WSACleanup
WSAStartup

msi

ord92
ord151
ord153
ord78
ord125
ord160
ord159
ord32
ord8
ord20
ord163

Sections

.text
Size: 525KB - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

tcreport
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 93.1MB - Virtual size: 93.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f8efb2bceb9e763747e4bfb23244445

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

userenv

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

msi

Sections

.text Size: 525KB - Virtual size: 525KB

.rdata Size: 159KB - Virtual size: 159KB

.data Size: 73KB - Virtual size: 79KB

tcreport Size: 16KB - Virtual size: 15KB

.rsrc Size: 93.1MB - Virtual size: 93.1MB

.text
Size: 525KB - Virtual size: 525KB

.rdata
Size: 159KB - Virtual size: 159KB

.data
Size: 73KB - Virtual size: 79KB

tcreport
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 93.1MB - Virtual size: 93.1MB