S:\tcaddin\Output\setup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
setup_think-cell_35490.exe
Resource
win10v2004-20240704-es
General
-
Target
setup_think-cell_35490.exe
-
Size
93.9MB
-
MD5
3fc5a9ba29364e05235327ec29291206
-
SHA1
8ef6228775a5997db0b0afd3f7ff423d84dff949
-
SHA256
67f1647a6bbd803cbe3ac9b28a4e796d2f8e0e42ea7227602ad8a505cd11da02
-
SHA512
45a4a8089be5fc53d19a7ea51495393f1e06b3c8167a8547989db03f6e3e3e2b936385242f2c993e22c80048191a79b8ff83b9721944fbf9f5242c94a7e9cf08
-
SSDEEP
1572864:OlSq7cupMKAdERmENT5BCm5xLYlRwgmDmHvYutgrtVz+T55u4asL7A:OlJA2RBT50OulRqDuvSrthU5Zaak
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource setup_think-cell_35490.exe
Files
-
setup_think-cell_35490.exe.exe windows:6 windows x86 arch:x86
8f8efb2bceb9e763747e4bfb23244445
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
userenv
GetProfileType
kernel32
GetEnvironmentVariableW
CreateDirectoryW
GetTempPathW
GetSystemDirectoryW
LoadResource
LockResource
SizeofResource
FindResourceW
IsDebuggerPresent
GetLocaleInfoEx
GetCommandLineW
CreateFileW
DeleteFileW
SetFileInformationByHandle
CompareStringEx
CompareStringOrdinal
GetFileAttributesW
RemoveDirectoryW
SetFileAttributesW
MoveFileExW
WaitForSingleObject
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
FindClose
FindNextFileW
OpenMutexW
CreateEventExW
CreatePrivateNamespaceW
OpenPrivateNamespaceW
ClosePrivateNamespace
CreateBoundaryDescriptorW
AddSIDToBoundaryDescriptor
DeleteBoundaryDescriptor
LocalAlloc
AddIntegrityLabelToBoundaryDescriptor
GetDriveTypeW
GetFullPathNameW
GetVolumeInformationW
GetVolumePathNameW
SetEvent
TerminateProcess
VerSetConditionMask
FreeLibrary
ExpandEnvironmentStringsW
GetSystemInfo
GetTimeZoneInformation
GetTickCount
MultiByteToWideChar
K32EnumProcessModules
ReadFile
WriteFile
GetOverlappedResult
CreateEventW
DuplicateHandle
ConnectNamedPipe
CreateNamedPipeW
CancelIo
CreateProcessW
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetFileInformationByHandle
FlushFileBuffers
SetEndOfFile
SetFilePointerEx
DeviceIoControl
AreFileApisANSI
SetStdHandle
GetFileType
LoadLibraryExW
RtlUnwind
GetVersionExW
InterlockedExchange
InitializeSListHead
GetProcessHeap
TlsSetValue
TlsGetValue
VirtualQuery
GetModuleHandleExW
GetCurrentProcess
WaitForMultipleObjects
VirtualFree
VirtualProtect
VirtualAlloc
GetCurrentThreadId
GetUserPreferredUILanguages
LoadLibraryW
GetModuleFileNameW
DeleteCriticalSection
SetLastError
RaiseException
DecodePointer
OutputDebugStringA
WideCharToMultiByte
FormatMessageW
FormatMessageA
LocalFree
GetProcAddress
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsAlloc
GetCurrentProcessId
InitializeCriticalSectionEx
PeekNamedPipe
GetLastError
CloseHandle
RtlCaptureContext
WriteConsoleW
LCMapStringEx
LoadLibraryExA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
OutputDebugStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCPInfo
GetStringTypeW
EncodePointer
HeapSize
HeapReAlloc
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
GetStdHandle
ExitProcess
GetConsoleCP
ReadConsoleW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetConsoleMode
user32
GetUserObjectInformationW
RegisterWindowMessageW
CharUpperBuffW
MessageBoxW
GetProcessWindowStation
advapi32
CreateRestrictedToken
CreateProcessAsUserW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteTreeW
RegDeleteValueW
CheckTokenMembership
RegQueryValueExW
RegEnumValueW
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
SetEntriesInAclW
SetSecurityDescriptorSacl
SetSecurityDescriptorControl
InitializeAcl
GetTokenInformation
AddMandatoryAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
CreateWellKnownSid
shell32
ShellExecuteExW
SHGetKnownFolderPath
ole32
CoInitializeEx
CoUninitialize
CoTaskMemFree
oleaut32
SysStringLen
SysFreeString
GetErrorInfo
SetErrorInfo
ws2_32
WSACleanup
WSAStartup
msi
ord92
ord151
ord153
ord78
ord125
ord160
ord159
ord32
ord8
ord20
ord163
Sections
.text Size: 525KB - Virtual size: 525KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 159KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 73KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tcreport Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 93.1MB - Virtual size: 93.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ