Suspicious ^86% windows

TIMi.TIMi

Signed PE modified post-signing

Elevated NSIS loader with reboot and clipboard accessFile changed after it was signed

SHA-25600e8146faef0e1cd80fa95214bba55b831cee0b3ef93ac18d407e022fb21e764

URLhttps://timi.global.ssl.fastly.net/TIMi_Full/TIMiSetup_Full.exe

MaleculeO₃(C₂DyI)H₆(CmDbF₉Os₆Po₃U)Md₅(Bi₇BkSi₃)

Evidence

Cleartext http:// URL 0x7ed8–0x80c8

⋯7 more rows
0x7f482e002000250064002500250000000000.. .%.d.%.%.....
0x7f5849006e007300740061006c006c006500I.n.s.t.a.l.l.e.
0x7f687200200069006e007400650067007200r. .i.n.t.e.g.r.
0x7f7869007400790020006300680065006300i.t.y. .c.h.e.c.
0x7f886b002000680061007300200066006100k. .h.a.s. .f.a.
0x7f9869006c00650064002e00200043006f00i.l.e.d... .C.o.
0x7fa86d006d006f006e002000630061007500m.m.o.n. .c.a.u.
0x7fb8730065007300200069006e0063006c00s.e.s. .i.n.c.l.
0x7fc87500640065000a0069006e0063006f00u.d.e...i.n.c.o.
0x7fd86d0070006c0065007400650020006400m.p.l.e.t.e. .d.
0x7fe86f0077006e006c006f00610064002000o.w.n.l.o.a.d. .
0x7ff861006e0064002000640061006d006100a.n.d. .d.a.m.a.
0x800867006500640020006d00650064006900g.e.d. .m.e.d.i.
0x801861002e00200043006f006e0074006100a... .C.o.n.t.a.
0x80286300740020007400680065000a006900c.t. .t.h.e...i.
⋯10 more rows

NSIS runtime error title in rdata 0x81c4–0x82f4

⋯3 more rows
0x81f443415451004e544d4152544100000000CATQ.NTMARTA....
0x820453006500530068007500740064006f00S.e.S.h.u.t.d.o.
0x821477006e00500072006900760069006c00w.n.P.r.i.v.i.l.
0x822465006700650000007e006e0073007500e.g.e...~.n.s.u.
0x8234250058002e0074006d00700000000000%.X...t.m.p.....
0x824454004d0050000000540045004d005000T.M.P...T.E.M.P.
0x8254000000004c006f00770000005c005400....L.o.w...\.T.
0x826465006d00700000004e00530049005300e.m.p...N.S.I.S.
0x827420004500720072006f00720000000000 .E.r.r.o.r.....
0x8284000000006f00700065006e0000000000....o.p.e.n.....
⋯7 more rows

Places data onto the Windows clipboard 0x8d8e–0x8e9e

⋯5 more rows
0x8dde65004200436c6f7365436c6970626f61e.B.CloseClipboa
0x8dee726400004a02536574436c6970626f61rd..J.SetClipboa
0x8dfe7264446174610000c100456d70747943rdData....EmptyC
0x8e0e6c6970626f6172640000f6014f70656elipboard....Open
0x8e1e436c6970626f61726400a40254726163Clipboard...Trac
0x8e2e6b506f7075704d656e75000074014765kPopupMenu..t.Ge
⋯7 more rows

AdjustTokenPrivileges API symbol 0x8f8e–0x927e

⋯7 more rows
0x8ffe466f6e74496e64697265637457002900FontIndirectW.).
0x900e4372656174654272757368496e646972CreateBrushIndir
0x901e656374008f0044656c6574654f626a65ect...DeleteObje
0x902e637400006b0147657444657669636543ct..k.GetDeviceC
0x903e617073001502536574426b436f6c6f72aps...SetBkColor
0x904e000047444933322e646c6c0074024d75..GDI32.dll.t.Mu
0x905e6c4469760000840044656c6574654669lDiv....DeleteFi
0x906e6c655700d50046696e64466972737446leW...FindFirstF
0x907e696c65570000dd0046696e644e657874ileW....FindNext
0x908e46696c655700ce0046696e64436c6f73FileW...FindClos
0x909e65001b0353657446696c65506f696e74e...SetFilePoint
0x90ae65720000b5025265616446696c650000er....ReadFile..
0x90be75024d756c746942797465546f576964u.MultiByteToWid
0x90ce654368617200cc036c7374726c656e41eChar...lstrlenA
0x90de00009d01476574507269766174655072....GetPrivatePr
0x90ee6f66696c65537472696e67570000aa03ofileStringW....
0x90fe57726974655072697661746550726f66WritePrivateProf
0x910e696c65537472696e67570000f8004672ileStringW....Fr
0x911e65654c6962726172790054024c6f6164eeLibrary.T.Load
0x912e4c696272617279457857000082014765LibraryExW....Ge
0x913e744d6f64756c6548616e646c65570000tModuleHandleW..
0x914eff01476c6f62616c467265650000f801..GlobalFree....
0x915e476c6f62616c416c6c6f6300bd004578GlobalAlloc...Ex
0x916e70616e64456e7669726f6e6d656e7453pandEnvironmentS
0x917e7472696e67735700c1036c737472636dtringsW...lstrcm
0x918e70570000c4036c737472636d70695700pW....lstrcmpiW.
0x919e3400436c6f736548616e646c65001f034.CloseHandle...
0x91ae53657446696c6554696d65003900436fSetFileTime.9.Co
0x91be6d7061726546696c6554696d6500dc02mpareFileTime...
0x91ce536561726368506174685700b6014765SearchPathW...Ge
0x91de7453686f7274506174684e616d655700tShortPathNameW.
0x91ee6a0147657446756c6c506174684e616dj.GetFullPathNam
0x91fe6557000071024d6f766546696c655700eW..q.MoveFileW.
0x920e0b0353657443757272656e7444697265..SetCurrentDire
0x921e63746f7279570000610147657446696cctoryW..a.GetFil
0x922e65417474726962757465735700001a03eAttributesW....
0x923e53657446696c65417474726962757465SetFileAttribute
0x924e735700005603536c65657000df014765sW..V.Sleep...Ge
0x925e745469636b436f756e74000071014765tTickCount..q.Ge
0x926e744c6173744572726f72000056004372tLastError..V.Cr
0x927e6561746546696c655700630147657446eateFileW.c.GetF

Large PE contains raw admin-manifest literal 0xd418–0xd708

⋯3 more rows
0xd44802003030000001001000a81c00000100..00............
0xd4583c3f786d6c2076657273696f6e3d2231<?xml version="1
0xd4682e302220656e636f64696e673d225554.0" encoding="UT
0xd478462d3822207374616e64616c6f6e653dF-8" standalone=
0xd48822796573223f3e3c617373656d626c79"yes"?><assembly
0xd49820786d6c6e733d2275726e3a73636865 xmlns="urn:sche
0xd4a86d61732d6d6963726f736f66742d636fmas-microsoft-co
0xd4b86d3a61736d2e763122206d616e696665m:asm.v1" manife
0xd4c8737456657273696f6e3d22312e30223estVersion="1.0">
0xd4d83c617373656d626c794964656e746974<assemblyIdentit
⋯13 more rows
0xd5b83c73656375726974793e3c7265717565<security><reque
0xd5c87374656450726976696c656765733e3cstedPrivileges><
0xd5d872657175657374656445786563757469requestedExecuti
0xd5e86f6e4c6576656c206c6576656c3d2272onLevel level="r
0xd5f865717569726541646d696e6973747261equireAdministra
0xd608746f72222075694163636573733d2266tor" uiAccess="f
0xd618616c7365222f3e3c2f72657175657374alse"/></request
⋯15 more rows