�T�I�?`1��-�[-�����/!�9Ñ��J��M����|�������5El��J�i^,S��C��ս�@[���g�Yh�aj�%������ܵ�L���N��T+�G�?��m���ck�7����1��nȺp���|i����@�SGƎ�S���0���]J��F�P�/_��]Ռ�e�A��z��*+Y!�������)�h�o=|j�h1i�vB~��F�O����%�.bQ�[~��m2ꖨ�r�2~K3+)^;�.������;�Ӆ�,�ej�ޛ�����?p}* �5�֕�eE;t ��]��(³�@���GD��#��)�G���P�r�`��/�m���#���L�H�Љq����dN�w�fߡgvm�����\�- �OD`��ts��{��l���F�1��`y]�i?/���{����081�'� ����3ӵ�������Xt�<�%z1lܠ��>6�jWϣ,��X������e�r ���+�8�҅=ο9b���5_||����@��`�$D�t-˓$x����r��vh�y�}�!����0��>�<N>�|�����J6*�F��`9u2���n�%&��M��X|�.Cb��y��^�����}����#���������8x�R���"#DC~ڱ���2��Y��T`X lB�6I/xe�"(���1�M���_�C�>"dZ��c.�<g<s<��h���@��BL#mb��\Gl��P, χ�k�̱�*8R�u�'.Z5�pv���OH(�j��11�[l��V��+��/��;���i��I1}���\&��8(i��Z�Qub�t!lh':�G�0M�?!�8�ET1(OS�K(���v�o"�d>L��T�`e��ԭ�bY��C9�����-�7����]�D�����h�b=��F�Y���T�<X������Oo>���O�� ���IWu4�k�PU>S���4��̻s��5ͩ�:])~��%-h:��aq7��<���Z��E��R��v�пכj�ߓ!<+�?ĺ�#�o�m�����D���& ��}H![�1\�����9i����{�j]b�q������ihъ7D����B����f�M�j��ݔC����3�ᧀGK܇�p~�M6x�E���"&��\l��,����>5�?������,�<w�ð���6��B*�#��v��9�Sf9fլ]�/��r���a���v'��r]�wo/x���G���HL���Z*���"؝>NO��L�f��lJ/$1�N1�t1Dj݅���F�G�6�N�X���vv���:d����)Nr��+Wjȑã��<�ݙ�{�8%�K=��ޏ-�a�������=�y�q��1��*���&K�C��_Еq�i��r��r�<ϔ�)!����9�9X�0��Q�*4��f1����E��G�����,@=�k�N)��c�n�oӼOY:�����������2p�#���3W�^��u�m�~0�� unb�Ўx<�K/c��e����Kd��(4��o-֪�ҽ�))d��5yf m?����)h�5C�W �uىO�n~o��T�@�1���e�n�?�֦���S�?�&��/�x�7iV<�C���^B�������HZ�Ɛ��o��P�s[�Ӄs��4��5�����V'�HShMU�HQ�ʾ��~��n�L-VS�p��M�]0E|��ugA��t�����K��j��i���O&���,������zY�����q�aB�?�mY�"�}B}.1o�WwugS~���i;{ץ+�I���#Z;=�y�KDŽ��o�5e����6 M9:Y~�� ������)�6�����`�oP \nF]�A� ��R��]��찖&w��0�NW �c]�1n���>�b0ў2*O���,���q�������2�����Z�v����R��^���[�(Psꂩ~2�FÈ2����Z���}��r�z��'�;�XӮ&����d� |k��3�O;q���$RQ��4��c�E�aDyW����C�� ����L_\DP��(�W���N�����G�0���~%2�֕�vyf�E)[^���|�����7f B�\R8ݟZ!aZp$�Zě;S���wO'\�Oa�T��Q;hG��X������%W�i����Q�����:����%�5�<��$�L$& ��^���[>�tyH9�-��Ї�<�_������#����2�Qd���|�zlc����Fǯ���H!A�g����I2L=��rQd�d��[#ܻr�^t � ����������u]�y�T����h1�)>�X�;e �;���!����q獙j �J��{��P� VGAk�}<w�c��%�$b"j�Q)o.y �!�<��z���=��ؘ�Ů}X��v\�$?��B�׀׀)\����d�2aG6����n��ie���1�MU��@S�:an�8_�;Fz8gD!�c�!����4zd|�)�K�t��ZX�"Һ(m���*���-ů7[]�̩bOS�l�a ص��W���ۮk�i�����Bp�A۪�����>��E�NX�*�Q��^:אַm�s�rT�<c ����ы��EYI5�d��1d��X�^��t��/_� � f��l�!���=��`���B0=�ztKo^:B�Ƨ�#1�k�^ -WER����mڞÃiwR?��ʓ�9� �5�'�43-Oc�]�e9����&t)�C{����/��h�fߡ6�B��!�o��^���^]pJ����� 9��t�d�g�ԝ��[Юt�;ڨ�k�:����>f�dZ�� ��T���.��oԺ�]�������Q;�����~��]�����4h�&�L��J�]vKP6� 2xIQe���/KAKqA�])��o��g[�H�R�T�?�XE�[�Rήr�$��d\���o�-ZA�g]gne.�h�rJ����@��Cg�y�!F�0&,]P*a����D8�C���u��ӡܫ���P�����W�hX��,�Hڀ=iNws�m��n&<<����Cw*^�g�� ��Ӌ-�x2�R��������%z8p���駥.Ga���x���qK`BU�f8I8
Static task
static1
Behavioral task
behavioral1
Sample
cracked.celka.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cracked.celka.exe
Resource
win10v2004-20220812-en
General
-
Target
cracked.celka.exe
-
Size
6.7MB
-
MD5
62ab9b9303b1266cb40fab9220366a67
-
SHA1
769c0ef2cc40ff42c0672b8aab0de8844ef57043
-
SHA256
1d50e587e37058490a993a948e71164d3a4177cd5a488c8f445499c03cb09335
-
SHA512
bd939e66cac7e3fabde0b3aee983bf50875ad3e227a96e7c40d848f522b2aeb6a4eeb2ce49a4fabc457107cd0c653fb1ca7762f4295e8b6d0f74a3eca6f8955f
-
SSDEEP
98304:7lGfmRrhQR9j5JZB2DmQ0eNJdA9FDcs9SY8ZOPaQ9cNCekoY++OCEQ7vNR:9RrSR9tJbZWwqs9SY8kcNCX02l
Malware Config
Signatures
Files
-
cracked.celka.exe.exe windows x64
b256c77d814c283870c896f0d1718757
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetSystemInfo
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
ole32
CoCreateInstance
oleaut32
SysAllocStringLen
ws2_32
socket
ntdll
RtlCaptureContext
wininet
DeleteUrlCacheEntry
urlmon
URLOpenBlockingStreamA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.a0 Size: - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.a1 Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ