Static task
static1
Behavioral task
behavioral1
Sample
CeylinFree.exe
Resource
win10v2004-20230915-de
General
-
Target
CeylinFree.exe
-
Size
1.0MB
-
MD5
b179bf596b1b506a7deb43475062de16
-
SHA1
2782614df53152a7d01f5a4493051d53d9cc2191
-
SHA256
d3c1aeb25e5d530a9158987887223fbbb59d52fd58c6169ef93db1109a502bd3
-
SHA512
0b3a8462b2164ac8574d5be1acf5e4043d0c8f43d589d74fce78c64443c608b700195d998ba4e3a0215c8b1e42da3e2f550a373d7dd5f43fed95ed4427b518d2
-
SSDEEP
24576:rG+eXwJLE2uzTZXTukngnGbnOmvZnCVgHncSs7+sNS/h4IX:rGnD7vZnCanm7+l54IX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CeylinFree.exe
Files
-
CeylinFree.exe.exe windows:6 windows x64
500f094ee2d3c5a0c17b336e9cbd9748
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetModuleHandleW
VirtualQueryEx
Process32FirstW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
Process32NextW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OpenProcess
Module32NextW
WideCharToMultiByte
Module32FirstW
CloseHandle
CreateToolhelp32Snapshot
WriteProcessMemory
GetTickCount
WakeAllConditionVariable
ReadProcessMemory
user32
TranslateMessage
SetWindowLongW
GetAsyncKeyState
SetLayeredWindowAttributes
GetForegroundWindow
PostQuitMessage
FindWindowA
UpdateWindow
PeekMessageW
DestroyWindow
DispatchMessageW
UnregisterClassA
GetKeyState
GetMessageExtraInfo
ScreenToClient
ShowWindow
mouse_event
GetWindowLongW
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
DefWindowProcW
SetCapture
LoadCursorW
SetWindowPos
RegisterClassExW
TrackMouseEvent
CreateWindowExW
UnregisterClassW
ClientToScreen
GetCapture
SetWindowDisplayAffinity
msvcp140
_Query_perf_frequency
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_counter
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
strstr
_purecall
__std_exception_copy
__std_exception_destroy
memchr
memcmp
memmove
memcpy
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_c_exit
_get_initial_narrow_environment
__p___argv
_set_app_type
__p___argc
_invalid_parameter_noinfo_noreturn
system
_exit
_initterm
_initterm_e
_register_thread_local_exe_atexit_callback
exit
api-ms-win-crt-stdio-l1-1-0
_wfopen
fwrite
fread
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
ftell
_set_fmode
__stdio_common_vsprintf
__stdio_common_vsscanf
__p__commode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
acosf
logf
fmodf
tanf
tan
pow
powf
log
sin
sinf
sqrt
sqrtf
atanf
cos
cosf
atan2f
__setusermatherr
Sections
.text Size: 630KB - Virtual size: 630KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 828B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ