Celestial[.]exe | Triage

Sharing

General

Target

Celestial.exe
Size

273KB
MD5

7ca6a26751bd7ad90ffc2843f040117c
SHA1

5c2be81194456480f952d674c0513959eab0ceda
SHA256

c13b27db146974839ceeb088132e55627944f9a230392e4f8661749586a3626a
SHA512

0f16bbf19913c4c09a13ea48325a3751311941b2d6b11a70a97737628c53bd58b8009fa9439e3b0ce66ef0e46dc420a6535b2d8803cbf6669d024c3c4ea3b896
SSDEEP

6144:Of+BLtABPD7sBi/0QNE44FCpHoafTy/lI1D0NiJ:essK44FCpO61DzJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

Celestial.exe

Files

Celestial.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\skaf8\Desktop\44CALIBER-main\44CALIBER\obj\Release\Insidious.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 271KB - Virtual size: 270KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ