Celestial[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

Celestial.dll
Size

950KB
MD5

4e764d6a1c27f431d1da5f28059b7935
SHA1

9dd33479977b479b376b4a193b0eefac59d9d268
SHA256

bf53d266f48796efd0a4521dcfa0aef67e32b91e6ea537a615746901040e29ca
SHA512

a0dcdeafd075d20d2b54d4a244bd46bb389b5376b0f599b33f7de80487e9d8103c35ec16e3adb943728a384deaa67c7281af7ff4dbb60cbbd733913ec9aad0bc
SSDEEP

12288:1zS8xHPH9uokj7LbZDnSAFB87duYOza7kK0yniM1OSelDpfEWmgnfN6u2xt:ZS8xP9Pc7BDVnYTkK0yn81GZMNit

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Celestial.dll

Files

Celestial.dll
.dll windows:6 windows x64 arch:x64

1cd8b5f8659b069a157e7ce13b0391ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
GetLocaleInfoA
CloseHandle
OpenProcess
LocalAlloc
LocalFree
K32EnumProcessModules
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
HeapCreate
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcess
GetCurrentThreadId
OpenThread
GlobalLock
QueryPerformanceCounter
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GlobalUnlock
GlobalAlloc
QueryPerformanceFrequency
WideCharToMultiByte
MultiByteToWideChar
ResumeThread
InitializeSListHead
GlobalFree
GetModuleHandleA
SuspendThread
GetCurrentProcessId

user32

SetCursor
GetCursorPos
ClientToScreen
SetWindowLongPtrA
CallWindowProcA
GetClientRect
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
mouse_event
GetAsyncKeyState
LoadCursorA
SetCursorPos
GetSystemMetrics
OpenClipboard
CloseClipboard
GetForegroundWindow
IsWindowUnicode
ReleaseCapture
SetCapture
GetCapture
SetClipboardData
GetClipboardData
EmptyClipboard
GetKeyboardLayout
TrackMouseEvent
GetKeyState
ScreenToClient

msvcp140

?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z

d3dx9_43

D3DXMatrixTranspose
D3DXVec3Transform

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

d3dcompiler_43

D3DCompile

vcruntime140

__C_specific_handler
memmove
memchr
memcmp
strrchr
longjmp
__current_exception
__current_exception_context
__intrinsic_setjmp
__std_type_info_destroy_list
memset
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
strstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_invalid_parameter_noinfo_noreturn
terminate
_cexit
_beginthreadex
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
_callnewh

api-ms-win-crt-math-l1-1-0

acosf
fmodf
cosf
sinf
pow
ceilf
sqrtf
log
logf
powf

api-ms-win-crt-string-l1-1-0

strncpy
strcmp
strncmp

api-ms-win-crt-stdio-l1-1-0

fclose
fflush
_wfopen
fopen
fread
__stdio_common_vsscanf
fseek
ftell
fwrite
__stdio_common_vsprintf
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtol
atof

Sections

.text
Size: 669KB - Virtual size: 668KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 239KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1cd8b5f8659b069a157e7ce13b0391ab

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

d3dx9_43

imm32

d3dcompiler_43

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

Sections

.text Size: 669KB - Virtual size: 668KB

.rdata Size: 239KB - Virtual size: 239KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 34KB - Virtual size: 34KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 669KB - Virtual size: 668KB

.rdata
Size: 239KB - Virtual size: 239KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 34KB - Virtual size: 34KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB