Behavioral task
behavioral1
Sample
Celax_crackbykali/loader.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Celax_crackbykali/loader.exe
Resource
win10v2004-20240508-en
General
-
Target
Celax_crackbykali.zip
-
Size
4.0MB
-
MD5
95094158e0c70f7b0cfa28537e02da0b
-
SHA1
5719d1a6010e5278c4bc9b1851389cda5c56f6e9
-
SHA256
4f1e8d4c927455ecb1b5d2cd380cae798dd821a508037feb59aa60214ba40cd7
-
SHA512
098fce8db15a816dcfb18f9c8732c0cd7057aaa0d7203ccb08e4563a8068630a7bbd48ac23d0f1717887f68b4ce765186dc471fc95ce6c8401d0e60a127826dd
-
SSDEEP
98304:XXEb7TuTnsmk8GZ/SS7ynKEMByC6nGx8+OC/PYRtAoe/qfYvlpa:HEksmMZr7GiQGW+OCIQtJlc
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Celax_crackbykali/loader.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Celax_crackbykali/loader.exe
Files
-
Celax_crackbykali.zip.zip
-
Celax_crackbykali/Celax_crackedbykali.1337
-
Celax_crackbykali/loader.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 393KB - Virtual size: 773KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 68KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 192KB - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 18KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 267B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ