D:\VisualApps\CeleryAPI\CeleryAPI\obj\Debug\CeleryAPI.pdb
Overview
overview
3Static
static
3V3.zip
windows10-1703-x64
1V3.zip
windows10-2004-x64
1V3.zip
windows11-21h2-x64
1V3/CeleryAPI.dll
windows10-1703-x64
1V3/CeleryAPI.dll
windows10-2004-x64
1V3/CeleryAPI.dll
windows11-21h2-x64
1V3/CeleryIn.dll
windows10-1703-x64
1V3/CeleryIn.dll
windows10-2004-x64
1V3/CeleryIn.dll
windows11-21h2-x64
1V3/CeleryInjector.exe
windows10-1703-x64
1V3/CeleryInjector.exe
windows10-2004-x64
1V3/CeleryInjector.exe
windows11-21h2-x64
1Static task
static1
Behavioral task
behavioral1
Sample
V3.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
V3.zip
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
V3.zip
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
V3/CeleryAPI.dll
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
V3/CeleryAPI.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral6
Sample
V3/CeleryAPI.dll
Resource
win11-20240704-en
Behavioral task
behavioral7
Sample
V3/CeleryIn.dll
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
V3/CeleryIn.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
V3/CeleryIn.dll
Resource
win11-20240704-en
Behavioral task
behavioral10
Sample
V3/CeleryInjector.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
V3/CeleryInjector.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral12
Sample
V3/CeleryInjector.exe
Resource
win11-20240508-en
General
-
Target
V3.zip
-
Size
923KB
-
MD5
627c1b98d81bd8f04aa8226d2a7abfae
-
SHA1
4383ba9d2d12b05871ba9d726420206bac71e4a6
-
SHA256
9eef3697be227b514a2de14e5747f13dfe2143006cc471f4e8f14df607b19871
-
SHA512
dc98bcf1643025f16e896c996b9f9f6c891c0c6b02c3cafc20859442e1c6304d9f3ba3b7884d4d3327e99f2c7ea79cd5cfb3261c5e42059c21913c40f574c910
-
SSDEEP
24576:sg7rrAFfaYC8er6dG4jCyLuV6r5NKq53bcvgbfW/SrZD6/:sgjAEDVr6U4ja6r5sG3bggaW6/
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/V3/CeleryAPI.dll unpack001/V3/CeleryIn.bin unpack001/V3/CeleryInjector.exe
Files
-
V3.zip.zip
-
V3/CeleryAPI.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 932B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
V3/CeleryIn.bin.dll windows:6 windows x64 arch:x64
fe78118d64d767d704fee2343d26ea59
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetProcessHeaps
HeapWalk
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
vcruntime140
memset
__std_type_info_destroy_list
__C_specific_handler
memcpy
api-ms-win-crt-string-l1-1-0
tolower
strlen
api-ms-win-crt-convert-l1-1-0
_ui64toa_s
_gcvt_s
_itoa_s
_itoa
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
exit
_initialize_narrow_environment
_cexit
_configure_narrow_argv
_execute_onexit_table
_seh_filter_dll
_initterm_e
_initterm
Exports
Exports
celerycmd
icallback
init
test
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
V3/CeleryInjector.exe.exe windows:6 windows x64 arch:x64
2815423b12fff7c32f137d69c0403656
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\Javan\Desktop\Projects\Release\CeleryInject.pdb
Imports
kernel32
GetThreadContext
VirtualAllocEx
VirtualProtectEx
ReadProcessMemory
WriteProcessMemory
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalUnlock
GlobalLock
lstrcpynW
lstrcpyW
lstrcatW
lstrlenW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
K32EnumProcessModules
K32GetModuleFileNameExW
K32QueryWorkingSetEx
GetCurrentProcess
ResumeThread
QueryPerformanceCounter
QueryPerformanceFrequency
VirtualQueryEx
OpenProcess
lstrcmpiW
Process32FirstW
Process32NextW
SuspendThread
GetThreadPriority
OpenThread
GetLastError
CloseHandle
GetTempPathW
GetFileAttributesW
DeleteFileW
CreateDirectoryW
lstrlenA
Sleep
TerminateProcess
InitializeSListHead
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
user32
GetClipboardData
FindWindowW
SetClipboardData
CloseClipboard
FindWindowA
EmptyClipboard
OpenClipboard
msvcp140
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bios_base@std@@QEBA_NXZ
?rdstate@ios_base@std@@QEBAHXZ
?fail@ios_base@std@@QEBA_NXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
urlmon
URLOpenBlockingStreamA
ntdll
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
NtQueryInformationProcess
shlwapi
PathRemoveFileSpecW
vcruntime140
_purecall
memcpy
memchr
memmove
_CxxThrowException
__std_exception_destroy
memset
__current_exception_context
__current_exception
__C_specific_handler
strchr
memcmp
__std_exception_copy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_c_exit
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_set_app_type
__p___argv
_seh_filter_exe
_cexit
_crt_atexit
system
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
terminate
_configure_narrow_argv
_errno
_invalid_parameter_noinfo_noreturn
exit
__p___argc
api-ms-win-crt-string-l1-1-0
isupper
strnlen
strpbrk
isdigit
toupper
_memicmp
strspn
strcspn
isxdigit
strncat
strncpy
strncmp
islower
tolower
isalpha
isalnum
iscntrl
isgraph
isspace
ispunct
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
ungetc
fclose
_set_fmode
setvbuf
__stdio_common_vsnprintf_s
fwrite
_fseeki64
fsetpos
fread
__p__commode
fputc
_get_stream_buffer_pointers
__acrt_iob_func
__stdio_common_vfprintf
fflush
__stdio_common_vsprintf
fgetpos
fgetc
__stdio_common_vsprintf_s
_wfopen
__stdio_common_vfwprintf
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-convert-l1-1-0
strtoul
strtoull
atoi
strtod
api-ms-win-crt-filesystem-l1-1-0
_wmkdir
_waccess_s
_unlock_file
_lock_file
_wstat64
api-ms-win-crt-time-l1-1-0
_difftime64
_gmtime64_s
_localtime64_s
_time64
strftime
clock
api-ms-win-crt-math-l1-1-0
tanh
_dsign
cosh
sqrt
floor
frexp
modf
sinh
round
floorf
acos
sin
cos
pow
asin
atan
tan
atan2
log2
log10
ldexp
log
fmod
__setusermatherr
ceil
exp
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 736KB - Virtual size: 736KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 100KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 133KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ