Celisor[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Celisor.exe
Size

922KB
MD5

f86985dc7d00b10e22c386a6010b649e
SHA1

c3801bfb433826cbea6da48d87eb77003e336960
SHA256

4eccc4510cc38d91f6e3c087ebf707164bf3b12d985310269fc9f5235a83f646
SHA512

64fcd9b58ba00ffcdcbf2a1f419fa183fe5833db2248cb9b753efe9f011c14fb95ff7647b93aefd937fee0c8f4378fa256c41ff2e8d0ba5385c1c267a707684b
SSDEEP

12288:giO5385L9ldpbSgztCBCmoMofNLianI9p50VKdYphnkAJV80Zvn1fcbT253jff7R:63g9ldUgZCsmo+anI9cZpNFWbC5h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Celisor.exe

Files

Celisor.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\User 1\Downloads\CelisorBETA\CelisorBETA\obj\Release\Celisor.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 736KB - Virtual size: 735KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ