CelWare V.1.1.0.zip
- SHA256 4ce2c6bf245f074b93f3b2d1a30ad89da434d6dbe7914b8c05612c9b2729d23d
Overview
overview
8Static
static
3CelWare V.1.1.0.zip
windows10-2004-x64
1CelWare V.1.1.0.zip
windows11-ltsc_2024-x64
1CelWare V....er.exe
windows10-2004-x64
1CelWare V....er.exe
windows11-ltsc_2024-x64
1CelWare V....on.txt
windows10-2004-x64
1CelWare V....on.txt
windows11-ltsc_2024-x64
1CelWare V....gn.exe
windows10-2004-x64
5CelWare V....gn.exe
windows11-ltsc_2024-x64
5CelWare V....re.exe
windows10-2004-x64
1CelWare V....re.exe
windows11-ltsc_2024-x64
1CelWare V....re.exe
windows10-2004-x64
8CelWare V....re.exe
windows11-ltsc_2024-x64
8CelWare V....re.pdb
windows10-2004-x64
3CelWare V....re.pdb
windows11-ltsc_2024-x64
3CelWare V....g.json
windows10-2004-x64
3CelWare V....g.json
windows11-ltsc_2024-x64
3CelWare V....it.dll
windows10-2004-x64
1CelWare V....it.dll
windows11-ltsc_2024-x64
1CelWare V....PI.dll
windows10-2004-x64
1CelWare V....PI.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CelWare V.1.1.0.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
CelWare V.1.1.0.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
CelWare V.1.1.0/Bin/Decompiler.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
CelWare V.1.1.0/Bin/Decompiler.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
CelWare V.1.1.0/Bin/current_version.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
CelWare V.1.1.0/Bin/current_version.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
CelWare V.1.1.0/Bin/erto3e4rortoergn.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral8
Sample
CelWare V.1.1.0/Bin/erto3e4rortoergn.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
Behavioral task
behavioral9
Sample
CelWare V.1.1.0/CelWare.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
CelWare V.1.1.0/CelWare.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
CelWare V.1.1.0/CelWare.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral12
Sample
CelWare V.1.1.0/CelWare.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
300 seconds
Behavioral task
behavioral13
Sample
CelWare V.1.1.0/CelWare.pdb
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral14
Sample
CelWare V.1.1.0/CelWare.pdb
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral15
Sample
CelWare V.1.1.0/CelWare.runtimeconfig.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral16
Sample
CelWare V.1.1.0/CelWare.runtimeconfig.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral17
Sample
CelWare V.1.1.0/ICSharpCode.AvalonEdit.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
CelWare V.1.1.0/ICSharpCode.AvalonEdit.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
CelWare V.1.1.0/QuorumAPI.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
CelWare V.1.1.0/QuorumAPI.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target CelWare V.1.1.0.zip
- Size 29.9MB
- Sample260810-hc2fjsshne
- SHA256 4ce2c6bf245f074b93f3b2d1a30ad89da434d6dbe7914b8c05612c9b2729d23d
- MD5 38a2d40b6e6784a1281d516279fa8d4a
- SHA1 70aff8b73c187e8c98a3a6c10e4efab2b6f17ef6
- SHA512 acffb9c3bcf456494ee756a9aa9919c728d68cd87862b11ff56a6e1f4483297f7e3d2eb243dfaac7bac4798e6b60a78a7a72b982c5d7757bd1d04c956e1be8e4
- SSDEEP 786432:EXRBhtR/hhpfpHdEWM/xyKet32K5z7HP+Nr8iCFeVch9m0FP:+RJp5hGvxQwK5vHPYre9/h
- TLSH T1B767337A857D94FE48F006EBDD9DF3943871A8ACE32BFD5A1C32250BBC649821541E63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/CelWare V.1.1.0/Bin/Decompiler.exe unpack001/CelWare V.1.1.0/Bin/erto3e4rortoergn.exe unpack001/CelWare V.1.1.0/CelWare.dll unpack001/CelWare V.1.1.0/CelWare.exe unpack001/CelWare V.1.1.0/ICSharpCode.AvalonEdit.dll unpack001/CelWare V.1.1.0/QuorumAPI.dll
File Explorer
-
CelWare V.1.1.0.zip.zip 29.9MB
-
CelWare V.1.1.0/Bin/Decompiler.exe.exe 9.4MB
-
CelWare V.1.1.0/Bin/current_version.txt5B
-
CelWare V.1.1.0/Bin/erto3e4rortoergn.exe.exe 30.1MB
-
CelWare V.1.1.0/CelWare.dll.exe 549KB
-
CelWare V.1.1.0/CelWare.exe.exe 182KB
-
CelWare V.1.1.0/CelWare.pdb23KB
-
CelWare V.1.1.0/CelWare.runtimeconfig.json429B
-
CelWare V.1.1.0/ICSharpCode.AvalonEdit.dll.dll 607KB
-
CelWare V.1.1.0/QuorumAPI.dll.dll 369KB
CelWare V.1.1.0/Bin/Decompiler.exe
- IMPHASH 8d1d7934b800e4ac91064a5f9d0c910f
- SHA256 fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8
- MD5 a109790efbe0542dddf63ef0415dd508
- SHA1 34d3f0c57dd5359f21bee246e00ee01f69132678
- SHA512 a148f1b6a5423147651ab12fad0250ff000efb605e7d468fa45d1e1c1bba71bf2748741d9e62aa72228b9e674d3766d736df64e81b85c9d441e840e0bed75d7f
- SSDEEP 49152:AhW7+AqGnMYHZi0h/tipa/lZ9dco869rpyd8cuIhwSt+AOaQXkiShcwaPJXqlExR:UkDPUKXmtGYGz2YhN
- TLSH T124A6C62A676960D9C1BFC07892839F22BD21749D073977F7898182692F20EF87D3D764
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7445708
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
decomp_server.pdb
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcryptprimitives
ProcessPrng
kernel32
GetCurrentThreadId
SetFileCompletionNotificationModes
GetLastError
Sleep
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
InitializeSListHead
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
GetSystemInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
IsDebuggerPresent
UnhandledExceptionFilter
GetStdHandle
GetCurrentProcessId
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
PostQueuedCompletionStatus
GetProcessHeap
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
SetHandleInformation
GetFileInformationByHandleEx
GetFinalPathNameByHandleW
GetModuleHandleW
FormatMessageW
GetConsoleOutputCP
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
HeapAlloc
GetFileType
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetQueuedCompletionStatusEx
SetConsoleMode
GetConsoleMode
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
CloseHandle
SetUnhandledExceptionFilter
GetCurrentProcess
CreateIoCompletionPort
IsProcessorFeaturePresent
ws2_32
WSAStartup
WSAGetLastError
WSACleanup
ioctlsocket
setsockopt
closesocket
WSASend
send
recv
shutdown
getsockname
accept
listen
bind
WSASocketW
WSAIoctl
ntdll
NtCancelIoFileEx
NtDeviceIoControlFile
NtWriteFile
RtlNtStatusToDosError
NtCreateFile
vcruntime140
__current_exception_context
memcpy
__current_exception
__CxxFrameHandler3
__C_specific_handler
_CxxThrowException
memcmp
memmove
memset
api-ms-win-crt-math-l1-1-0
pow
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_initterm_e
exit
_exit
__p___argc
_set_app_type
_seh_filter_exe
__p___argv
_cexit
_initialize_narrow_environment
_initterm
_configure_narrow_argv
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_c_exit
_get_initial_narrow_environment
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Name
.text
Size
7.1MB
Virtual Size
7.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
501KB
Virtual Size
501KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=34321,
count=3, id=259, version=34321,
count=9, id=260, version=34321,
count=23, id=261, version=34321,
count=203, id=1, productName=Unmarked objects,
count=1152, productName=Unmarked objects (old),
count=1, id=258, version=34435,
CelWare V.1.1.0/Bin/current_version.txt
- SHA256 dcd17f34d5ea3ab83d52607a49c50a505b7285dc2710f9bd891aae49436c16c3
- MD5 7461df82ce707677f20a34b947284d6c
- SHA1 4db1f31ac8b042e0ba76d72e1d1c675413946d85
- SHA512 d74d5bd3bd6b6b26156ad3a897438312d2d61d4a5bbb4d5eebd07af4e5f6712095a40fd537bcce3249049376bd02acfa1d389cc106814bd4eb0055b7d18327fb
- MD5 SHA1 SHA512
CelWare V.1.1.0/Bin/erto3e4rortoergn.exe
- IMPHASH 79a7c0e3c1a1b9d4e761fae93f30c57a
- SHA256 c4a8e9064cf39e9b06a84c9cd8e4ab7a51347ef509807b52c6acc508b4271d0d
- MD5 9356728bccf5c0c207b6664a64a376c8
- SHA1 30e50fc753a05bde53a67fdaaa0872ed35e019ca
- SHA512 5ca5b30a9edc9e10913aeb58d16bc9d0c92e58374a4a60f67dc6e0a1389647152b6d938374024ae7f1fbba8033895adf26b55a2b9d951e0dcdc01d81221a305a
- SSDEEP 786432:QwOusLTll/KusdtUAMbhYSb3bDRFJ3bd:GLBoJtmOSbrDRR
- TLSH T1E86723C265D572D49BD30544638E12DE22C2A87985FD99297EC61C039F30EFF2998EB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
31938983
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetStdHandle
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
msvcp140
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
wintrust
WinVerifyTrust
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.nf6c4q
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bt2h5s
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wp5d1n
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.lq7z2p
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pr2v5x
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nz4w6v
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bg6s1n
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.kx8b4j
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.qf9c1l
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.xh3g5w
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.sk1y9t
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rl8p3q
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.xk7m9
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tm8h3x
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ds3c8l
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.qt4y8m
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vw5z2n
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.hy1q7m
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bl6y9s
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.jy7d8x
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.cv4b8m
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mp6g3k
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.mz8d7l
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.nx2w5v
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fj9r6k
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fl7r2p
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rt9f6p
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.jw9k3h
Size
Virtual Size
652B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tempest
Size
Virtual Size
17.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.tempest
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tempest
Size
30.1MB
Virtual Size
30.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
CelWare V.1.1.0/CelWare.dll
- SHA256 a11686258460cbc2dad26eee82fab3058fe3d0a866817016d55153bd523a73d5
- MD5 b86c5a7d023a07d48d2f10be0306168f
- SHA1 f9ec9352be7fec2a14f15ca37980c5cd318e4a5c
- SHA512 eb55cc6adaa206078b3e4d4b14c9db06dce673892e1454bfdc9bb846ddd765eeb4aed2289e0259704f24170d8b04f6935ae99d11018cd5599200d22b90fd6289
- SSDEEP 12288:MXioxVtQVyJCTLnjCAxKFvKcqT0vv5549y8rW48N5v5KhNy4Yd9zhug:hoxVtdJCTLn/K0cqT0X5y9hW48Tzw
- TLSH T1DEC41225B7BC445BD2FB057A4C7623488373770656A2EA4C2CFC18CE8EE6B12AD15367
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\VioCapone.DESKTOP-EGC26QD\Downloads\template\obj\x64\Release\net8.0-windows\CelWare.pdb
Name
.text
Size
513KB
Virtual Size
513KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
CelWare V.1.1.0/CelWare.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 11d57b690d915fcc219916a5d790780732eccfbcf1ed63064762231ecedb9f6c
- MD5 b70593a8746712a5dda2b74a8034a00a
- SHA1 c1796f6c29bf9ebde305f6480514acf1b5ef75f2
- SHA512 5541ed7fafb1a45d2ef522c105370cff5f64985bf6b3d52c7fbdd36c99d340b60c5f1a61cfff3cca93550fb1d0bff92f77b1525eff84a0a3dbf2ae43197e0a2a
- SSDEEP 3072:gqvmgiYSoIk8uIHzlqRwa/YB26mkIgrFk2cRjx9Dtular:g64k83TlEvGTIgY9zDtug
- TLSH T181046C07E6A850BEE1B6D679CD924C41FB7278558B71A7CF07504EB60E77AD0AE38302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72368
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
35KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35220,
count=1, id=258, version=35220,
CelWare V.1.1.0/CelWare.pdb
- SHA256 7126f9fc4622f5ec67e49350a7dce33f05eab670432eeac3e31c6df91f85a2a9
- MD5 e0eead206b2a2952c6c05fac3e3a53cf
- SHA1 99ab114af491ab7c245a97e10f56fdb906afa2b5
- SHA512 2baa6948923d6b884564598b526bb418e10de71dae6da08661241e5094039adc0a5e1fe1c42870014592bd040ce3c8fc45f972806d3dbf7ed0386c0c00d5823d
- SSDEEP 384:aSyCPZtyOS1LMeJxjvnrq5aw34PFwCOGyfNe2h8G7AKxXsibz1bD9l0U9HEfA9Qv:JyC3S1L3JxPsI2hlhB6fJEyirgkuFUza
- TLSH T1B3B2C573935CC965C20269779562C38C7B30D3202742EF76F1D86969DEAF7980BB3261
- MD5 SHA1 SHA512 SSDEEP TLSH
CelWare V.1.1.0/CelWare.runtimeconfig.json
- SHA256 73b37384bb001e78db2014d328750eb2990393712fd63cd00c0f41965b3dbe96
- MD5 1043e1e5e960609d014e56f638202c24
- SHA1 aaa1583e8c9809a39a52c73efff1e5e439cfd3df
- SHA512 5fe61affcddd7b6235270cc3f0e7fa7f2e890852de6f5c7759234870d244ee1b32f95dfd7efb5e2f410d12557593491c53a5323b68966918f92a545c1f10d66e
- TLSH T1BEE02A3ACA206DB714F02BBEC02AC187FA3023AB00040D16BAFC180C2F361A22001F88
- MD5 SHA1 SHA512 TLSH
CelWare V.1.1.0/ICSharpCode.AvalonEdit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 abf7dd1243fde8eb04016fd50bccc5da48cd2ed8b390c8dcf6c26984e1939293
- MD5 9c4bbb4c0e915e95d9e8ef8cb3b63928
- SHA1 869d2e4c5267641f043edd1d4598e831dad3970f
- SHA512 4c768d32ada10a38057081d331caacdf083b6b47c2a9daf97198872e3b9712a5feeb26305808f6aed6740ffa5ed4af3212d497318a956c2f81f0e27991b12c80
- SSDEEP 6144:1+Sq/OsB39SCIjrFerolw6StkXm9/acTH8Yb7hWU+wPXjJHUzXHP3b7DZjoY:QSqRUCFMlAky/dTcYjuH/R
- TLSH T1E9D43A2C379C161AD2BF1B77E5314204E3BFFC46B269DB4F388465BA2D527629C016A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
626886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\AvalonEdit\AvalonEdit\ICSharpCode.AvalonEdit\obj\Release\net6.0-windows\ICSharpCode.AvalonEdit.pdb
mscoree
_CorDllMain
Name
.text
Size
604KB
Virtual Size
604KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CelWare V.1.1.0/QuorumAPI.dll
- SHA256 3398ac3251b38a4a0376d1310e73ac89fa0aed631999514f4de31691d3e0a824
- MD5 233f688c757358ed5f97c76b8be88391
- SHA1 3dfc2f7d8aeb041b2016eb090688c1ba6308b865
- SHA512 e697a91e0fb4a4a541b94a7448688243aef0071e46158f8a956d8f7d94b072939b4e5c2d52e6eba292d0d87d5cc44afba880cc4f3959f3b2975427c7be9db63b
- SSDEEP 6144:0VwvTjHVVV9Qv0vspvhICzZxkNJsnlz5:0VwvHHVVV9Qv0vspOCzZxo
- TLSH T10184DE03AF449B11CA6C343A82FB2D2C63A1F5CB1771891FDF057AA71CD62A69DCD246
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
367KB
Virtual Size
367KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
796B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ