CelesteUncapped.zip
- SHA256 a6fda1a35d0ca926f50c452aa55fabbe4e0f39f6ef06889e422d40da12398b2c
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CelesteUncapped.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
CelesteUncapped.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target CelesteUncapped.zip
- Size 223KB
- Sample261024-sakp5act3l
- SHA256 a6fda1a35d0ca926f50c452aa55fabbe4e0f39f6ef06889e422d40da12398b2c
- MD5 032f7c17ff97221d98857994b01194a2
- SHA1 0d4f09dd681fab910f883b41220b454dcbfc29c4
- SHA512 0164d4fedbc744d3d2234d01463f5f7691d0945f3a4130b28457a7f9923d4e930d1da32800d2b3cffb1b6cbe6a78ea4947ab4bccc5e73c32e4167b2945cb2dfa
- SSDEEP 6144:JOqs+Ki04Cdd0WrBncfmGGHh5XHi353PI1D:MfPduWrkGHPe34D
- TLSH T1DC2422C9D6A6D81BDC7562FA1EDCFF4095A947400FA15FA10C880C59A294AEDF33DAF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/CelesteUncapped.exe unpack001/Mono.Cecil.Mdb.dll unpack001/Mono.Cecil.Pdb.dll unpack001/Mono.Cecil.Rocks.dll unpack001/Mono.Cecil.dll
File Explorer
-
CelesteUncapped.zip.zip 223KB
-
CelesteUncapped.exe.exe 7KB
-
CelesteUncapped.pdb768B
-
Mono.Cecil.Mdb.dll.dll 42KB
-
Mono.Cecil.Pdb.dll.dll 87KB
-
Mono.Cecil.Rocks.dll.dll 27KB
-
Mono.Cecil.dll.dll 337KB
CelesteUncapped.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c8efb8182875ebf3566066b2eaa2f4c0568430c04aa97758d44037d587841613
- MD5 6739e4aa8e00978780001ae989fcd55b
- SHA1 bb1b68b65ca8fca28e388168066d55a15b3f5891
- SHA512 b49568e4fbba57bf8cc0b4a1520bf7c3f254863326a1b9078a403a1d5844585df9e6a336b1da102bed97d8ea894bb066f79a8162c4e3ed5dc117ce12af3bbaba
- SSDEEP 96:/51EX/11gDUE+GT2QT1mcCLw9xwMAalYHIhAhP0GBzNtB:woDU5M2G8N09K/IhYcGD
- TLSH T1F0E1C625B3D98A7AE9FB4A3669B323401A30FB258C33CB1F5C88119F9C23B444563B75
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
/home/dana/workspace/CelesteUncapped/obj/Release/CelesteUncapped.pdb
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
CelesteUncapped.pdb
- SHA256 b43576c4285c42f8ba4f9f41beb2d7a63f2faec4353f46b4243324e973137108
- MD5 37b43e540a9cbe4d4c71ca334d3d42f0
- SHA1 d6276061098896bcaa2e399da533bab8284ca59c
- SHA512 c5cf683cf063b0cca515ac675453403745ed95473d48ef7261f63f64f37d40d657d0464d7c9aa517f6d255bca1238fa678c95797e24286ceaca9a522b9e3b1a0
- TLSH T18F01DD1033D48D46D2E2627F4AE313403332D64A7617D75302647475EC067E0CD632D8
- MD5 SHA1 SHA512 TLSH
Mono.Cecil.Mdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 90cfc73befd43fc3fd876e23dcc3f5ce6e9d21d396bbb346513302e2215db8c9
- MD5 dc80f588f513d998a5df1ca415edb700
- SHA1 e2f0032798129e461f0d2494ae14ea7a4f106467
- SHA512 1b3e57fbc10f109a43e229b5010d348e2786e12ddf48a757da771c97508f8f3891be3118ff3bb84c3fd6bfa1723c670541667cdbf2d14ea63243f6def8f038cc
- SSDEEP 768:Cr5EYZep98C87KHeBUZwrEF7b+gxfM3AkMus4iWJq9F4CRIcZwMRTIzyAt9U2:Cr59g98C87KHeBUbwgKirbdwMRTzAt9l
- TLSH T1E51329142BBC4B2BC29E51FDA89221061BF1917C6613FBA78EC8E1F7BC47B850512277
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\symbols\mdb\obj\Release\net40\Mono.Cecil.Mdb.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.Pdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d67ebd49241041e6b6191703a90d89e68d4465adce02c595218b867df34581a3
- MD5 6cd3ed3db95d4671b866411db4950853
- SHA1 528b69c35a5e36cc8d747965c9e5ea0dc40323b8
- SHA512 e8ae4caf214997cc440e684a963727934741fd616a073365fa1fc213c5ca336c12e117d7fa0d6643600a820297fc11a21e4ac3c11613fba612b90ebd5fc4c07e
- SSDEEP 1536:fU2qJ+RazRt/Kc4oJiOxFR4NdJF0/RfhF46HAoYKHgPzpS6w7fa1C9r:s2MRtrfrR+Pe/xAiAzpQ7y1C9r
- TLSH T13D936D36E7A8A566D8DC64761476090903F2D2AED1639B565ECCBEF8192FF300933393
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\symbols\pdb\obj\Release\net40\Mono.Cecil.Pdb.pdb
mscoree
_CorDllMain
Name
.text
Size
85KB
Virtual Size
84KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.Rocks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a08c040912df2a3c823ade85d62239d56abaa8f788a2684fb9d33961922687c7
- MD5 c8f36848ce8f13084b355c934fc91746
- SHA1 8f60c2fd1f6f5b5f365500b2749dca8c845f827a
- SHA512 7c47f96e0e7dfaebb4dccf99fa0dda64c608634e2521798fd0d4c74eb2641c848fadad29c2cd26eb9b45acdfef791752959117a59e1f0913f9092e4662075115
- SSDEEP 384:E0ve8JOuJTiC7n2NwxEXCnjB+RXcMeDz8PmR1ugLoaeuLMBG9UphJAprjEduFLHJ:E+meiCyrXOwS8uRssveum1peFLHFBbO
- TLSH T1E2C23A012764CB33D1EF863678E1129803F6C2A66103D7199DDCA6F6A84B7C59B117FA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33582
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\rocks\obj\Release\net40\Mono.Cecil.Rocks.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7744c9c84c28033bc3606f4dfce2adcd6f632e2be7827893c3e2257100f1cf9e
- MD5 7546acebc5a5213dee2a5ed18d7ebc6c
- SHA1 b964d242c0778485322ccb3a3b7c25569c0718b7
- SHA512 30b3a001550dca88c8effc9e8107442560ee1f42e3d2f354cc2813ae9030bf872c76dc211fd12778385387be5937e9bf172ea00c151cab0bca77c8aafdd11f7d
- SSDEEP 6144:jFzzF5VOCxfiKKhsw4NiL0XRzx9WoCklyus:BdfiKI4RzWSyu
- TLSH T104748C3633EC463BD68E4377E05A852D83FAD917A24FD70E5C94A6FA1C43BD28A11163
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
348638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\sources\cecil\obj\Release\net40\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
335KB
Virtual Size
334KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ