MuCelta.rar
- SHA256 30408b36344d1470c683ebeeb11706661327b95aaeee588d98158cad0e7b88c7
Password
Matias
General
- Target MuCelta.rar
- Size 3.3MB
- Sample261110-ryctravtbs
- SHA256 30408b36344d1470c683ebeeb11706661327b95aaeee588d98158cad0e7b88c7
- MD5 0a90deb34a6e115863732441445d5ed7
- SHA1 7418b703344a6cdca74f37bcdd4ad0e625151214
- SHA512 f93fda83a9bfae7c0f85ca086e0c3683f0863b3150673d06048cadde3f96ada999063907c3de23a2014d1bad9bb82e6e60cd9c44be618aa86acf5ae07abb5f70
- SSDEEP 98304:4sEQnKPA1Af6s15tycEUq+gaWQZQ5q+PhAUY1:4GKPACf6s1r7jgkMqqa
- TLSH T1FDF5339740B63B7B9E58DE1002112EDB63AD58E35A12A48F2BA3F39C34075107B53B9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/MuCelta.exe themida - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MuCelta.exe
File Explorer
-
MuCelta.rar.rar 3.3MB
-
MuCelta.exe.exe 3.3MB
MuCelta.exe
- SHA256 37d475f4b820f158724329572b6599fae88c0cb5deec83bb8df917324be71e68
- MD5 f3a5b83241edbdffc31413baf357ab46
- SHA1 cc7ec55744d382b08e2b9e8d42cffab520bad351
- SHA512 0984fc8e658392764b82d3a6d1c9f5d727442457e8f579b1bb3628f09b15c3fcb65fe8aaf7a1c11de5303e33e7f20a1388e712e74cac6f929fc698d0ed401c44
- SSDEEP 98304:TfbRB+0SGLOOn/E2iOyqAXUQfK/r886WurOYcudQ274re:b7zSU9s2iOyFXUR/r4aIGkee
- TLSH T117F533839C258A7FCF46D977063EFB214E15BA04E6D29942483F47D217F829D4BB2D0A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
Matias
Minor OS version
0
Major OS version
6
Entry point
6127704
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
259KB
Virtual Size
609KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
30KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
10KB
Virtual Size
531KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
22KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
160KB
Virtual Size
160KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
4.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=34, id=261, version=35207,
count=4, id=257, version=35207,
count=25, id=257, version=33145,
count=342, id=1, productName=Unmarked objects,
count=13, id=261, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,