Malicious
Malicious

PE Executable
MD5: ce84b5ced6719ef6680c681e46014400
Size: 10.01 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 ce84b5ced6719ef6680c681e46014400
Sha1 7960e61fd077596e7d9630fe579ace4842a344e7
Sha256 4e57af02f430ffdacb81b8b597b251bac12de9c0703fb5325411dc83ca8d8e11
Sha384 9dd11f541444216ce8c3fbd89540bb662a8e9552bf406463ad8576e61761e98b39b8ac52bcf05cc86aece580a1267a1c
Sha512 cc469fdadc02a8aeef9fccf532e82deefd43bc6bb06adc990951ce2a92a04c3349edd1ea2e4a38f7b933fab4deb42f84916673fad73bf0a7c03861c4446fdd59
SSDeep 98304:0bCTz8+F7j9+U22ihIYgOeieNEVJyZlng4p2V:0KzpFOJIEYEVcn1p
TLSH 15A6E1447551BE5EC3E68C32E4FA1C1C933098A61743E30B653AF695EC5F2B66E803E6
PeID
Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 8Microsoft Visual C++ 8Microsoft Visual C++ v6.0 DLLUPX 2.00-3.0X -> Markus Oberhumer & Laszlo Molnar & John ReiserUPX Protector v1.0xUPX v2.0 -> Markus, Laszlo & ReiserVC8 -> Microsoft Corporation
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RBIND
ID:0000
Overlay_d02e93b4.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
.rdata
.data
Resources
RT_ICON
ID:0002
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
RBIND
ID:0000
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
UPX0
UPX1
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
ID:1036
RT_MANIFEST
ID:0001
ID:0
RT_CURSOR
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
RT_STRING
ID:0FF3
ID:0
ID:0FF4
ID:0
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:2048
ID:0
RT_GROUP_CURSOR2
ID:7FF9
ID:1033
ID:7FFA
ID:1033
ID:7FFB
ID:1033
ID:7FFC
ID:1033
ID:7FFD
ID:1033
ID:7FFE
ID:1033
ID:7FFF
ID:1033
.Net Resources
{f4f5d655-d3f5-4ecf-9a53-3a2fe4afba9b}
RnsC:
Z0Az>S7ceT;H}HL:0Y$.resources
logoPictureBox.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
ls
p0l#ez"6 r wkmcf=YU"'%.resources
$this.Icon
[NBF]root.IconData
?18Z
,YcTt5!
+UrJh7sHJBcb9(.resources
{c61cd46d-9d75-437f-8270-5249854f931f}

{5a3e54c3-0556-4780-bd19-e692c4c55323}
.Net Resources
dKdkxsSmIYnrDCIYUE.Jk1oatCKnLf4Z9glNn
SldU312rrq5gHS7TXf.0yf4WwmQ0Lr4BgaS3u
2YBbjS3tT5QGksOylk.8LcFGNYCVEDVOaOLLW
1fpqhOV4se87mCeUVX.RpkyNkfVp0FPe6fvPT
DhHl6jOtylClhTqtKE.7Gu4wLycxX7dqMcase
7h6BUxxxxm0IkvtIBq.Xh0V63rZiOW8TfTlRV
RT_ICON
ID:0032
ID:1033
RT_RCDATA
ID:0000
ID:2048
RT_GROUP_CURSOR4
ID:0080
ID:1033
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
PDB Path: C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.rsrc
.reloc
Resources
RBIND
ID:0000
Overlay_d02e93b4.bin
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
.rdata
.data
Resources
RT_ICON
ID:0002
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
RBIND
ID:0000
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
UPX0
UPX1
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
ID:1036
RT_MANIFEST
ID:0001
ID:0
RT_CURSOR
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
RT_STRING
ID:0FF3
ID:0
ID:0FF4
ID:0
ID:0FF5
ID:0
ID:0FF6
ID:0
ID:0FF7
ID:0
ID:0FF8
ID:0
ID:0FF9
ID:0
ID:0FFA
ID:0
ID:0FFB
ID:0
ID:0FFC
ID:0
ID:0FFD
ID:0
ID:0FFE
ID:0
ID:0FFF
ID:0
ID:1000
ID:0
RT_RCDATA
ID:0000
ID:2048
ID:0
RT_GROUP_CURSOR2
ID:7FF9
ID:1033
ID:7FFA
ID:1033
ID:7FFB
ID:1033
ID:7FFC
ID:1033
ID:7FFD
ID:1033
ID:7FFE
ID:1033
ID:7FFF
ID:1033
.Net Resources
{f4f5d655-d3f5-4ecf-9a53-3a2fe4afba9b}
RnsC:
Z0Az>S7ceT;H}HL:0Y$.resources
logoPictureBox.BackgroundImage
[NBF]root.Data
[NBF]root.Data-preview.png
ls
p0l#ez"6 r wkmcf=YU"'%.resources
$this.Icon
[NBF]root.IconData
?18Z
,YcTt5!
+UrJh7sHJBcb9(.resources
{c61cd46d-9d75-437f-8270-5249854f931f}

{5a3e54c3-0556-4780-bd19-e692c4c55323}
.Net Resources
dKdkxsSmIYnrDCIYUE.Jk1oatCKnLf4Z9glNn
SldU312rrq5gHS7TXf.0yf4WwmQ0Lr4BgaS3u
2YBbjS3tT5QGksOylk.8LcFGNYCVEDVOaOLLW
1fpqhOV4se87mCeUVX.RpkyNkfVp0FPe6fvPT
DhHl6jOtylClhTqtKE.7Gu4wLycxX7dqMcase
7h6BUxxxxm0IkvtIBq.Xh0V63rZiOW8TfTlRV
RT_ICON
ID:0032
ID:1033
RT_RCDATA
ID:0000
ID:2048
RT_GROUP_CURSOR4
ID:0080
ID:1033
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙