2023-05-18_2da293339cb78af98e00d550aabaa076_cerber

Sharing

Copy URL Twitter E-mail

General

Target

2023-05-18_2da293339cb78af98e00d550aabaa076_cerber
Size

117KB
MD5

2da293339cb78af98e00d550aabaa076
SHA1

e7b25941c17d076abccf41e0c49bf932dc2306dd
SHA256

b580a1fbe78412736b6fff47a2d2d90a0a9d164430d49e927584c7a579bf5a98
SHA512

3b137d8ddd9070bcf6092718baf33e88e718e6ba8e2ebc80ce5f6c642b5a546b5d79bdc4fb36ae5aeb136b312b20d478c3c362a048243340a28de9ff38587fe1
SSDEEP

3072:FAx+feo6RSH+/C+J6b0BaaKDkjcZ2qx5IR6sssUDhwf4:FAUd6RgGC2BBaaKDkjiIcss3dwA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-05-18_2da293339cb78af98e00d550aabaa076_cerber

Files

2023-05-18_2da293339cb78af98e00d550aabaa076_cerber
.exe windows x86

dff48738bc056b7aaf1d6db663a2144b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA
CryptImportPublicKeyInfo
CryptStringToBinaryA
CryptDecodeObjectEx

wininet

InternetCrackUrlA
InternetConnectA
InternetReadFile
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle

shlwapi

StrPBrkA
StrChrW
PathFindFileNameW
PathMatchSpecW
PathUnquoteSpacesW
StrStrIA
StrChrIA
StrCpyNW
StrToIntA
StrChrA
StrCmpNIW
PathSkipRootW
StrCmpIW
PathRemoveExtensionW
StrToInt64ExA
StrSpnA
PathCombineW
StrStrIW
StrCmpNIA
StrCmpNW

version

GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
VerQueryValueA
GetFileVersionInfoSizeA

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

imagehlp

CheckSumMappedFile

ws2_32

inet_ntoa
inet_addr
htonl
shutdown
closesocket
gethostbyname
WSAStartup
socket
sendto
htons

kernel32

GetLastError
GetVolumeInformationW
GetModuleHandleW
GetSystemWindowsDirectoryW
SetErrorMode
LockResource
GetSystemDirectoryW
lstrcatW
lstrlenW
GetProcAddress
GetDateFormatW
SetFilePointer
SetFilePointerEx
WaitForSingleObject
SetEvent
OutputDebugStringW
SetFileTime
WriteFile
InitializeCriticalSection
Sleep
LeaveCriticalSection
GetTimeFormatW
GetFileAttributesW
FileTimeToSystemTime
ReadFile
GetFileSizeEx
MoveFileW
EnterCriticalSection
CreateEventW
SizeofResource
GetFileTime
DeleteCriticalSection
CloseHandle
FileTimeToLocalFileTime
lstrcpyW
CreateThread
OpenMutexW
FindResourceW
FreeResource
LocalFree
ExitProcess
CreateDirectoryW
ExpandEnvironmentStringsW
GetTempFileNameW
GetFileSize
MapViewOfFile
UnmapViewOfFile
FreeLibrary
CreateProcessW
LoadLibraryExW
LoadLibraryW
CopyFileW
GetSystemWow64DirectoryW
lstrcpynW
TerminateProcess
FlushInstructionCache
FlushFileBuffers
GetTempPathW
VirtualAllocEx
CreateFileMappingW
OpenEventW
WinExec
GetWindowsDirectoryW
DeleteFileW
WriteProcessMemory
ResumeThread
FindFirstFileW
GetModuleFileNameW
FindClose
SetFileAttributesW
LoadResource
CreateMutexW
GetCurrentProcess
GetCurrentThread
SetThreadPriority
TlsAlloc
SetCurrentDirectoryW
OutputDebugStringA
SetProcessShutdownParameters
IsBadWritePtr
lstrcpynA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrcpyA
GetEnvironmentVariableW
GetVersionExW
lstrcmpiA
GetTickCount
IsBadStringPtrW
GetModuleFileNameA
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
VirtualFree
VirtualAlloc
QueryDosDeviceW
FindNextFileW
IsBadReadPtr
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
GetComputerNameA
IsBadCodePtr
IsBadStringPtrA
GetCurrentThreadId
WaitForMultipleObjects
SearchPathW
CreateToolhelp32Snapshot
VirtualProtect
OpenProcess
GetModuleHandleA
lstrcmpiW
GetHandleInformation
Process32NextW
GetSystemInfo
CreateFileW
Process32FirstW
RtlUnwind
ReadProcessMemory

advapi32

RegOpenKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegEnumKeyW
CryptDestroyKey
CryptAcquireContextW
CryptGetKeyParam
SetKernelObjectSecurity
LookupPrivilegeValueW
GetTokenInformation
AdjustTokenPrivileges
RegFlushKey
RegEnumValueW
RegDeleteValueW
OpenProcessToken
RegSetValueExW
RegOpenKeyW
RegCreateKeyExW
GetLengthSid
CreateWellKnownSid
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
DuplicateToken
CryptEncrypt
ConvertSidToStringSidW
RegQueryValueExW

user32

CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
TranslateMessage
DispatchMessageW
wsprintfA
GetForegroundWindow
CharLowerBuffA
GetLastInputInfo
wsprintfW
GetSystemMetrics
GetKeyboardLayoutList
RegisterClassExW
UnregisterClassW

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitializeSecurity
CoInitialize

shell32

SHGetFolderPathW
ShellExecuteExW
SHChangeNotify
ShellExecuteW

ntdll

memcpy
_aullshr
isspace
_chkstk
_alldiv
ZwQueryInformationProcess
memmove
RtlDosPathNameToNtPathName_U
NtDeleteFile
RtlFreeUnicodeString
ZwOpenSection
ZwQuerySystemInformation
ZwOpenDirectoryObject
ZwClose
ZwOpenProcess
_allmul
_allshl
_allshr
memset
_aulldvrm
NtQueryVirtualMemory

oleaut32

SysAllocString
SysFreeString

netapi32

NetUserEnum
NetUserGetInfo
NetApiBufferFree

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dff48738bc056b7aaf1d6db663a2144b

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

wininet

shlwapi

version

mpr

imagehlp

ws2_32

kernel32

advapi32

user32

ole32

shell32

ntdll

oleaut32

netapi32

Sections

.text Size: 69KB - Virtual size: 68KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 3KB - Virtual size: 12KB

.rsrc Size: 29KB - Virtual size: 29KB

.text
Size: 69KB - Virtual size: 68KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 3KB - Virtual size: 12KB

.rsrc
Size: 29KB - Virtual size: 29KB