7ad8de3bf16be6ebba2099a6d71a2887_cerber_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7ad8de3bf16be6ebba2099a6d71a2887_cerber_JC.exe
Size

196KB
MD5

7ad8de3bf16be6ebba2099a6d71a2887
SHA1

134afe9140696743ada447438557273b8d1d0ae1
SHA256

11a370d6501a54abf6ab7eb5dc12d3e23c2fb5f804f0dd95fd73214631ad15a9
SHA512

1a04912d75a5003572d7beba1cfce7e8b9357ce7341252d2743c8b475753a91bf4bd89bb0b19a581a01c76a4c978171b3133f80c1aaca036e252c98ace9c42b1
SSDEEP

3072:beRyP8lR2hYgScZE86BInwT3oexHDGptV0gic8MDuzASMwaiaf5YArm:CRyP8OhimEtBInS3oU6pMjEDuzAhf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ad8de3bf16be6ebba2099a6d71a2887_cerber_JC.exe

Files

7ad8de3bf16be6ebba2099a6d71a2887_cerber_JC.exe
.exe windows x86

09b14511b4c36c1ed8b3fcc416b40464

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA
CryptStringToBinaryA
CryptDecodeObjectEx

shlwapi

StrStrIW
PathSkipRootW
PathFindFileNameW
StrStrA
StrCmpNA
PathMatchSpecW
StrPBrkA
StrSpnA
StrToInt64ExA
StrCpyNW
PathCombineW
StrToIntA
StrCmpNIW
StrChrA
StrCmpNIA
PathFindFileNameA
StrChrW
StrCmpNW

mpr

WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum

ws2_32

WSAStartup
sendto
htons
htonl
shutdown
gethostbyname
closesocket
inet_addr
socket
inet_ntoa

kernel32

RtlUnwind
lstrcmpiA
GetCommandLineW
CreateMutexW
SetErrorMode
GetCurrentProcess
ExitProcess
GetCurrentThread
WaitForMultipleObjects
TerminateProcess
GetModuleFileNameW
SetThreadPriority
GetTempPathW
GetLastError
IsBadStringPtrA
IsBadWritePtr
OutputDebugStringA
SetProcessShutdownParameters
SetFilePointer
lstrlenA
LocalFree
UnmapViewOfFile
CreateFileMappingW
IsBadReadPtr
IsBadStringPtrW
GetCurrentThreadId
lstrcpyA
PeekNamedPipe
SystemTimeToFileTime
MoveFileExW
SetFileTime
lstrlenW
CreateFileW
CreateProcessA
GetSystemDirectoryA
GetLocalTime
CreatePipe
GetTickCount
ReadFile
FileTimeToSystemTime
OpenEventW
GetFileAttributesW
GetProcAddress
FlushFileBuffers
GetModuleHandleW
TlsAlloc
MulDiv
CreateThread
lstrcpyW
FileTimeToLocalFileTime
DeleteCriticalSection
GetFileTime
GetFileSizeEx
CreateEventW
EnterCriticalSection
MapViewOfFile
SearchPathW
GetTempFileNameW
FindFirstFileW
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
VirtualFree
VirtualAlloc
FindClose
QueryDosDeviceW
GetTimeFormatW
lstrcmpiW
lstrcatW
FindNextFileW
SetFileAttributesW
GetCurrentProcessId
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
CreateDirectoryW
GetComputerNameA
LeaveCriticalSection
Sleep
InitializeCriticalSection
WriteFile
MoveFileW
OutputDebugStringW
SetEvent
lstrcpynW
WaitForSingleObject
lstrcpynA
OpenProcess
SetFilePointerEx
MultiByteToWideChar
GetVersionExW
GetFileSize
WideCharToMultiByte
GetDateFormatW
GetHandleInformation
CloseHandle
CreateToolhelp32Snapshot
VirtualProtect
GetModuleHandleA
Process32NextW
Process32FirstW
GetSystemInfo

user32

wsprintfW
GetForegroundWindow
DispatchMessageW
RegisterClassExW
UnregisterClassW
DefWindowProcW
RegisterClassW
CreateWindowExW
FillRect
DrawTextA
GetDC
SystemParametersInfoW
PeekMessageW
GetKeyboardLayoutList
GetSystemMetrics
CharLowerBuffA
TranslateMessage
wsprintfA
ReleaseDC

advapi32

CryptAcquireContextW
CryptGetKeyParam
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
CreateWellKnownSid
CheckTokenMembership
DuplicateToken
CryptGenRandom
CryptReleaseContext
AdjustTokenPrivileges
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueW
RegOpenKeyW
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
RegCloseKey
CryptDestroyKey

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW
ShellExecuteExW
SHChangeNotify

gdi32

SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject

ntdll

_allmul
isspace
_allshl
RtlDosPathNameToNtPathName_U
NtDeleteFile
RtlFreeUnicodeString
ZwQuerySystemInformation
tolower
memmove
ZwOpenProcess
_alldiv
memset
_aulldvrm
memcpy
NtQueryVirtualMemory

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Sections

.text
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

09b14511b4c36c1ed8b3fcc416b40464

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

shlwapi

mpr

ws2_32

kernel32

user32

advapi32

ole32

shell32

gdi32

ntdll

version

Sections

.text Size: 64KB - Virtual size: 61KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 112KB - Virtual size: 108KB

.text
Size: 64KB - Virtual size: 61KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 112KB - Virtual size: 108KB