2024-05-22_497b3e4590dca4ce7bda96f85bcfb121_cerber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-22_497b3e4590dca4ce7bda96f85bcfb121_cerber
Size

183KB
MD5

497b3e4590dca4ce7bda96f85bcfb121
SHA1

2562fd9026f8372e312252b3e93fa09377a0e4be
SHA256

592f21edfe1a2192e0fe662a5077458660f55e61d3cdcba0eeebe2e3a44be96c
SHA512

64aa3758d8167af90f9b43dc57ee6245cd351831e2ae1b6f0124cf5a0c80a129d69107807a6caf21d10bef797ef64d00c9928736639cf4b4bfcbc963d57a71d1
SSDEEP

3072:uWakdSXyefzv3S9G7vhIYvrtUpBa+baX3EyxTyeUnRrnlCXpbFQ6gBtvBHuvuYH8:uWgikzPS90BDkBa+bS3EeylUZbFQ3BRZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-22_497b3e4590dca4ce7bda96f85bcfb121_cerber

Files

2024-05-22_497b3e4590dca4ce7bda96f85bcfb121_cerber
.exe windows:5 windows x86 arch:x86

c70276d3812b1daaf1c59c3df6741440

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA
CryptStringToBinaryA
CryptDecodeObjectEx

shlwapi

StrStrIW
PathMatchSpecW
PathSkipRootW
StrCpyNW
StrFormatByteSizeW
StrPBrkA
StrCmpNW
StrStrA
StrSpnA
StrToInt64ExA
StrCmpNA
PathCombineW
PathFindFileNameW
StrToIntA
StrChrA
StrCmpNIA
PathFindFileNameA
StrChrW
StrCmpNIW

ws2_32

inet_addr
closesocket
gethostbyname
htonl
shutdown
htons
sendto
socket
inet_ntoa

kernel32

GetCommandLineW
lstrcmpiA
CreateMutexW
SetErrorMode
GetCurrentProcess
GetCurrentThread
TerminateProcess
GetModuleFileNameW
WaitForMultipleObjects
SetThreadPriority
GetTempPathW
GetLastError
GetCurrentThreadId
OutputDebugStringA
SetProcessShutdownParameters
SetFilePointer
lstrlenA
MapViewOfFile
TlsAlloc
CreateFileMappingW
IsBadStringPtrA
IsBadWritePtr
IsBadReadPtr
lstrcpyA
IsBadStringPtrW
PeekNamedPipe
SystemTimeToFileTime
MoveFileExW
SetFileTime
MoveFileW
GetFileSizeEx
CreateProcessA
GetSystemDirectoryA
GetLocalTime
CreatePipe
GetTickCount
FlushFileBuffers
OpenEventW
lstrlenW
RtlUnwind
ExitProcess
LocalFree
GetProcAddress
MulDiv
EnterCriticalSection
GetModuleHandleW
CreateEventW
CreateThread
lstrcpyW
FileTimeToLocalFileTime
DeleteCriticalSection
GetFileTime
UnmapViewOfFile
SearchPathW
GetTempFileNameW
FindFirstFileW
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
VirtualFree
VirtualAlloc
FindClose
QueryDosDeviceW
CreateFileW
FindNextFileW
SetFileAttributesW
LoadLibraryW
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
CreateDirectoryW
GetComputerNameA
ReadFile
FileTimeToSystemTime
GetFileAttributesW
GetTimeFormatW
lstrcatW
LeaveCriticalSection
Sleep
lstrcpynW
InitializeCriticalSection
lstrcpynA
OpenProcess
WriteFile
MultiByteToWideChar
GetVersionExW
OutputDebugStringW
WideCharToMultiByte
SetEvent
GetHandleInformation
WaitForSingleObject
SetFilePointerEx
GetFileSize
CloseHandle
CreateToolhelp32Snapshot
VirtualProtect
Process32FirstW
GetDateFormatW
GetModuleHandleA
lstrcmpiW
Process32NextW
GetSystemInfo

user32

GetForegroundWindow
DispatchMessageW
DefWindowProcW
RegisterClassW
RegisterClassExW
UnregisterClassW
CreateWindowExW
PeekMessageW
FillRect
DrawTextA
GetDC
SystemParametersInfoW
ReleaseDC
wsprintfW
GetKeyboardLayoutList
GetSystemMetrics
CharLowerBuffA
TranslateMessage
wsprintfA

advapi32

LookupPrivilegeValueW
CryptAcquireContextW
CryptGetKeyParam
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
CreateWellKnownSid
CheckTokenMembership
DuplicateToken
CryptGenRandom
CryptReleaseContext
AdjustTokenPrivileges
FreeSid
AllocateAndInitializeSid
RegOpenKeyW
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
RegCloseKey
CryptDestroyKey

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeEx

shell32

SHChangeNotify
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
ShellExecuteW

gdi32

SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject

ntdll

_chkstk
isspace
RtlDosPathNameToNtPathName_U
NtDeleteFile
RtlFreeUnicodeString
tolower
memmove
ZwOpenProcess
ZwQuerySystemInformation
_alldiv
_allmul
memset
_aulldvrm
memcpy
NtQueryVirtualMemory

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 105KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c70276d3812b1daaf1c59c3df6741440

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

shlwapi

ws2_32

kernel32

user32

advapi32

ole32

shell32

gdi32

ntdll

version

Sections

.text Size: 64KB - Virtual size: 64KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 105KB - Virtual size: 108KB

.CRT Size: 512B - Virtual size: 12B

.text
Size: 64KB - Virtual size: 64KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 105KB - Virtual size: 108KB

.CRT
Size: 512B - Virtual size: 12B