2024-05-23_6232daaab5123e7558e85194c53aa816_cerber | Triage

Sharing

General

Target

2024-05-23_6232daaab5123e7558e85194c53aa816_cerber
Size

196KB
MD5

6232daaab5123e7558e85194c53aa816
SHA1

2a1ff8673c29ddfd7c024c3140b5e063efbc60a6
SHA256

ff7ab90e382b5c38f4aef5c43b5b68e79bf9d6c4e8da32218a12a7feb05dabdd
SHA512

3f492bd014c2988bf9a7467ec58e0993b73ca8fc9d3acccdc35e6c2829b41054af971e5125c48e9ec40b18cccad58c7b52d1b99d062dae4941c5b7396b5e6205
SSDEEP

6144:R3x12BaZmbYU2EDaWQLo/5VX9dBpDtIjkw/:Rh12BawZ2EBQ87B3k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-23_6232daaab5123e7558e85194c53aa816_cerber

Files

2024-05-23_6232daaab5123e7558e85194c53aa816_cerber
.exe windows:5 windows x86 arch:x86

ebce88cab5f5d3d7b4f28f267a127ce7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

memmove
isspace
tolower
_aulldvrm
memset
memcpy
_allmul
_alldiv
RtlUnwind
NtQueryVirtualMemory

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 129KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE