2024-05-24_d598a14d38066a0944d1e17d4ffdcda2_cerber | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-24_d598a14d38066a0944d1e17d4ffdcda2_cerber
Size

196KB
MD5

d598a14d38066a0944d1e17d4ffdcda2
SHA1

743e2fe12664bfe4bc4e48f05611ae7a3b2c1d97
SHA256

a013173bc25d65f632e8714d4b7e3757f39d08fa82944aa063e3c3bbdb751fa0
SHA512

e2fff91eceda0ad7f6f144ae681d9202a98bd3c8fc4d040e2d415fa161002157c6e5608fa58e579789623949490ff63765b30d87ee8eed3f023e3d6501ea6128
SSDEEP

3072:R3x12BVsTlFdabYtC2ycfoVYosRJLtL8xSxcHJuXenqJmcwehJB0XP:R3x12BaZmbYU2EpELB8U3OGws0XP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_d598a14d38066a0944d1e17d4ffdcda2_cerber

Files

2024-05-24_d598a14d38066a0944d1e17d4ffdcda2_cerber
.exe windows:5 windows x86 arch:x86

ebce88cab5f5d3d7b4f28f267a127ce7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

memmove
isspace
tolower
_aulldvrm
memset
memcpy
_allmul
_alldiv
RtlUnwind
NtQueryVirtualMemory

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 129KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE