E:\VS2019Proj\CerberusV3\Cerberus\CLI_CERBERUS_GAMES\RFOClient.pdb
Static task
static1
Behavioral task
behavioral1
Sample
48228fdbcdecea3cc50cd0202b3bcfbe0a43b5b6314063a356e15d59e4c620caN.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
48228fdbcdecea3cc50cd0202b3bcfbe0a43b5b6314063a356e15d59e4c620caN.dll
Resource
win10v2004-20240802-en
General
-
Target
48228fdbcdecea3cc50cd0202b3bcfbe0a43b5b6314063a356e15d59e4c620caN
-
Size
1.4MB
-
MD5
33ecad00839b7264d775a6d870ac8550
-
SHA1
1672d1aefca1ae96871205faf204207ba7418cda
-
SHA256
48228fdbcdecea3cc50cd0202b3bcfbe0a43b5b6314063a356e15d59e4c620ca
-
SHA512
dcceaf767bbd69f63be2b678cb801e93924728ee9f7297e3db353e7a8639cbcb169a9a208f473f7c6e6597f2b5ab15ac33a9358e238c2e05f87cdbfc2389cc59
-
SSDEEP
24576:1/JZG8tc7RRcP++BZbdYtaiQUYN72WgdFOkPpgNtO0JDZYkMKOKT/y:K+BZbdY4Uyd2ItOY7MVK7y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48228fdbcdecea3cc50cd0202b3bcfbe0a43b5b6314063a356e15d59e4c620caN
Files
-
48228fdbcdecea3cc50cd0202b3bcfbe0a43b5b6314063a356e15d59e4c620caN.dll windows:6 windows x86 arch:x86
ddd66e3dd8f9cb86cfc19c050479553d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
CryptDestroyHash
RegCreateKeyA
RegCloseKey
RegOpenKeyExA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptSetHashParam
RegSetValueExA
CryptDestroyKey
CryptReleaseContext
CryptGetHashParam
RegQueryValueExA
kernel32
HeapFree
GetPrivateProfileStringA
GetCurrentProcess
GetProcAddress
LoadLibraryA
VirtualProtectEx
WriteProcessMemory
ReadProcessMemory
OpenProcess
CloseHandle
FormatMessageA
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
WideCharToMultiByte
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetModuleHandleW
GetFileInformationByHandleEx
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
VirtualFree
VirtualAlloc
VirtualQuery
HeapAlloc
HeapReAlloc
GetThreadContext
SetThreadContext
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OpenThread
SuspendThread
ResumeThread
VirtualProtect
FlushInstructionCache
Sleep
HeapCreate
GetLastError
CreateFileA
WriteFile
GetFileSizeEx
ReadFile
SetEndOfFile
GetTickCount
GetModuleHandleA
IsBadReadPtr
AreFileApisANSI
GetFileAttributesExW
CreateDirectoryW
RtlUnwind
RaiseException
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
CreateFileW
FlushFileBuffers
GetConsoleCP
HeapSize
WriteConsoleW
GetExitCodeThread
user32
GetWindowInfo
GetKeyState
ScreenToClient
MessageBoxA
GetCursorPos
winmm
timeGetTime
d3dx9_43
D3DXCreateTextureFromFileA
D3DXGetImageInfoFromFileA
Sections
.text Size: 553KB - Virtual size: 553KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gpt0 Size: 740KB - Virtual size: 739KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 422B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ