Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
2025-02-28_9ddca5b078d960960ecd47b8ea6fcfc0_cerber.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2025-02-28_9ddca5b078d960960ecd47b8ea6fcfc0_cerber.exe
Resource
win10v2004-20250217-en
General
-
Target
2025-02-28_9ddca5b078d960960ecd47b8ea6fcfc0_cerber
-
Size
207KB
-
MD5
9ddca5b078d960960ecd47b8ea6fcfc0
-
SHA1
6db1ee5c0b104b05871468662b77900a3e1b3853
-
SHA256
2b2784e4a5317419d551fb2eba7ace868f04f9fcee32085f4f808078b488bca5
-
SHA512
f9cc09744a1aba9bcd12b70b5049a82f46fdedd498a1273aeb63ab45c962b5162cfe7d137ed05cc8966b5dc14cc6d54e2b1079810012643be717c0f4078faeb9
-
SSDEEP
3072:GFpwo1bMOPxCC5DTEBUZBXDjX9bzMQqxCjY3YL5f0BTlL8rdfkAU+Fv/HV4a:MpwonxCqTNBXDLaQfjhsBTSXFv/HV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-02-28_9ddca5b078d960960ecd47b8ea6fcfc0_cerber
Files
-
2025-02-28_9ddca5b078d960960ecd47b8ea6fcfc0_cerber.exe windows:5 windows x86 arch:x86
0f524fe455225f95baeda368fc788a95
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CryptBinaryToStringA
CryptStringToBinaryA
CryptDecodeObjectEx
shlwapi
StrChrA
StrCmpNIA
PathFindExtensionW
StrCmpNIW
StrToIntA
StrCmpNW
PathFindFileNameW
StrSpnA
StrCmpNA
PathMatchSpecW
StrStrA
StrFormatByteSizeW
PathCombineW
StrCpyNW
PathUnquoteSpacesW
PathSkipRootW
StrToInt64ExA
StrChrW
StrPBrkA
ws2_32
htons
closesocket
shutdown
WSAStartup
socket
inet_ntoa
htonl
sendto
gethostbyname
inet_addr
powrprof
CallNtPowerInformation
urlmon
FindMimeFromData
oleaut32
VariantClear
ole32
CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoInitialize
kernel32
GetCurrentThreadId
CloseHandle
FileTimeToLocalFileTime
GetCurrentProcessId
SetFileAttributesW
CreateThread
OutputDebugStringW
OutputDebugStringA
GetFileAttributesW
GetCurrentProcess
GetTimeFormatW
LeaveCriticalSection
Sleep
OpenProcess
GetCommandLineW
CreateMutexW
SetErrorMode
SearchPathW
GetTempFileNameW
GetModuleHandleW
GetCurrentThread
GetModuleFileNameW
InitializeCriticalSection
SetThreadPriority
GetLastError
SetProcessShutdownParameters
MultiByteToWideChar
SetFilePointer
lstrlenA
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
CreateFileMappingW
WriteFile
GetTickCount
lstrcpyA
MoveFileExW
SetEvent
WaitForSingleObject
GetModuleHandleA
SetFilePointerEx
CreateProcessA
GetSystemDirectoryA
DeleteCriticalSection
GetFileTime
CreatePipe
CreateToolhelp32Snapshot
GetFileSize
lstrcatW
Process32NextW
GetDateFormatW
TerminateProcess
MulDiv
CreateEventW
lstrlenW
Process32FirstW
EnterCriticalSection
FileTimeToSystemTime
MoveFileW
GetFileSizeEx
FlushFileBuffers
CreateFileW
lstrcmpiW
FindFirstFileW
GetDriveTypeW
InterlockedIncrement
GetLogicalDrives
GetSystemDirectoryW
FindClose
IsBadStringPtrW
IsBadReadPtr
GlobalMemoryStatusEx
QueryDosDeviceW
IsBadCodePtr
FindNextFileW
GetDiskFreeSpaceExW
IsBadWritePtr
ExpandEnvironmentStringsW
LoadLibraryW
GetProcAddress
IsBadStringPtrA
LocalFree
GetTempPathW
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
lstrcpynA
lstrcpynW
WaitForMultipleObjects
GetVersionExW
GetSystemInfo
GetHandleInformation
lstrcmpiA
ReadFile
CreateDirectoryW
GetComputerNameA
GetNativeSystemInfo
TlsAlloc
RtlUnwind
lstrcpyW
user32
wsprintfA
CharLowerBuffA
TranslateMessage
PeekMessageW
CreateWindowExW
RegisterClassW
DefWindowProcW
DispatchMessageW
wsprintfW
RegisterClassExW
UnregisterClassW
MessageBoxW
FillRect
DrawTextA
GetDC
GetSystemMetrics
SystemParametersInfoW
ReleaseDC
GetKeyboardLayoutList
GetForegroundWindow
CharLowerBuffW
advapi32
CryptDestroyKey
OpenProcessToken
GetTokenInformation
DuplicateToken
CheckTokenMembership
ConvertSidToStringSidW
CryptGetKeyParam
CryptAcquireContextW
RegCloseKey
RegOpenKeyExW
GetSecurityDescriptorOwner
GetFileSecurityW
RegQueryValueExW
EqualSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateWellKnownSid
CryptGenRandom
CryptImportKey
shell32
CommandLineToArgvW
SHChangeNotify
SHGetFolderPathW
SHGetFileInfoW
ShellExecuteW
gdi32
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject
netapi32
NetApiBufferFree
NetUserEnum
NetUserGetInfo
ntdll
isspace
memset
_aulldvrm
memcpy
_allmul
RtlDosPathNameToNtPathName_U
NtDeleteFile
RtlFreeUnicodeString
tolower
memmove
_alldiv
NtQueryVirtualMemory
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 129KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE