2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber

Sharing

Copy URL

Twitter E-mail

General

Target

2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber
Size

207KB
MD5

8decb4b6c3256a11d3b1bc4e943e8c7d
SHA1

05fc08d5a5ff70dd4546738a51ab2a0b6c2c9923
SHA256

336217dba6750195bcb69c21b74d1dcd72980e689beb2c83da2c922896081f61
SHA512

463ad11c9e9a3cffd5bde25c49a118a95f5dcb586643cf18d812dd480c0bcee21fa81b6c7ed67d2d93d719c413ad0df50764590062987a70ab3072d9381db1dd
SSDEEP

3072:GFpwo1bMOPxCC5DTEBUZBXDjjbzMQqxPjY3YL5f0BTlL8rdfkAU+Fv/HV4a:MpwonxCqTNBXDUQSjhsBTSXFv/HV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber

Files

2025-03-15_8decb4b6c3256a11d3b1bc4e943e8c7d_cerber
.exe windows:5 windows x86 arch:x86

0f524fe455225f95baeda368fc788a95

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringA
CryptStringToBinaryA
CryptDecodeObjectEx

shlwapi

StrChrA
StrCmpNIA
PathFindExtensionW
StrCmpNIW
StrToIntA
StrCmpNW
PathFindFileNameW
StrSpnA
StrCmpNA
PathMatchSpecW
StrStrA
StrFormatByteSizeW
PathCombineW
StrCpyNW
PathUnquoteSpacesW
PathSkipRootW
StrToInt64ExA
StrChrW
StrPBrkA

ws2_32

htons
closesocket
shutdown
WSAStartup
socket
inet_ntoa
htonl
sendto
gethostbyname
inet_addr

powrprof

CallNtPowerInformation

urlmon

FindMimeFromData

oleaut32

VariantClear

ole32

CoTaskMemFree
CreateStreamOnHGlobal
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoInitialize

kernel32

GetCurrentThreadId
CloseHandle
FileTimeToLocalFileTime
GetCurrentProcessId
SetFileAttributesW
CreateThread
OutputDebugStringW
OutputDebugStringA
GetFileAttributesW
GetCurrentProcess
GetTimeFormatW
LeaveCriticalSection
Sleep
OpenProcess
GetCommandLineW
CreateMutexW
SetErrorMode
SearchPathW
GetTempFileNameW
GetModuleHandleW
GetCurrentThread
GetModuleFileNameW
InitializeCriticalSection
SetThreadPriority
GetLastError
SetProcessShutdownParameters
MultiByteToWideChar
SetFilePointer
lstrlenA
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
CreateFileMappingW
WriteFile
GetTickCount
lstrcpyA
MoveFileExW
SetEvent
WaitForSingleObject
GetModuleHandleA
SetFilePointerEx
CreateProcessA
GetSystemDirectoryA
DeleteCriticalSection
GetFileTime
CreatePipe
CreateToolhelp32Snapshot
GetFileSize
lstrcatW
Process32NextW
GetDateFormatW
TerminateProcess
MulDiv
CreateEventW
lstrlenW
Process32FirstW
EnterCriticalSection
FileTimeToSystemTime
MoveFileW
GetFileSizeEx
FlushFileBuffers
CreateFileW
lstrcmpiW
FindFirstFileW
GetDriveTypeW
InterlockedIncrement
GetLogicalDrives
GetSystemDirectoryW
FindClose
IsBadStringPtrW
IsBadReadPtr
GlobalMemoryStatusEx
QueryDosDeviceW
IsBadCodePtr
FindNextFileW
GetDiskFreeSpaceExW
IsBadWritePtr
ExpandEnvironmentStringsW
LoadLibraryW
GetProcAddress
IsBadStringPtrA
LocalFree
GetTempPathW
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
lstrcpynA
lstrcpynW
WaitForMultipleObjects
GetVersionExW
GetSystemInfo
GetHandleInformation
lstrcmpiA
ReadFile
CreateDirectoryW
GetComputerNameA
GetNativeSystemInfo
TlsAlloc
RtlUnwind
lstrcpyW

user32

wsprintfA
CharLowerBuffA
TranslateMessage
PeekMessageW
CreateWindowExW
RegisterClassW
DefWindowProcW
DispatchMessageW
wsprintfW
RegisterClassExW
UnregisterClassW
MessageBoxW
FillRect
DrawTextA
GetDC
GetSystemMetrics
SystemParametersInfoW
ReleaseDC
GetKeyboardLayoutList
GetForegroundWindow
CharLowerBuffW

advapi32

CryptDestroyKey
OpenProcessToken
GetTokenInformation
DuplicateToken
CheckTokenMembership
ConvertSidToStringSidW
CryptGetKeyParam
CryptAcquireContextW
RegCloseKey
RegOpenKeyExW
GetSecurityDescriptorOwner
GetFileSecurityW
RegQueryValueExW
EqualSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CreateWellKnownSid
CryptGenRandom
CryptImportKey

shell32

CommandLineToArgvW
SHChangeNotify
SHGetFolderPathW
SHGetFileInfoW
ShellExecuteW

gdi32

SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject

netapi32

NetApiBufferFree
NetUserEnum
NetUserGetInfo

ntdll

isspace
memset
_aulldvrm
memcpy
_allmul
RtlDosPathNameToNtPathName_U
NtDeleteFile
RtlFreeUnicodeString
tolower
memmove
_alldiv
NtQueryVirtualMemory

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 129KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0f524fe455225f95baeda368fc788a95

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

shlwapi

ws2_32

powrprof

urlmon

oleaut32

ole32

kernel32

user32

advapi32

shell32

gdi32

netapi32

ntdll

version

Sections

.text Size: 63KB - Virtual size: 62KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 129KB - Virtual size: 131KB

.text
Size: 63KB - Virtual size: 62KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 129KB - Virtual size: 131KB