Your Cresselia is legit
Cresselia is found in the wild at level 50 in ORAS, and it learns both Aurora Beam and Slash before then. This person probably just used a Master Ball on it just cause, made it relearn some moves, and somehow gave it Pokerus. If its not hacked, the original capture location should be Crescent Isle or somewhere in Sinnoh, and the IVs are probably fine.
A truly hacked Pokemon can be hard to tell, but usually they're perfect in every way. Shiny, lv.100, perfect IVs, you know the rest. But theres always a chance that someone hacked it to be imperfect, so the only real way to tell is to send it through Pokemon Bank.
Hope I helped!