ba71ddcab00697f42ccc7fc67c7a4fccb92f6b06ad02593a972d3beb8c01f723

Sharing

Copy URL

Twitter E-mail

General

Target

ba71ddcab00697f42ccc7fc67c7a4fccb92f6b06ad02593a972d3beb8c01f723
Size

590KB
MD5

523549ffdcb9b321a921707646508653
SHA1

94808f20001137569b88877c3c757b151070f673
SHA256

ba71ddcab00697f42ccc7fc67c7a4fccb92f6b06ad02593a972d3beb8c01f723
SHA512

16c1ca1e2bda58d2981f15d3a9aec6ba92463d6ff186fa6b668f5683db5feb351d931118033a3a2ab6b1d8092a6ffdbb400ab369ca420effcc293b64c6120534
SSDEEP

3072:cY5UHwtHqdIHGpPlW5fWyuTsqYaurw24LdZmm7/CO8gr:DBEpPlByuCaur54LdZmhO8

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

ba71ddcab00697f42ccc7fc67c7a4fccb92f6b06ad02593a972d3beb8c01f723
.exe windows x86

881d01fe0bccff8f956a30825bc9bf93

Code Sign

4e:bd:25:66:af:c8:c9:62:07:ae:37:9f:98:95:a5:e5
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

17-02-2020 00:00

Not After

16-02-2021 23:59

Subject

CN=DANIEL CIURA PHU SEC CAR,O=DANIEL CIURA PHU SEC CAR,POSTALCODE=31-610,STREET=66-50 Os. Tysiaclecia,L=Krakow,ST=Krakow,C=PL,2.5.4.18=#130633312d363130

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-05-2019 00:00

Not After

01-08-2030 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f8:38:0f:3b:2d:5b:3b:e7:6d:66:59:80:8f:d7:af:b4:0e:6e:79:7f:2a:01:e6:b1:70:b1:53:05:f8:e7:20:a8
Signer

Actual PE Digest

f8:38:0f:3b:2d:5b:3b:e7:6d:66:59:80:8f:d7:af:b4:0e:6e:79:7f:2a:01:e6:b1:70:b1:53:05:f8:e7:20:a8

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=DANIEL CIURA PHU SEC CAR,O=DANIEL CIURA PHU SEC CAR,POSTALCODE=31-610,STREET=66-50 Os. Tysiaclecia,L=Krakow,ST=Krakow,C=PL,2.5.4.18=#130633312d363130

09-03-2020 13:50
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
VirtualAlloc
SetErrorMode
OpenProcess
RegisterWaitForSingleObject
GetUserDefaultUILanguage
UnregisterWait
GetCurrentProcess
FlushInstructionCache
RaiseException
WideCharToMultiByte
GetSystemTime
GetSystemDirectoryW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetExitCodeThread
GetStringTypeExW
MultiByteToWideChar
GetLocaleInfoW
GetCommandLineW
SetCurrentDirectoryW
OutputDebugStringW
DebugBreak
FatalExit
SearchPathW
GetSystemDefaultUILanguage
GetVersionExW
LoadLibraryExW
GetThreadLocale
GetLocaleInfoA
GetACP
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
HeapSetInformation
DuplicateHandle
LocalAlloc
GetModuleFileNameW
GetFileType
CreateFileW
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
VerifyVersionInfoW
VerSetConditionMask
LocalFree
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
FormatMessageW
GetTimeFormatW
GetDateFormatW
SystemTimeToTzSpecificLocalTime
GetLastError
FileTimeToSystemTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedExchange
InterlockedCompareExchange
CreateEventW
FreeLibrary
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
CloseHandle
GetCurrentThread
SetEvent
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
TerminateJobObject
WaitForMultipleObjects
CreateThread
SetLastError
TerminateProcess
AssignProcessToJobObject
SetInformationJobObject
CreateJobObjectW
QueueUserWorkItem
WaitForSingleObject
ResetEvent
OpenEventW
CompareStringW
CompareFileTime
SystemTimeToFileTime
SetComputerNameExA
SetMessageWaitingIndicator
ReadConsoleW
SetPriorityClass
MoveFileA
MulDiv
WaitForDebugEvent
SetComputerNameExW
MoveFileExW
EnumResourceTypesA
GetSystemWindowsDirectoryW
GetNumberOfConsoleInputEvents
FindFirstFileW
WriteProfileStringW
RtlMoveMemory
BackupRead
SetCalendarInfoW
GetConsoleAliasExesLengthA
LCMapStringW
RtlUnwind
ConvertThreadToFiber
GetExitCodeProcess
IsBadCodePtr
WritePrivateProfileSectionA
OutputDebugStringA
HeapWalk
GetThreadContext
FindFirstChangeNotificationA
FindNextFileA
IsDBCSLeadByteEx
GetFileAttributesW
SetThreadIdealProcessor
FindNextVolumeMountPointW
GetTempPathA
GetEnvironmentStringsW
SetCommBreak
GetStartupInfoA
GetModuleHandleA

user32

LoadIconA
LoadCursorA
ShowWindow
UpdateWindow
PostQuitMessage
DefWindowProcA
LoadCursorFromFileW
GetInputState
GetDoubleClickTime
IsWindowEnabled
VkKeyScanA
IsWindowVisible
GetSysColorBrush
GetCapture
GetQueueStatus
GetProcessWindowStation
EndMenu
DestroyWindow
InSendMessage
CharLowerW
DestroyCursor
GetCursor
GetMenu
CreatePopupMenu
DestroyMenu
AppendMenuW
EnableMenuItem
TrackPopupMenuEx
ScreenToClient
GetWindow
SetCursor
IsChild
DialogBoxParamW
GetKeyboardLayout
GetKeyboardLayoutList
IsRectEmpty
SetActiveWindow
IsDialogMessageW
DispatchMessageW
TranslateMessage
GetMessageW
CharNextW
CharUpperW
GetKeyState
GetClassNameW
MsgWaitForMultipleObjects
SetWindowRgn
SetScrollInfo
GetScrollInfo
ScrollWindowEx
EnableWindow
MessageBoxW
MapWindowPoints
GetDlgCtrlID
SystemParametersInfoW
GetSystemMetrics
CloseDesktop
SetThreadDesktop
SetWindowPos
LoadStringW
UnregisterClassA
PostMessageW
IsWindow
CreateDesktopW
GetThreadDesktop
GetUserObjectInformationW
OpenInputDesktop
GetDesktopWindow
PeekMessageW
ReleaseDC
GetDC
DestroyIcon
LoadImageW
GetSysColor
CallWindowProcW
SetWindowLongW
SendMessageW
GetClientRect
BeginPaint
EndPaint
InvalidateRect
GetClassInfoExW
LoadCursorW
DefWindowProcW
EnumDisplayMonitors
GetMonitorInfoW
SetTimer
RegisterClassExW
GetWindowLongW
GetFocus
GetWindowTextW
GetWindowTextLengthW
CopyRect
InflateRect
DrawFocusRect
GetDialogBaseUnits
SetClassLongW
CreateWindowExW
SetWindowTextW
KillTimer
EndDialog
SwitchDesktop
GetWindowRect
GetDlgItem
CreateAcceleratorTableW
FillRect
DestroyAcceleratorTable
TranslateAcceleratorW
TrackMouseEvent
PtInRect
ClientToScreen
BeginDeferWindowPos
EndDeferWindowPos
SetFocus
GetCaretPos
EqualRect
OffsetRect
SendInput
DeferWindowPos
MoveWindow
GetParent
AttachThreadInput
GrayStringW
BringWindowToTop
IsCharAlphaW
GetKeyboardLayoutNameW
UnhookWinEvent
DdeCreateStringHandleA
SetDoubleClickTime
ImpersonateDdeClientWindow

gdi32

GetStockObject
CreateSolidBrush
CloseEnhMetaFile
SaveDC
GetROP2
GdiGetBatchLimit
EndPage
GetLayout
EndDoc
DeleteObject
GetObjectA
CreateFontIndirectW
GetDeviceCaps
GetObjectW
DeleteDC
BitBlt
SelectObject
SetLayout
CreateCompatibleDC
CreateRoundRectRgn
SetBkMode
GetDIBits
CreateCompatibleBitmap
StretchBlt
CreateDIBSection
SetDIBits
CreateDCW
GetTextExtentPoint32W
GetTextColor
GetBkColor
CreateICW
SetTextColor
SetBkColor
EngStrokeAndFillPath
PATHOBJ_vGetBounds
DeleteEnhMetaFile
PolyPolygon
EngLockSurface
CancelDC
GetKerningPairs
StrokeAndFillPath
DescribePixelFormat
AddFontResourceExA
GetDeviceGammaRamp
RemoveFontResourceExW
EngDeletePalette
GdiPlayDCScript
FONTOBJ_pvTrueTypeFontFile
GetRasterizerCaps
CreateColorSpaceA
GetDIBColorTable
GetStringBitmapA
SetStretchBltMode
DeleteMetaFile
GdiSwapBuffers
PolyBezierTo
GetCharABCWidthsFloatW
GetFontUnicodeRanges
PlgBlt
PathToRegion
EngGradientFill
RemoveFontResourceExA
SetPixelV

comdlg32

GetSaveFileNameW
GetOpenFileNameW
GetFileTitleW

advapi32

RegOpenKeyA
GetUserNameA
RegQueryValueExA
InitializeAcl
GetAclInformation
GetSecurityDescriptorControl
CryptSignHashW
CryptGetUserKey
CryptAcquireContextW
CryptCreateHash
CryptReleaseContext
CryptGetProvParam
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptSetProvParam
CryptDecrypt
CryptDestroyKey
CryptSetHashParam
OpenProcessToken
GetTokenInformation
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ConvertStringSidToSidW
LookupAccountSidW
CryptGetHashParam
CryptHashData
CryptDestroyHash
GetSecurityInfo
AdjustTokenPrivileges
GetAce
LookupPrivilegeValueW
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
ImpersonateSelf
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
EqualSid
CopySid
IsValidSid
GetLengthSid
OpenThreadToken
SetThreadToken
RevertToSelf
GetSecurityDescriptorLength
MakeSelfRelativeSD
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
MakeAbsoluteSD
AddAce
RegEnumKeyW

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteExW
DragAcceptFiles
ExtractAssociatedIconW
SHCreateDirectoryExW
SHGetIconOverlayIndexA
DragFinish

ole32

CoTaskMemFree
StgCreateStorageEx
CreateStreamOnHGlobal
CoCreateGuid
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance
DoDragDrop

shlwapi

PathFindExtensionW
PathAddBackslashW
StrRChrA
PathIsUNCW

comctl32

ImageList_Destroy
ImageList_Add
ImageList_Create
InitCommonControlsEx

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_controlfp

imm32

ImmGetContext

Sections

.text
Size: 488KB - Virtual size: 487KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

881d01fe0bccff8f956a30825bc9bf93

Code Sign

4e:bd:25:66:af:c8:c9:62:07:ae:37:9f:98:95:a5:e5Certificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

f8:38:0f:3b:2d:5b:3b:e7:6d:66:59:80:8f:d7:af:b4:0e:6e:79:7f:2a:01:e6:b1:70:b1:53:05:f8:e7:20:a8Signer

Signature Validations

Verification

09-03-2020 13:50 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

shlwapi

comctl32

msvcrt

imm32

Sections

.text Size: 488KB - Virtual size: 487KB

.rdata Size: 512B - Virtual size: 28B

.data Size: 17KB - Virtual size: 16KB

.rsrc Size: 77KB - Virtual size: 76KB

4e:bd:25:66:af:c8:c9:62:07:ae:37:9f:98:95:a5:e5
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

f8:38:0f:3b:2d:5b:3b:e7:6d:66:59:80:8f:d7:af:b4:0e:6e:79:7f:2a:01:e6:b1:70:b1:53:05:f8:e7:20:a8
Signer

09-03-2020 13:50
Valid: false

.text
Size: 488KB - Virtual size: 487KB

.rdata
Size: 512B - Virtual size: 28B

.data
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 77KB - Virtual size: 76KB