ba7e4f4e60e5307e25ee0e052018e25de9a9dc310a1d58cade18f50c8a407591

Sharing

Copy URL

Twitter E-mail

General

Target

ba7e4f4e60e5307e25ee0e052018e25de9a9dc310a1d58cade18f50c8a407591
Size

161KB
MD5

6015bbeee416d93df03e4f7c3f7c2f96
SHA1

8f26971ca886eec445006442322f656a7f27313a
SHA256

ba7e4f4e60e5307e25ee0e052018e25de9a9dc310a1d58cade18f50c8a407591
SHA512

d70d75452b28d6dbba2d182f1d4b3134d80c4fa952b394a707d8a84a01c6d90fa4f422ea617ead7ea3dfbe4b2ad2a3b53e0752044c0dadfc252bc4f4ff84980b
SSDEEP

3072:NEu7WuWHcWWuWToWuWoWuWhHW0WoWuWY0uFSWyiE3mc0nCG5cAVxng:Cu7WuWHhWuWToWuWoWuWZW0WoWuWYDy

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

ba7e4f4e60e5307e25ee0e052018e25de9a9dc310a1d58cade18f50c8a407591
.dll windows x86

e2741e6a3b69861bd266f8ac667be460

Code Sign

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsDebuggerPresent
ConvertDefaultLocale
WriteProfileStringA
LoadLibraryA
GetProcAddress
GetModuleHandleW
SetErrorMode

user32

UpdateLayeredWindow
CreateWindowExW
BeginDeferWindowPos
SetWindowRgn
CharPrevExA
RegisterDeviceNotificationW
RemovePropW
RegisterWindowMessageA
FillRect
IsDialogMessage
LoadBitmapA
DestroyAcceleratorTable
EnumPropsExA
GetComboBoxInfo
RegisterClipboardFormatA
GetKBCodePage
ChangeDisplaySettingsExA
ValidateRgn
DdeSetUserHandle
PostThreadMessageW
GetCursorPos
GetDlgItemTextA
GetUserObjectInformationW
UnregisterClassW
mouse_event
CopyIcon
PostThreadMessageA
LockWindowUpdate
SetWindowsHookExW
EndMenu
SendMessageA
SendMessageCallbackW
DrawFrameControl
SetMenuInfo
GetKeyboardType
EnumDisplaySettingsW
DragDetect
RegisterClipboardFormatW
MessageBoxIndirectA
ReuseDDElParam
OemToCharA
EnumPropsExW
RedrawWindow
SetDlgItemInt
GetSystemMetrics
VkKeyScanW
InSendMessage
GetAsyncKeyState
IsWindow
GetClipboardOwner
GetMessagePos
GetClipboardData
CharNextA
GetActiveWindow
GetMenuCheckMarkDimensions
GetDlgCtrlID
IsWindowEnabled
CharLowerA
GetFocus
IsMenu
GetCaretBlinkTime
GetDC
GetWindowDC
IsIconic
OemKeyScan
OpenIcon
GetKeyboardLayout
GetListBoxInfo
GetSysColor
GetWindowTextLengthW
GetParent
IsCharAlphaW
CloseWindow
GetCursor
PaintDesktop
DestroyMenu
GetInputState
DrawMenuBar
LoadCursorFromFileA
GetCapture
GetForegroundWindow
GetClipboardSequenceNumber
GetThreadDesktop
DestroyWindow
GetProcessWindowStation
CharLowerW
IsWindowUnicode
GetLastActivePopup
GetDesktopWindow
EnumClipboardFormats
GetSysColorBrush
GetMenu
GetWindowContextHelpId
DestroyCursor
GetShellWindow
LoadIconA

gdi32

GetTextColor
PathToRegion
CloseEnhMetaFile
GetTextCharacterExtra
GetColorSpace
GetBkColor
EndPage
UnrealizeObject
GetTextCharset
GdiFlush
CreateMetaFileW
GetObjectType
BeginPath
AddFontResourceW
EndDoc
CreateHalftonePalette
SwapBuffers
AddFontResourceA
GdiGetBatchLimit
GetStockObject
SaveDC
GetBkMode
AbortDoc
GetStretchBltMode
GetLayout
CreateMetaFileA
DeleteEnhMetaFile
GetMapMode
DeleteMetaFile
GetPixelFormat
StrokePath

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2741e6a3b69861bd266f8ac667be460

Code Sign

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Sections

.text Size: 48KB - Virtual size: 48KB

.rdata Size: 90KB - Virtual size: 89KB

.data Size: 19KB - Virtual size: 19KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 988B

.text
Size: 48KB - Virtual size: 48KB

.rdata
Size: 90KB - Virtual size: 89KB

.data
Size: 19KB - Virtual size: 19KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 988B