3069915e03f560e6f95bb6daab1e06752edf186a85cf82ddc868fb0cc308adc9

Sharing

Copy URL

Twitter E-mail

General

Target

3069915e03f560e6f95bb6daab1e06752edf186a85cf82ddc868fb0cc308adc9
Size

365KB
MD5

d0035466f1e16bb5c3a26fc041c5978e
SHA1

1407ad134cc4c151b8193410785acc324fd11fba
SHA256

3069915e03f560e6f95bb6daab1e06752edf186a85cf82ddc868fb0cc308adc9
SHA512

dfc57ee1fdbd84c26343a0ebd04dd8fda91c3b5b2265371c0ee03923205f309dab2054f0a60e9bfc71a53ab4624724207e59d84c30409ac1e043630703ba7255
SSDEEP

6144:NCAGcAcig3SuEE/UPTYkkK795PuBSciRzWpILtsEdKg:Ndfh3SW/Uc5K73PuBMRb

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

3069915e03f560e6f95bb6daab1e06752edf186a85cf82ddc868fb0cc308adc9
.exe windows x86

acc11d71c1973fe86e07c451b98278e2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
LoadLibraryA
GetProcAddress
GetLastError
OpenProcess
GetModuleFileNameW
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
WaitForDebugEvent
GetPriorityClass
GetModuleHandleW
CreateConsoleScreenBuffer
SetSystemTimeAdjustment
RemoveDirectoryW
GetConsoleAliasExesLengthA
Process32NextW
EscapeCommFunction
GetConsoleMode
ReadConsoleOutputCharacterW
RtlZeroMemory
IsDebuggerPresent
SetFilePointerEx
Module32Next
lstrcatW
DeleteCriticalSection
OpenEventW
GetProfileStringA
OpenWaitableTimerA
GetDevicePowerState
GetNumberOfConsoleMouseButtons
GetProfileIntW
Beep
GetFullPathNameA
PeekConsoleInputA
WriteConsoleOutputA
SetConsoleDisplayMode
GetFullPathNameW
GetFileAttributesA
RemoveDirectoryA
WinExec
CompareStringA
MultiByteToWideChar
GetStartupInfoA
CreateProcessA
CopyFileA
GetTempPathA
FreeLibrary
DeleteFileA

user32

GetKeyboardLayout
GetForegroundWindow
LoadCursorW
ReleaseCapture
CharToOemW
SetClassWord
LoadMenuIndirectA
LoadCursorFromFileW
SendIMEMessageExA
PtInRect
WINNLSGetIMEHotkey
GetPropW
DdeAddData
GetMenuItemInfoW
PeekMessageA
MapVirtualKeyExW
CreateDialogIndirectParamW
MessageBoxA
GetMenuStringW
RealChildWindowFromPoint
MapVirtualKeyA
DdeQueryStringA
GetClipboardSequenceNumber
BeginDeferWindowPos
GetSysColorBrush
DdeInitializeA
FlashWindowEx
DdeCreateStringHandleA
LoadIconA
EnableScrollBar
ShowWindow
GetScrollRange
GetClassLongA
DrawMenuBar
GetMenuCheckMarkDimensions
InflateRect
SetActiveWindow
TrackMouseEvent
GetLastActivePopup
InvalidateRect
RegisterClipboardFormatW
EnumDisplayDevicesW
DestroyMenu
keybd_event
ShowCursor
EnumDisplaySettingsExA
DdeDisconnectList
SetWindowLongA
ReleaseDC
GetDC
CopyIcon
LoadCursorA
EndDeferWindowPos
DeferWindowPos
GetWindowLongA
CallWindowProcA
KillTimer
FindWindowA
GetAsyncKeyState
SetCursor
RedrawWindow
SetCapture
GetParent
DestroyCursor
EnableWindow
IsWindow
GetDesktopWindow
PostMessageA
GetSysColor
GetWindowRect
SetTimer
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
SendMessageA

gdi32

CreateMetaFileW
GetStockObject
GetEnhMetaFileA
GetEnhMetaFileBits
GdiSetBatchLimit
EnumFontFamiliesA
EngCreateSemaphore
CreateColorSpaceA
GetTextAlign
SetDCBrushColor
GetObjectA
CreateFontIndirectA
CreateSolidBrush
GetTextExtentPoint32A

advapi32

RegOpenKeyW
RegQueryValueExA
GetTokenInformation
RegSetValueExA
RegOpenKeyA
RegDeleteKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegCloseKey

shell32

CommandLineToArgvW
SHFileOperationA
ShellExecuteEx
ExtractIconA
DragQueryFile
SHGetSettings
SHEmptyRecycleBinW
SHFileOperationW
FindExecutableW
SHLoadNonloadedIconOverlayIdentifiers
SHFreeNameMappings
SHGetFolderPathW
SHFileOperation
SHGetFileInfoA
DragQueryFileW
DoEnvironmentSubstW

shlwapi

StrRStrIW
StrRChrA
StrCmpNA
StrChrW
StrRChrIA

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 341B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text3
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text2
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data3
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

acc11d71c1973fe86e07c451b98278e2

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

Sections

.text Size: 34KB - Virtual size: 33KB

.rdata Size: 512B - Virtual size: 341B

.text3 Size: 10KB - Virtual size: 9KB

.text2 Size: 271KB - Virtual size: 271KB

.data Size: 25KB - Virtual size: 25KB

.data3 Size: 20KB - Virtual size: 19KB

.rsrc Size: 3KB - Virtual size: 2KB

.text
Size: 34KB - Virtual size: 33KB

.rdata
Size: 512B - Virtual size: 341B

.text3
Size: 10KB - Virtual size: 9KB

.text2
Size: 271KB - Virtual size: 271KB

.data
Size: 25KB - Virtual size: 25KB

.data3
Size: 20KB - Virtual size: 19KB

.rsrc
Size: 3KB - Virtual size: 2KB