023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82

Resubmissions

15-11-2023 11:10

231115-m96hzsgb22 10

02-05-2022 23:45

220502-3rtpgaeghq 10

Sharing

Copy URL

Twitter E-mail

General

Target

023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82
Size

2.6MB
MD5

fb95561e8ed7289d015e945ad470e6db
SHA1

03573bc869701cffd7c96e223633d46b0a23823a
SHA256

023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82
SHA512

2a0bf4048c1a9eca9e13566b1512403b51462c8eb71cfb273225fbc221aa156a3d3eb571fa5328ff2f4e2ef7026b3e8847f0c0a739d8f989ba716efa411821a6
SSDEEP

6144:sTlCgffOYPE99pqcLE9zn0HJGsfb7cwhl7e/:sJfWP9p1Lgzmbgye/

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

023f1ef0cc2c1e055b05ae1ff5bcc6bf2421003dea227aeb6d70c8a525fa3b82
.exe windows x86

c238930fa064812ba3069f8285a92cfa

Code Sign

55:0f:28:66:f0:cf:b7:58:b5:41:89:7a:a9:66:44:9c
Certificate

Issuer

CN=EENBOSIFBCTKNAZPAQ

Not Before

05-04-2020 20:13

Not After

31-12-2039 23:59

Subject

CN=EENBOSIFBCTKNAZPAQ

Extended Key Usages

ExtKeyUsageCodeSigning

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:61:a2:72:eb:bd:4c:33:95:c0:52:cb:f6:e8:c4:e2:78:ae:fe:40
Signer

Actual PE Digest

2f:61:a2:72:eb:bd:4c:33:95:c0:52:cb:f6:e8:c4:e2:78:ae:fe:40

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=EENBOSIFBCTKNAZPAQ

09-04-2020 16:53
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEvent
SetFileAttributesA
GetTickCount
WaitForMultipleObjects
GetSystemTime
GetLocalTime
OutputDebugStringA
FreeLibrary
LoadLibraryA
GetWindowsDirectoryA
lstrcpynA
MoveFileA
CreateMutexA
ReleaseMutex
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcAddress
DeviceIoControl
CreateThread
GetLastError
SetFilePointer
CopyFileA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
GetComputerNameA
GetCurrentThreadId
GetModuleHandleA
GetStartupInfoA
ResetEvent
CreateDirectoryA
WaitForSingleObject
DeleteFileA
GetTempPathA
lstrcpyA
SetErrorMode
GetVolumeInformationA
GetDriveTypeA
GetFileAttributesA
CreateEventA
CreateFileA
WriteFile
ReadFile
CloseHandle
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
lstrlenW
lstrlenA
GetDiskFreeSpaceExA
GetVersionExA
GetVersion
GetLogicalDriveStringsA
ConvertDefaultLocale
GetConsoleAliasExesW
CreateSemaphoreW
IsValidCodePage
GetFileAttributesExA
_hwrite
lstrcmp
GetComputerNameExA
EnumSystemLocalesA
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
SetStdHandle
ExitThread
VirtualQuery
GetSystemInfo
VirtualAlloc
GetDateFormatA
GetTimeFormatA
PeekNamedPipe
GetFileType
TerminateProcess
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
GlobalFlags
VirtualProtect
TlsFree
LocalReAlloc
VirtualFree
LCMapStringA
IsBadWritePtr
GetOEMCP
GetStringTypeA
GetCurrentDirectoryA
GetUserDefaultLCID
IsValidLocale
SetEnvironmentVariableA
GetFileInformationByHandle
InterlockedDecrement
GlobalSize
InterlockedExchange
GetACP
GetLocaleInfoA
FindClose
GetTimeZoneInformation
MulDiv
GetSystemDirectoryA
CompareStringA
LocalAlloc
LocalLock
LocalUnlock
SetThreadPriority
FreeResource
QueryPerformanceFrequency
QueryPerformanceCounter
GetOverlappedResult
GetProcessHeap
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
GetCurrentThread
lstrcmpiA
IsBadReadPtr
TerminateThread
Beep
SetLastError
IsBadCodePtr
LocalFree
InterlockedIncrement
SetUnhandledExceptionFilter
GetCurrentProcessId
ExitProcess
ResumeThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetThreadLocale
SetThreadLocale
GlobalFree
SetConsoleCtrlHandler
GetCurrentProcess
RaiseException
GetFileSize
Sleep
LoadResource
LockResource
SizeofResource
EnumResourceLanguagesW
GlobalDeleteAtom
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
DuplicateHandle
UnlockFile
LockFile
FlushFileBuffers
SuspendThread
lstrcmpA
SetEndOfFile

user32

GetNextDlgGroupItem
MessageBoxA
SendNotifyMessageA
CloseClipboard
OpenClipboard
SetClipboardData
EmptyClipboard
LoadMenuA
PostMessageA
SetCapture
GetClientRect
ReleaseCapture
InvalidateRect
DrawFocusRect
EnableWindow
GetSubMenu
GrayStringA
SetWindowRgn
LoadBitmapA
GetMenuStringA
GetMenuItemID
GetMenuState
ModifyMenuA
GetMenuItemCount
AppendMenuA
GetSystemMetrics
GetDC
DrawTextA
ReleaseDC
SystemParametersInfoA
GetSysColor
GetCursorPos
SetScrollPos
EqualRect
SetScrollRange
IsWindowVisible
GetClassInfoA
DefWindowProcA
SetWindowLongA
LoadCursorA
ShowWindow
wsprintfA
KillTimer
PeekMessageA
TranslateMessage
DispatchMessageA
IsIconic
DrawIcon
GetSystemMenu
SetTimer
LoadIconA
SetWindowTextA
GetMessagePos
PtInRect
GetCapture
DrawFrameControl
IsWindow
RedrawWindow
GetParent
InflateRect
OffsetRect
GetWindowRect
ClientToScreen
WindowFromPoint
GetActiveWindow
SetCursor
GetNextDlgTabItem
IsMenu
SendMessageA
TabbedTextOutA
GetWindowLongA
CopyRect
FillRect
DrawEdge
SetRect
GetKeyState
FrameRect
EndDeferWindowPos
GetProcessDefaultLayout
DdeClientTransaction
WINNLSGetIMEHotkey
UpdateWindow
CreatePopupMenu
CreateIconIndirect
GetDlgItem
DestroyWindow
DestroyMenu
DestroyCursor
SetWindowPos
MapWindowPoints
ScreenToClient
SetForegroundWindow
GetWindow
GetFocus
LockWindowUpdate
GetDCEx
DeleteMenu
SetParent
UnpackDDElParam
ReuseDDElParam
SetMenu
InvalidateRgn
SetWindowContextHelpId
MapDialogRect
EndDialog
ShowOwnedPopups
IsWindowEnabled
IsDlgButtonChecked
SetDlgItemInt
GetDlgItemInt
GetDesktopWindow
GetClassNameA
GetIconInfo
ExitWindowsEx
IsRectEmpty
UnhookWindowsHookEx
CallNextHookEx
EnumWindows
CheckRadioButton
SendDlgItemMessageA
GetForegroundWindow
GetTopWindow
GetMessageTime
DestroyIcon
GetAsyncKeyState
ScrollDC
IsChild
ChildWindowFromPointEx
SubtractRect
UnionRect
GetLastActivePopup
WaitMessage
PostQuitMessage
CheckDlgButton
SetFocus
MoveWindow
BeginPaint
EndPaint
GetDialogBaseUnits
GetWindowRgn
ShowCursor
BeginDeferWindowPos
DeferWindowPos
SetRectEmpty
GetWindowTextA
SetDlgItemTextA
ScrollWindow
CheckMenuRadioItem
AdjustWindowRectEx
CopyIcon
ShowScrollBar
DrawIconEx
CopyImage
SetMenuDefaultItem
MessageBeep
FlashWindow
SetActiveWindow
BringWindowToTop
RemoveMenu
EnableMenuItem
CheckMenuItem
CreateMenu
IntersectRect
GetDoubleClickTime
GetSysColorBrush
GetWindowDC
GetMenu
GetScrollInfo
IsZoomed
ValidateRect
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetWindowPlacement
GetDlgCtrlID
SetWindowPlacement
SetScrollInfo
GetScrollPos
GetScrollRange
TrackPopupMenu
GetListBoxInfo

gdi32

GetBkColor
GetTextMetricsA
GetCharWidthA
CombineRgn
SelectClipRgn
StretchBlt
Pie
CreateRectRgn
CreateFontA
RealizePalette
CreatePalette
Polygon
GetStockObject
GetWindowExtEx
GetViewportExtEx
CreateBitmap
LPtoDP
GetMapMode
DPtoLP
Rectangle
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetObjectA
GetPixel
SelectObject
BitBlt
DeleteObject
DeleteDC
GetTextExtentPoint32A
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectA
CreateSolidBrush
CreatePen
GetDeviceCaps
GdiSetServerAttr
CreateEllipticRgn
GetFontAssocStatus
GetEnhMetaFileBits
GetCharWidthI
GetTextCharsetInfo
EngUnicodeToMultiByteN
GetCharacterPlacementW
PlgBlt
BeginPath
EngStretchBltROP
GdiConvertBrush
CreateRoundRectRgn
SetSystemPaletteUse
EngGetCurrentCodePage
GetEnhMetaFileHeader
RectInRegion
STROBJ_dwGetCodePage
EngDeleteSemaphore
EngDeletePalette
SelectBrushLocal
GetStringBitmapA
GetDeviceGammaRamp
GetDCPenColor
SetICMProfileA
GdiGetPageHandle
SetPixelV
SetBoundsRect
GetBitmapDimensionEx
SetBitmapDimensionEx
SetBkMode
GetWindowOrgEx
GetViewportOrgEx
GetBitmapBits
SetBitmapBits
CreateDIBSection
SetDIBColorTable
GdiFlush
CreateRectRgnIndirect
Ellipse
GetRgnBox
SelectPalette
CreatePatternBrush
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
SetROP2
SetPolyFillMode
CreatePolygonRgn
FillRgn
OffsetRgn
SetRectRgn
SaveDC
GetClipBox
ExtSelectClipRgn
SetStretchBltMode
SetDIBitsToDevice
RestoreDC
GetDIBits
PatBlt
SetTextAlign
GetTextColor
SetPixel
SetBkColor
SetTextColor
CreateBrushIndirect
GetStretchBltMode

advapi32

RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
CryptAcquireContextA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CryptReleaseContext
CryptGenRandom
RegOpenKeyA
GetUserNameA

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA
ShellExecuteExA
DragFinish
SHAppBarMessage

ole32

CoCreateInstance
CoTaskMemFree
StgOpenStorage
CoTaskMemAlloc
OleSetContainedObject
OleCreateStaticFromData
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
ReleaseStgMedium
OleDuplicateData
CoInitialize
CLSIDFromProgID
CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard
CoGetClassObject
StgOpenStorageOnILockBytes
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoInitializeSecurity
CoUninitialize
CreateStreamOnHGlobal

shlwapi

PathFileExistsW
PathRenameExtensionW
PathRemoveFileSpecW
PathIsRelativeW
PathRemoveExtensionW
PathFindExtensionW
PathFindFileNameW
PathRemoveBackslashW
PathAddBackslashW
PathIsURLW
PathCanonicalizeW
PathBuildRootW
PathStripToRootW
PathStripPathW
PathGetDriveNumberW
PathGetArgsW
PathIsRootW
PathCombineW
PathIsUNCW
UrlUnescapeW
PathMatchSpecW

comctl32

ImageList_Draw
ImageList_GetImageCount
ImageList_AddMasked
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_Remove
ImageList_Create
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragShowNolock
ImageList_DragMove
ImageList_EndDrag
ImageList_BeginDrag
CreatePropertySheetPageW
DestroyPropertySheetPage
ImageList_Destroy
ImageList_GetIconSize
ImageList_GetIcon
ImageList_SetOverlayImage
ImageList_DrawEx
ImageList_ReplaceIcon
ImageList_Add
ImageList_LoadImageW
PropertySheetW
ImageList_SetBkColor

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

c238930fa064812ba3069f8285a92cfa

Code Sign

55:0f:28:66:f0:cf:b7:58:b5:41:89:7a:a9:66:44:9cCertificate

Extended Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

2f:61:a2:72:eb:bd:4c:33:95:c0:52:cb:f6:e8:c4:e2:78:ae:fe:40Signer

Signature Validations

Verification

09-04-2020 16:53 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 2.6MB - Virtual size: 2.6MB

.data Size: 41KB - Virtual size: 41KB

.rsrc Size: 9KB - Virtual size: 8KB

55:0f:28:66:f0:cf:b7:58:b5:41:89:7a:a9:66:44:9c
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

2f:61:a2:72:eb:bd:4c:33:95:c0:52:cb:f6:e8:c4:e2:78:ae:fe:40
Signer

09-04-2020 16:53
Valid: false

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 41KB - Virtual size: 41KB

.rsrc
Size: 9KB - Virtual size: 8KB