e17dd6e10b76f9d0987b3fbd91504a4a94c30712f6d1a677eb13886becbcceb0

Sharing

Copy URL

Twitter E-mail

General

Target

e17dd6e10b76f9d0987b3fbd91504a4a94c30712f6d1a677eb13886becbcceb0
Size

109KB
MD5

776407ef671c10897da7093a079ff8be
SHA1

7baa088a928ac6f9cc8d9869e7efe04e3e07d0a9
SHA256

e17dd6e10b76f9d0987b3fbd91504a4a94c30712f6d1a677eb13886becbcceb0
SHA512

5da155e85b26fe98070e3b87888e645a53a4a6705f13f53f1af3a0736181621f8fba2e995f035a0f4b955bab661954d18d51c6ba0ad032c46b24eaf36693fa6d
SSDEEP

3072:9I6JQGuHlBhl45ik04Bn5n/An2/997oizgEnZJcGBa5G0dUv1:LeZvk04Bn5n/An2/99Uungbdq1

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

e17dd6e10b76f9d0987b3fbd91504a4a94c30712f6d1a677eb13886becbcceb0
.exe windows x86

2055bd5e5e13dc5dbf1dd934f372f818

Code Sign

ca:98:7a:78:a2:e2:5f:bc:1a:51:51:97:46:b5:b9:33
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28-03-2020 00:00

Not After

28-03-2021 23:59

Subject

CN=Ltd \"Piligrim\",O=Ltd \"Piligrim\",POSTALCODE=238530,STREET=d. 1 etazh 1 pom. 1\, per. 2-I Primorski,L=Zelenogradsk,ST=Kaliningradskaya Obl,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2030 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:7c:3a:f1:82:2b:eb:1e:03:0e:24:dc:e9:a8:d8:69:86:08:9e:88
Signer

Actual PE Digest

2f:7c:3a:f1:82:2b:eb:1e:03:0e:24:dc:e9:a8:d8:69:86:08:9e:88

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Ltd \"Piligrim\",O=Ltd \"Piligrim\",POSTALCODE=238530,STREET=d. 1 etazh 1 pom. 1\, per. 2-I Primorski,L=Zelenogradsk,ST=Kaliningradskaya Obl,C=RU

18-05-2022 18:06
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsValidCodePage
GetLastError
LocalFree
LocalAlloc
GetEnvironmentVariableA
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetStdHandle
CloseHandle
IsDBCSLeadByte
SetConsoleCursorPosition
ScrollConsoleScreenBufferA
GetConsoleScreenBufferInfo
CreateFileW
GetTimeFormatW
GetDateFormatW
ReadFile
GetSystemDefaultLCID
FileTimeToSystemTime
DosDateTimeToFileTime
GetTimeZoneInformation
SetConsoleCtrlHandler
GetDriveTypeA
SetFilePointer
CreateFileA
GetModuleHandleA
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
HeapFree
GetCurrentDirectoryA
SetCurrentDirectoryA
HeapAlloc
GetSystemTimeAsFileTime
Beep
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
SetEnvironmentVariableA
GetFullPathNameA
WriteFile
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetCPInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetProcessHeap
GetStringTypeA
GetStringTypeW
VirtualAlloc
HeapReAlloc
VirtualProtect
GetSystemInfo
VirtualQuery
LCMapStringA
LCMapStringW
SetEnvironmentVariableW
GetFileAttributesA
LoadLibraryA
GetACP
GetOEMCP
SetStdHandle
FlushFileBuffers
CompareStringA
CompareStringW
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
RtlUnwind
GetLocaleInfoW
SetEndOfFile

user32

GetMessagePos
GetCursorPos
PostQuitMessage
TranslateMessage
DispatchMessageW
MapVirtualKeyW
VkKeyScanW
GetAsyncKeyState
GetFocus
SetCapture
GetScrollInfo
SetScrollInfo
EnableScrollBar
ScrollWindow
GetParent
WindowFromPoint
SetParent
RedrawWindow
ScreenToClient
ClientToScreen
IsDialogMessageW
IsWindowEnabled
GetMessageTime
GetActiveWindow
GetWindow
ChildWindowFromPointEx
GetCapture
TrackPopupMenu
DefWindowProcW
CallWindowProcW
InvalidateRect
FillRect
IsWindow
GetSysColor
GetClientRect
SetFocus
ReleaseCapture
SetCursorPos
MoveWindow
DeferWindowPos
CreateWindowExW
GetUpdateRgn
MapWindowPoints
BeginDeferWindowPos
EndDeferWindowPos
GetMenuItemInfoW
GetMenuItemCount
RegisterHotKey
UnregisterHotKey
PtInRect
InflateRect
GetIconInfo
CreateIconIndirect
LoadIconW
LoadBitmapW
LoadImageW
IsIconic
IsZoomed
FlashWindow
CreateDialogIndirectParamW
GetWindowPlacement
DrawMenuBar
EnableMenuItem
GetDesktopWindow
CreateDialogParamW
GetDlgItem
SetWindowRgn
DestroyIcon
DrawTextW
CopyRect
DrawStateW
OffsetRect
SetRectEmpty
DrawFocusRect
DrawFrameControl
DrawIconEx
DestroyCursor
GetMenuState
GetMenuItemID
GetSubMenu
GetSysColorBrush
CheckMenuItem
CheckMenuRadioItem
SetMenuItemInfoW
SetRect
DrawEdge
DestroyMenu
CreatePopupMenu
InsertMenuW
InsertMenuItemW
RemoveMenu
ModifyMenuW
CreateMenu
GetClipboardFormatNameW
RegisterClipboardFormatW
ChildWindowFromPoint
UnionRect
GetDialogBaseUnits
GetDoubleClickTime
DestroyAcceleratorTable
CreateAcceleratorTableW
TranslateAcceleratorW
MessageBeep
GetClassNameW
GetWindowTextW
GetMessageW
ValidateRect
PostThreadMessageW
BeginPaint
EndPaint
GetWindowDC
ChangeDisplaySettingsW
EnumDisplaySettingsW
FindWindowExW
IsRectEmpty
ValidateRgn
IsClipboardFormatAvailable
ShowCursor
AdjustWindowRectEx
RegisterWindowMessageW
WaitForInputIdle
ExitWindowsEx
KillTimer
SetTimer
DdeFreeStringHandle
DdeUninitialize
DdeQueryStringW
DdeFreeDataHandle
DdeGetData
DdeCreateDataHandle
DdeGetLastError
DdeInitializeW
DdeDisconnect
DdeClientTransaction
DdeCreateStringHandleW
DdeNameService
DdeConnect
DdePostAdvise
SetActiveWindow
BringWindowToTop
SetWindowPos
EnableWindow
UpdateWindow
DestroyWindow
AttachThreadInput
ShowWindow
SetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
GetForegroundWindow
ReleaseDC
GetDC
AppendMenuW
GetSystemMenu
wsprintfW
IsProcessDPIAware
SystemParametersInfoW
GetKeyState
SetWindowsHookExW
SetWindowLongW
GetWindowLongW
UnhookWindowsHookEx
GetWindowTextLengthW
SetWindowTextW
GetSystemMetrics
SetCursor
HideCaret
LoadCursorW
RegisterClassW
UnregisterClassW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
CallNextHookEx
CloseClipboard
EmptyClipboard
GetClipboardData
OpenClipboard
SetMenu
GetWindowRect
SendMessageW
PostMessageW
keybd_event
LoadIconA
GetMenuContextHelpId
IsCharAlphaW
OpenIcon
CharNextA
OemKeyScan
GetMenu
EndMenu
GetClipboardOwner
GetTopWindow
IsCharLowerW
GetKeyboardLayout
IsCharAlphaNumericA
IsWindowUnicode
InSendMessage
CharLowerW
GetKBCodePage
GetMessageExtraInfo
PaintDesktop
IsCharAlphaNumericW
GetDlgCtrlID
GetCaretBlinkTime
EnumClipboardFormats
GetQueueStatus
CloseDesktop
GetListBoxInfo
CloseWindowStation
GetProcessWindowStation
GetClipboardSequenceNumber
GetOpenClipboardWindow
CharUpperW
GetClipboardViewer
GetThreadDesktop
IsCharAlphaA
LoadCursorFromFileA
IsMenu
IsCharLowerA
CountClipboardFormats
VkKeyScanA
CloseWindow
GetWindowContextHelpId
WindowFromDC
AnyPopup
GetMenuCheckMarkDimensions
IsGUIThread
LoadCursorFromFileW
CopyIcon
GetLastActivePopup
CharUpperA
GetInputState
CharLowerA
GetCursor
IsCharUpperW
CharNextW
ShowCaret
GetWindowTextLengthA
GetKeyboardType
GetShellWindow
IsCharUpperA

gdi32

GetStockObject
CreatePatternBrush
DeleteDC
DeleteColorSpace
GetROP2
GetMapMode
GetDCBrushColor
WidenPath
AddFontResourceW
GetBkMode
GetTextCharacterExtra
DeleteMetaFile
GetDCPenColor
EndPage
GdiFlush
CancelDC
SwapBuffers
GetSystemPaletteUse
CloseFigure
CreateHalftonePalette
AddFontResourceA
UpdateColors
GetEnhMetaFileA
EndDoc
DeleteEnhMetaFile
CreateCompatibleDC
CloseEnhMetaFile
GdiGetBatchLimit
EndPath
PathToRegion
CreateMetaFileW
GetTextColor
GetColorSpace
GetEnhMetaFileW
GetBkColor
CreateMetaFileA
StrokePath
UnrealizeObject
SaveDC
CreateSolidBrush
RealizePalette
GetLayout
GetGraphicsMode
SetMetaRgn
CloseMetaFile
AbortPath
GetObjectType
GetStretchBltMode
DeleteObject
GetTextCharset
GetPixelFormat
GetPolyFillMode
BeginPath
GetFontLanguageInfo
AbortDoc
FillPath
FlattenPath
GetTextAlign

advapi32

RegOpenKeyA
GetUserNameA

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2055bd5e5e13dc5dbf1dd934f372f818

Code Sign

ca:98:7a:78:a2:e2:5f:bc:1a:51:51:97:46:b5:b9:33Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

2f:7c:3a:f1:82:2b:eb:1e:03:0e:24:dc:e9:a8:d8:69:86:08:9e:88Signer

Signature Validations

Verification

18-05-2022 18:06 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

Sections

.text Size: 21KB - Virtual size: 21KB

.rdata Size: 57KB - Virtual size: 57KB

.data Size: 14KB - Virtual size: 13KB

.rsrc Size: 11KB - Virtual size: 10KB

ca:98:7a:78:a2:e2:5f:bc:1a:51:51:97:46:b5:b9:33
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

2f:7c:3a:f1:82:2b:eb:1e:03:0e:24:dc:e9:a8:d8:69:86:08:9e:88
Signer

18-05-2022 18:06
Valid: false

.text
Size: 21KB - Virtual size: 21KB

.rdata
Size: 57KB - Virtual size: 57KB

.data
Size: 14KB - Virtual size: 13KB

.rsrc
Size: 11KB - Virtual size: 10KB