803b3c8668187a1570015c980639840de722f736ad60bc6de5afd3a1d011c00b

Sharing

Copy URL

Twitter E-mail

General

Target

803b3c8668187a1570015c980639840de722f736ad60bc6de5afd3a1d011c00b
Size

172KB
MD5

49c734a62dc12d8120ec812ddee36651
SHA1

b60ad1de3c6d477d3fa3d601efb9e751d20394e4
SHA256

803b3c8668187a1570015c980639840de722f736ad60bc6de5afd3a1d011c00b
SHA512

0e529828ab1e66e7bae8602b5536a19dff1c0397bda394188eafb16582f1886932ad51df8b4f748083c57c075890324c67cc1ac9678a6f6d340a641753872ccb
SSDEEP

3072:U26p04PgDvcLVonnjqP6R8LmgrKAjL5LlJXVWe6ak03jSI:f6pxxieP6Gmmj1J+ak03jp

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

803b3c8668187a1570015c980639840de722f736ad60bc6de5afd3a1d011c00b
.exe windows x86

169fa71d31a75a969ce3c17ec25e75e2

Code Sign

6c:a3:22:98:ba:38:15:a1:4c:2d:12:b6:b0:4f:0a:95
Certificate

Issuer

CN=KVUBWABK

Not Before

30-03-2019 12:14

Not After

31-12-2039 23:59

Subject

CN=KVUBWABK

Extended Key Usages

ExtKeyUsageCodeSigning

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

69:46:f1:52:16:14:fe:09:0a:29:c9:e8:8e:53:9a:a2:97:29:f1:31:28:b7:ad:b7:38:ba:9a:a8:f9:aa:32:d9
Signer

Actual PE Digest

69:46:f1:52:16:14:fe:09:0a:29:c9:e8:8e:53:9a:a2:97:29:f1:31:28:b7:ad:b7:38:ba:9a:a8:f9:aa:32:d9

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=KVUBWABK

30-03-2019 14:55
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeW
GetSystemDefaultLCID
GetSystemDefaultUILanguage
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathW
GetThreadLocale
GetTickCount
GetTimeFormatA
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultUILanguage
GetVersion
GetVersionExA
GetVersionExW
GetVolumeInformationA
GetVolumeInformationW
GetWindowsDirectoryA
GetWindowsDirectoryW
GlobalAddAtomA
GlobalAddAtomW
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFindAtomW
GlobalFlags
GlobalFree
GlobalGetAtomNameA
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalSize
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDebuggerPresent
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LocalReAlloc
LockFile
LockResource
MoveFileW
MulDiv
MultiByteToWideChar
GetStringTypeExW
OpenProcess
OpenThread
OutputDebugStringA
OutputDebugStringW
Process32FirstW
Process32NextW
ProcessIdToSessionId
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ReleaseMutex
RemoveDirectoryA
ResumeThread
RtlUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleTextAttribute
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleCount
SetLastError
SetStdHandle
SetThreadLocale
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnlockFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WTSGetActiveConsoleSessionId
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
WritePrivateProfileStringA
WritePrivateProfileStringW
lstrcmpA
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyA
lstrlenA
lstrlenW
VirtualAllocEx
GetStringTypeExA
GetStringTypeA
GetStdHandle
GetStartupInfoW
GetStartupInfoA
GetShortPathNameW
GetProfileIntA
GetProcessTimes
GetProcessHeap
GetProcAddress
GetPrivateProfileStringW
GetPrivateProfileStringA
GetPrivateProfileIntW
GetOEMCP
AddAtomW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetModuleFileNameA
GetLongPathNameW
GetLocaleInfoW
GetLocaleInfoA
GetLocalTime
GetLastError
GetFullPathNameW
GetFullPathNameA
GetFileType
GetFileTime
GetFileSizeEx
GetFileSize
GetFileAttributesW
GetFileAttributesExW
GetFileAttributesExA
GetFileAttributesA
GetExitCodeProcess
GetEnvironmentVariableW
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
GetDateFormatW
GetDateFormatA
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetCurrentDirectoryA
GetConsoleScreenBufferInfo
GetConsoleOutputCP
GetConsoleMode
GetConsoleCP
GetComputerNameW
GetComputerNameExW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetACP
FreeResource
FreeLibrary
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FormatMessageW
FormatMessageA
FlushFileBuffers
FindResourceW
FindResourceExW
FindResourceA
FindNextFileW
FindFirstFileW
FindFirstFileA
FindClose
FindAtomW
FileTimeToSystemTime
FileTimeToLocalFileTime
FatalAppExitA
ExpandEnvironmentStringsW
ExitThread
ExitProcess
EnumSystemLocalesA
EnumResourceLanguagesW
EnumResourceLanguagesA
EnterCriticalSection
DuplicateHandle
DeviceIoControl
DeleteFileW
DeleteFileA
DeleteCriticalSection
DeleteAtom
CreateToolhelp32Snapshot
CreateThread
CreateProcessW
CreateProcessA
CreateMutexW
CreateMutexA
CreateFileW
CreateFileA
CreateEventW
CreateEventA
CreateDirectoryA
ConvertDefaultLocale
CompareStringW
CompareStringA
CloseHandle
OpenMutexW

user32

ModifyMenuW
MoveWindow
OffsetRect
PeekMessageW
PostMessageW
PostQuitMessage
PtInRect
RegisterClassW
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropW
ReuseDDElParam
ScreenToClient
ScrollWindow
ScrollWindowEx
SendDlgItemMessageA
SendDlgItemMessageW
SendMessageW
SetActiveWindow
SetCapture
SetDlgItemInt
SetDlgItemTextW
SetFocus
SetForegroundWindow
SetMenu
SetMenuItemBitmaps
SetParent
SetPropW
SetRect
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowScrollBar
ShowWindow
SystemParametersInfoA
SystemParametersInfoW
TabbedTextOutW
TrackPopupMenu
TrackPopupMenuEx
TranslateMessage
UnhookWindowsHookEx
UnionRect
UnpackDDElParam
UnregisterClassW
UpdateWindow
ValidateRect
WinHelpW
WindowFromPoint
wsprintfW
MessageBoxW
MapWindowPoints
MapVirtualKeyW
LockWindowUpdate
LoadStringW
LoadMenuW
LoadIconW
LoadCursorW
LoadBitmapW
LoadAcceleratorsW
KillTimer
IsWindowVisible
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDlgButtonChecked
IsDialogMessageW
IsChild
IntersectRect
InsertMenuW
InsertMenuItemW
InflateRect
GrayStringW
GetWindowThreadProcessId
GetWindowTextW
GetWindowTextLengthW
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowDC
GetWindow
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetMessageW
GetMessageTime
GetMessagePos
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenuCheckMarkDimensions
GetMenuBarInfo
GetMenu
GetLastActivePopup
GetKeyState
GetKeyNameTextW
GetForegroundWindow
GetFocus
GetDlgItemTextW
GetDlgItemInt
GetDlgItem
GetDlgCtrlID
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetClientRect
GetClassNameW
GetClassLongW
GetClassInfoW
GetClassInfoExW
GetCapture
GetActiveWindow
FillRect
EqualRect
EndPaint
EndDialog
EndDeferWindowPos
EnableWindow
EnableMenuItem
DrawTextW
DrawTextExW
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DeferWindowPos
DefWindowProcW
CreatePopupMenu
CopyRect
ClientToScreen
CheckRadioButton
CheckMenuItem
CheckDlgButton
CharUpperW
CallWindowProcW
CallNextHookEx
BringWindowToTop
BeginPaint
BeginDeferWindowPos
AppendMenuW
AdjustWindowRectEx
CreateWindowExW

gdi32

Arc
ArcTo
BitBlt
Chord
CombineRgn
CopyEnhMetaFileW
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
CreateDIBSection
CreateDIBitmap
CreateFontIndirectW
CreateHalftonePalette
CreateICW
CreatePalette
CreatePenIndirect
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
Ellipse
EndDoc
EndPage
EnumFontFamiliesExW
EnumFontsW
ExcludeClipRect
ExtCreateRegion
ExtFloodFill
ExtTextOutW
FrameRgn
GdiFlush
GetBitmapBits
GetBrushOrgEx
GetClipBox
GetCurrentObject
GetCurrentPositionEx
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetEnhMetaFileBits
GetEnhMetaFileDescriptionW
GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
GetNearestPaletteIndex
GetObjectW
GetPaletteEntries
GetPixel
GetRgnBox
GetStockObject
GetSystemPaletteEntries
GetTextExtentPoint32W
GetTextExtentPointW
GetTextMetricsW
GetWinMetaFileBits
GetWindowOrgEx
IntersectClipRect
LineTo
MaskBlt
MoveToEx
OffsetRgn
PatBlt
Pie
PlayEnhMetaFile
PolyBezier
PolyBezierTo
Polygon
Polyline
RealizePalette
RectVisible
Rectangle
ResizePalette
RestoreDC
RoundRect
SaveDC
SelectObject
SelectPalette
SetAbortProc
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
SetDIBits
SetDIBitsToDevice
SetEnhMetaFileBits
SetMapMode
SetPaletteEntries
SetPixel
SetPixelV
SetROP2
SetStretchBltMode
SetTextColor
SetViewportOrgEx
SetWinMetaFileBits
SetWindowOrgEx
StartDocW
StartPage
StretchBlt
StretchDIBits
UnrealizeObject
AngleArc

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

169fa71d31a75a969ce3c17ec25e75e2

Code Sign

6c:a3:22:98:ba:38:15:a1:4c:2d:12:b6:b0:4f:0a:95Certificate

Extended Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

69:46:f1:52:16:14:fe:09:0a:29:c9:e8:8e:53:9a:a2:97:29:f1:31:28:b7:ad:b7:38:ba:9a:a8:f9:aa:32:d9Signer

Signature Validations

Verification

30-03-2019 14:55 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 33KB - Virtual size: 32KB

.data Size: 23KB - Virtual size: 23KB

.rsrc Size: 40KB - Virtual size: 39KB

6c:a3:22:98:ba:38:15:a1:4c:2d:12:b6:b0:4f:0a:95
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

69:46:f1:52:16:14:fe:09:0a:29:c9:e8:8e:53:9a:a2:97:29:f1:31:28:b7:ad:b7:38:ba:9a:a8:f9:aa:32:d9
Signer

30-03-2019 14:55
Valid: false

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 23KB - Virtual size: 23KB

.rsrc
Size: 40KB - Virtual size: 39KB