036cf3360058bbcfb3a0e65f72736b8e210d9d08894cd9718b0698e89af4ead9

Sharing

Copy URL

Twitter E-mail

General

Target

036cf3360058bbcfb3a0e65f72736b8e210d9d08894cd9718b0698e89af4ead9
Size

145KB
MD5

57dfa52cdf92b853aaa66650baf8a986
SHA1

67b9090eb27efb29bded8ca3a551ac8e6725e2a1
SHA256

036cf3360058bbcfb3a0e65f72736b8e210d9d08894cd9718b0698e89af4ead9
SHA512

04c63e3b02c84f167f3f9d385147cdaa88fc4b82ef0fb188156086e7ba7851bd28b21e60915a76cdc197baa615a7ef34caf257ed37f81cde4aea12aee892390b
SSDEEP

3072:5ltrbkFEEqOWYnLdLfD/g5fTjqhv5hvkR:5vwFEEqPYnLtf74inS

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

036cf3360058bbcfb3a0e65f72736b8e210d9d08894cd9718b0698e89af4ead9
.exe windows x86

0c5f00c2910516409a7c2f829eaf24f0

Code Sign

5e:ef:b1:fd:00:be:3f:91:42:7a:10:ab:6e:35:b7:a5
Certificate

Issuer

CN=ADJGWCJK

Not Before

08-04-2019 10:29

Not After

31-12-2039 23:59

Subject

CN=ADJGWCJK

Extended Key Usages

ExtKeyUsageCodeSigning

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:14:2e:e2:bf:8a:93:36:d9:d3:63:49:46:ec:07:da:fa:99:5f:9c:fb:73:8a:69:a6:ac:7a:9b:bd:da:8b:ad
Signer

Actual PE Digest

19:14:2e:e2:bf:8a:93:36:d9:d3:63:49:46:ec:07:da:fa:99:5f:9c:fb:73:8a:69:a6:ac:7a:9b:bd:da:8b:ad

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=ADJGWCJK

08-04-2019 17:22
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessW
CreateThread
DeleteCriticalSection
DeleteFileA
DeleteFileW
EndUpdateResourceW
EnterCriticalSection
EnumResourceTypesA
EnumSystemCodePagesW
EraseTape
ExitProcess
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FatalExit
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindResourceExA
FlushFileBuffers
FlushInstructionCache
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleDisplayMode
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetDateFormatW
GetEnvironmentStrings
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesW
GetFileSize
GetFileTime
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNumberFormatW
GetOEMCP
GetPrivateProfileStringW
GetProcAddress
GetProcessHeap
GetShortPathNameW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
GetTimeFormatA
GetTimeFormatW
GetUserDefaultLangID
GetVersionExA
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFindAtomW
GlobalFree
GlobalLock
CreateProcessA
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedExchangeAdd
InterlockedIncrement
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsDebuggerPresent
IsValidCodePage
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
MapUserPhysicalPagesScatter
MapViewOfFile
MoveFileExW
MulDiv
MultiByteToWideChar
OpenProcess
OutputDebugStringW
Process32FirstW
QueryPerformanceCounter
QueueUserAPC
RaiseException
ReadDirectoryChangesW
ReadFile
ReadProcessMemory
ResetEvent
RtlUnwind
SearchPathA
SearchPathW
SetConsoleActiveScreenBuffer
SetConsoleDisplayMode
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEvent
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SleepEx
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
WritePrivateProfileStringW
WriteProcessMemory
lstrcmpA
lstrcmpW
lstrcpyn
lstrlenA
lstrlenW
VirtualAllocEx
CreateMutexW
CreateMailslotA
CreateFileW
CreateFileMappingW
CreateFileA
CreateEventW
CreateEventA
CreateDirectoryW
CompareFileTime
CloseHandle
CancelIo
GlobalSize
AddConsoleAliasW

user32

DefWindowProcW
DestroyWindow
ChangeDisplaySettingsExW
BeginPaint
DialogBoxParamW
DispatchMessageW
EndDialog
EndPaint
EnumDisplayDevicesW
EnumDisplaySettingsW
GetMessageW
LoadAcceleratorsW
IsMenu
GetFocus
GetParent
GetOpenClipboardWindow
GetMenuCheckMarkDimensions
IsWindowEnabled
CountClipboardFormats
IsCharAlphaW
CreatePopupMenu
CopyIcon
VkKeyScanW
DestroyMenu
GetQueueStatus
IsWindowVisible
IsWindowUnicode
IsWindow
GetCaretBlinkTime
LoadIconA
UpdateWindow
TranslateMessage
TranslateAcceleratorW
ShowWindow
RegisterClassExW
PostQuitMessage
MessageBoxW
LoadStringW
LoadIconW
CreateWindowExW
LoadCursorW

gdi32

EndPath
PathToRegion
GetTextCharacterExtra
GetPolyFillMode
GetDCBrushColor
CreateHalftonePalette
DeleteMetaFile
GetLayout
EndPage
FillPath
CreateMetaFileW
CreateSolidBrush

shell32

SHFileOperationA
ShellHookProc
ShellExecuteW
ShellExecuteA
ShellAboutW
SHIsFileAvailableOffline
CommandLineToArgvW
DragFinish
DragQueryFile
DragQueryFileA
ExtractAssociatedIconExW
ExtractAssociatedIconW
ExtractIconExA
SHAddToRecentDocs
SHBindToParent
SHCreateDirectoryExA
SHCreateDirectoryExW
Shell_NotifyIconA
SHFormatDrive
SHGetDataFromIDListW
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHGetDiskFreeSpaceExA
SHGetFileInfo
SHGetFileInfoW
SHGetMalloc
SHGetPathFromIDList
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHInvokePrinterCommandW

shlwapi

StrCmpNW
StrRChrA
StrStrA
StrStrIA
StrChrW
StrStrIW

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c5f00c2910516409a7c2f829eaf24f0

Code Sign

5e:ef:b1:fd:00:be:3f:91:42:7a:10:ab:6e:35:b7:a5Certificate

Extended Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

19:14:2e:e2:bf:8a:93:36:d9:d3:63:49:46:ec:07:da:fa:99:5f:9c:fb:73:8a:69:a6:ac:7a:9b:bd:da:8b:adSigner

Signature Validations

Verification

08-04-2019 17:22 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

shlwapi

Sections

.text Size: 72KB - Virtual size: 72KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 58KB - Virtual size: 57KB

5e:ef:b1:fd:00:be:3f:91:42:7a:10:ab:6e:35:b7:a5
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

19:14:2e:e2:bf:8a:93:36:d9:d3:63:49:46:ec:07:da:fa:99:5f:9c:fb:73:8a:69:a6:ac:7a:9b:bd:da:8b:ad
Signer

08-04-2019 17:22
Valid: false

.text
Size: 72KB - Virtual size: 72KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 58KB - Virtual size: 57KB