d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2

Sharing

Copy URL

Twitter E-mail

General

Target

d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2
Size

100KB
MD5

8dc2977abe0b363aca606378bf7fd385
SHA1

82fd6c30ebb2b3b5bb5911a3b57fd29142ce6fa8
SHA256

d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2
SHA512

59f33d6707902aaa8704420a213541cfb758fe2cdfa49fce82d0c29f941d855d77799ef6cde5e5db6d307b8c620f4ba8eb2466dbb87d798c37757212e5786325
SSDEEP

1536:S9XM2K4Y3kK5MNq5cktsVPkRcT5nEYJyuXtg/7rSLh50Uj7z3nYxV:S98xkK5h5xwPDTZrKrqh50Uj7z3nYxV

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

d7a745533209956b23fafe533d54e93193c7cda43457924693dbe60ec77ef8f2
.exe windows x86

a153425123b94dec4bc9aa7350df751a

Code Sign

66:3f:85:0a:53:d2:a9:bb:47:39:c6:d0:31:89:30:72
Certificate

Issuer

CN=OHPHNFHI

Not Before

10-04-2019 11:35

Not After

31-12-2039 23:59

Subject

CN=OHPHNFHI

Extended Key Usages

ExtKeyUsageCodeSigning

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

80:1d:07:f0:7d:ff:33:2f:5c:73:0b:45:5b:4b:8c:5d:66:c4:0b:d1:58:9c:3c:14:75:9c:1b:70:99:fd:11:3f
Signer

Actual PE Digest

80:1d:07:f0:7d:ff:33:2f:5c:73:0b:45:5b:4b:8c:5d:66:c4:0b:d1:58:9c:3c:14:75:9c:1b:70:99:fd:11:3f

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=OHPHNFHI

10-04-2019 13:31
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedDecrement
InterlockedExchange
InterlockedIncrement
LeaveCriticalSection
LoadLibraryExW
LocalAlloc
MultiByteToWideChar
OutputDebugStringW
RaiseException
ResetEvent
ResumeThread
RtlUnwind
SetEvent
SignalObjectAndWait
Sleep
InterlockedCompareExchange
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcpynW
lstrlenW
GetModuleHandleA
VirtualAllocEx
LoadLibraryA
LoadLibraryW
InitializeCriticalSection
GetVersionExW
GetVersion
GetThreadLocale
GetSystemInfo
GetStdHandle
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetExitCodeThread
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetCommandLineW
GetCPInfo
GetACP
FreeLibrary
FormatMessageW
FindFirstFileW
FindClose
ExitThread
ExitProcess
EnumCalendarInfoA
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateEventW
CompareStringW
TlsGetValue
CloseHandle

user32

PeekMessageW
PtInRect
RemovePropW
SendMessageTimeoutW
SetClassLongW
SetClassWord
SetDlgItemTextA
SetMenuItemInfoW
SetSystemCursor
TabbedTextOutA
TileChildWindows
TranslateAcceleratorA
ValidateRect
ValidateRgn
GetCaretBlinkTime
IsWindow
IsWindowUnicode
IsWindowVisible
GetQueueStatus
DestroyMenu
VkKeyScanW
CopyIcon
CreatePopupMenu
IsCharAlphaW
CountClipboardFormats
IsWindowEnabled
GetMenuCheckMarkDimensions
GetOpenClipboardWindow
GetParent
GetFocus
LoadIconW
MsgWaitForMultipleObjects
MessageBoxW
MessageBoxA
LoadStringW
LoadMenuW
IsCharUpperW
InternalGetWindowText
GetSystemMetrics
GetNextDlgTabItem
GetKeyboardType
GetKeyboardLayoutNameW
GetCursorPos
GetClassLongA
EnumPropsW
EnumPropsExA
EnumDesktopsW
EnumDesktopsA
EnableMenuItem
EmptyClipboard
DrawTextExW
DrawStateW
DrawIconEx
DefWindowProcW
DefFrameProcA
DefDlgProcA
DdeQueryStringA
DdeFreeStringHandle
DdeCmpStringHandles
CreateWindowStationA
CreateDialogIndirectParamA
CharUpperBuffW
CharToOemW
CharToOemBuffA
CharNextW
CharLowerBuffA
CharLowerA
ChangeMenuW
EndMenu

gdi32

FillRgn
GdiAlphaBlend
GdiEntry8
GdiGetPageCount
GetPaletteEntries
GetTextMetricsW
GetWinMetaFileBits
PolylineTo
STROBJ_bEnumPositionsOnly
SetBoundsRect
CreateFontIndirectExW
StartDocW
EngQueryLocalTime
EndPath
CreateSolidBrush
PathToRegion
GetTextCharacterExtra
GetPolyFillMode
GetDCBrushColor
CreateHalftonePalette
DeleteMetaFile
GetLayout
EndPage
FillPath
CreateMetaFileW
EngMultiByteToWideChar
EngFindResource
StartFormPage
CreateEllipticRgn
CreateEnhMetaFileA
EngBitBlt

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

DragFinish

ole32

CoTaskMemFree

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a153425123b94dec4bc9aa7350df751a

Code Sign

66:3f:85:0a:53:d2:a9:bb:47:39:c6:d0:31:89:30:72Certificate

Extended Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

80:1d:07:f0:7d:ff:33:2f:5c:73:0b:45:5b:4b:8c:5d:66:c4:0b:d1:58:9c:3c:14:75:9c:1b:70:99:fd:11:3fSigner

Signature Validations

Verification

10-04-2019 13:31 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 69KB - Virtual size: 69KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 600B

.rsrc Size: 20KB - Virtual size: 20KB

66:3f:85:0a:53:d2:a9:bb:47:39:c6:d0:31:89:30:72
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

80:1d:07:f0:7d:ff:33:2f:5c:73:0b:45:5b:4b:8c:5d:66:c4:0b:d1:58:9c:3c:14:75:9c:1b:70:99:fd:11:3f
Signer

10-04-2019 13:31
Valid: false

.text
Size: 69KB - Virtual size: 69KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 600B

.rsrc
Size: 20KB - Virtual size: 20KB