ab9de10e6324b942aa8b9994db8909bdbce32283d06be8eeed690ce32f3422b8

Sharing

Copy URL

Twitter E-mail

General

Target

ab9de10e6324b942aa8b9994db8909bdbce32283d06be8eeed690ce32f3422b8
Size

144KB
MD5

5d6019733fd57be83041a5039849fc44
SHA1

04e23b1f4ee6379e6706f42bc65d7ce5cbd6f604
SHA256

ab9de10e6324b942aa8b9994db8909bdbce32283d06be8eeed690ce32f3422b8
SHA512

28e9189b848f08f189867d29971f04c464eb0ecd19b0220628e0f95ff21e56f6d4a6e24dfa17a9c8b33c6fe181d2da6f9afbcb7aab3b148a5467e457dafafb42
SSDEEP

1536:+Bftrr3BVkFVaan1qOEXhXVCcbnBoLdLkuDNd3QkLOSPfNW9UZ5l9b/ugCiGUX:+ltrbkFEEqOWYnLdLfD/gCfNnZ5lskV

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

ab9de10e6324b942aa8b9994db8909bdbce32283d06be8eeed690ce32f3422b8
.exe windows x86

51b00e4d5d79945f3d1adb628a80975f

Code Sign

5e:ef:b1:fd:00:be:3f:91:42:7a:10:ab:6e:35:b7:a5
Certificate

Issuer

CN=ADJGWCJK

Not Before

08-04-2019 10:29

Not After

31-12-2039 23:59

Subject

CN=ADJGWCJK

Extended Key Usages

ExtKeyUsageCodeSigning

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d5:36:67:86:45:19:13:82:79:97:c0:19:d4:d0:e0:e1:15:4f:5f:a5:b5:c8:64:d1:18:11:5d:76:d8:55:b2:31
Signer

Actual PE Digest

d5:36:67:86:45:19:13:82:79:97:c0:19:d4:d0:e0:e1:15:4f:5f:a5:b5:c8:64:d1:18:11:5d:76:d8:55:b2:31

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=ADJGWCJK

08-04-2019 13:22
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EndUpdateResourceW
EnterCriticalSection
EnumResourceTypesA
EnumSystemCodePagesW
EraseTape
ExitProcess
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FatalExit
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindResourceExA
FlushFileBuffers
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleDisplayMode
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDateFormatA
GetDateFormatW
GetEnvironmentStrings
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesW
GetFileSize
GetFileTime
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNumberFormatW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemTimeAsFileTime
GetTempPathW
GetTickCount
GetTimeFormatA
GetTimeFormatW
GetUserDefaultLangID
GetVersionExA
DeleteFileW
GlobalAlloc
GlobalFree
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsBadCodePtr
IsBadWritePtr
IsDebuggerPresent
IsValidCodePage
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MapUserPhysicalPagesScatter
MulDiv
MultiByteToWideChar
Process32FirstW
QueryPerformanceCounter
RaiseException
ReadFile
RtlUnwind
SearchPathA
SearchPathW
SetConsoleActiveScreenBuffer
SetConsoleDisplayMode
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEvent
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
SleepEx
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
lstrcmpA
lstrcpyn
lstrlenA
lstrlenW
VirtualAllocEx
DeleteFileA
DeleteCriticalSection
CreateProcessW
CreateProcessA
CreateMailslotA
CreateFileW
CreateFileA
CreateEventW
CreateEventA
CompareFileTime
CloseHandle
GetWindowsDirectoryW
AddConsoleAliasW

user32

DefWindowProcW
DestroyWindow
ChangeDisplaySettingsExW
BeginPaint
DialogBoxParamW
DispatchMessageW
EndDialog
EndPaint
EnumDisplayDevicesW
EnumDisplaySettingsW
GetMessageW
LoadAcceleratorsW
IsMenu
GetFocus
GetParent
GetOpenClipboardWindow
GetMenuCheckMarkDimensions
IsWindowEnabled
CountClipboardFormats
IsCharAlphaW
CreatePopupMenu
CopyIcon
VkKeyScanW
DestroyMenu
GetQueueStatus
IsWindowVisible
IsWindowUnicode
IsWindow
GetCaretBlinkTime
LoadIconA
UpdateWindow
TranslateMessage
TranslateAcceleratorW
ShowWindow
RegisterClassExW
PostQuitMessage
MessageBoxW
LoadStringW
LoadIconW
CreateWindowExW
LoadCursorW

gdi32

EndPath
PathToRegion
GetTextCharacterExtra
GetPolyFillMode
GetDCBrushColor
CreateHalftonePalette
DeleteMetaFile
GetLayout
EndPage
FillPath
CreateMetaFileW
CreateSolidBrush

shell32

SHFileOperationA
ShellHookProc
ShellExecuteW
ShellExecuteA
ShellAboutW
SHIsFileAvailableOffline
CommandLineToArgvW
DragFinish
DragQueryFile
DragQueryFileA
ExtractAssociatedIconExW
ExtractAssociatedIconW
ExtractIconExA
SHAddToRecentDocs
SHBindToParent
SHCreateDirectoryExA
SHCreateDirectoryExW
Shell_NotifyIconA
SHFormatDrive
SHGetDataFromIDListW
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHGetDiskFreeSpaceExA
SHGetFileInfo
SHGetFileInfoW
SHGetMalloc
SHGetPathFromIDList
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHInvokePrinterCommandW

shlwapi

StrCmpNW
StrRChrA
StrStrA
StrStrIA
StrChrW
StrStrIW

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51b00e4d5d79945f3d1adb628a80975f

Code Sign

5e:ef:b1:fd:00:be:3f:91:42:7a:10:ab:6e:35:b7:a5Certificate

Extended Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

d5:36:67:86:45:19:13:82:79:97:c0:19:d4:d0:e0:e1:15:4f:5f:a5:b5:c8:64:d1:18:11:5d:76:d8:55:b2:31Signer

Signature Validations

Verification

08-04-2019 13:22 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

shlwapi

Sections

.text Size: 72KB - Virtual size: 71KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 58KB - Virtual size: 57KB

5e:ef:b1:fd:00:be:3f:91:42:7a:10:ab:6e:35:b7:a5
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

d5:36:67:86:45:19:13:82:79:97:c0:19:d4:d0:e0:e1:15:4f:5f:a5:b5:c8:64:d1:18:11:5d:76:d8:55:b2:31
Signer

08-04-2019 13:22
Valid: false

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 58KB - Virtual size: 57KB