9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f

Sharing

Copy URL

Twitter E-mail

General

Target

9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f
Size

108KB
MD5

c8bd995346f61308e200199c7e041b3c
SHA1

46a39c9425bff794916493459f8bffd9e6915af4
SHA256

9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f
SHA512

9f820d527a5b05d8003d3350ef2428f6d956ec63b42f3d9097df9989f1d1a219841ebe4959eb75c7cc3ab9e36dbebab0e32d9cfc49c114bfc2d7a30373124755
SSDEEP

3072:FCrRG9LgWHyMp6awrpEoNLna7TpP7N5LtgxH:FCrskJaYvn+PdgB

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

9635c10648c4dccb9c9de1260429441a6936fcbd0f7eb16c4c149adc5888a32f
.exe windows x86

9275efde03c2c0e26841ab9eeca178fa

Code Sign

6d:41:ef:f2:9f:38:ad:46:b3:1e:18:49:99:7e:6e:8d
Certificate

Issuer

CN=TXEEIIHYPDLIUTTDUL

Not Before

16-04-2019 17:38

Not After

31-12-2039 23:59

Subject

CN=TXEEIIHYPDLIUTTDUL

Extended Key Usages

ExtKeyUsageCodeSigning

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

e1:58:27:dd:72:ae:85:f9:73:75:4f:21:1c:42:c1:78:c1:1f:6f:d8:10:53:d4:8f:9a:16:bf:60:c9:ee:79:63
Signer

Actual PE Digest

e1:58:27:dd:72:ae:85:f9:73:75:4f:21:1c:42:c1:78:c1:1f:6f:d8:10:53:d4:8f:9a:16:bf:60:c9:ee:79:63

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=TXEEIIHYPDLIUTTDUL

17-04-2019 13:33
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileA
FindFirstFileExA
FindNextFileA
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameA
GetComputerNameExW
GetComputerNameW
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesExW
GetFileSize
GetFileTime
GetFileType
GetLastError
GetLocalTime
GetLocaleInfoA
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetProcessTimes
GetQueuedCompletionStatus
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetThreadTimes
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedDecrement
EnumSystemLocalesA
IsBadStringPtrW
FindClose
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
MultiByteToWideChar
OpenEventA
OpenEventW
OpenProcess
OutputDebugStringW
PostQueuedCompletionStatus
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ReleaseMutex
ResetEvent
RtlUnwind
SetConsoleActiveScreenBuffer
SetConsoleCtrlHandler
SetConsoleCursorPosition
SetConsoleMode
SetConsoleScreenBufferSize
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFilePointer
SetFilePointerEx
SetHandleCount
SetHandleInformation
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeA
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcatA
lstrcatW
lstrcmpW
lstrcmpiW
lstrcpyA
lstrcpyW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW
EnterCriticalSection
DeleteFileA
DeleteCriticalSection
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
FileTimeToSystemTime
ExpandEnvironmentStringsW
IsDebuggerPresent
ExitProcess
DecodePointer
CreateThread
CreateProcessA
CreatePipe
CreateNamedPipeA
CreateMutexA
CreateIoCompletionPort
CreateFileW
CreateFileMappingA
CreateFileA
CreateEventW
CreateEventA
CreateDirectoryA
CreateConsoleScreenBuffer
ConnectNamedPipe
CompareStringW
CompareStringA
CloseHandle
InterlockedIncrement
AddAtomA

user32

LoadIconW
GetDesktopWindow

gdi32

GetStockObject
GetObjectA
CreateSolidBrush
CreateFontIndirectA
GetTextExtentPoint32A

advapi32

RegQueryValueExA
CopySid
EqualSid
GetLengthSid
SystemFunction036
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
RegSetValueExA
AllocateAndInitializeSid
RegOpenKeyA
RegCreateKeyA
RegCloseKey
InitializeSecurityDescriptor
GetUserNameA

shell32

SHQueryRecycleBinA
SHIsFileAvailableOffline
SHInvokePrinterCommandA
SHGetSpecialFolderPathA
SHGetMalloc
SHGetIconOverlayIndexW
SHGetFileInfoA
SHGetDiskFreeSpaceExA
SHGetDiskFreeSpaceA
SHGetDesktopFolder
SHFileOperationW
SHCreateDirectoryExW
SHCreateDirectoryExA
SHChangeNotify
SHBrowseForFolderA
FindExecutableW
ExtractIconW
ExtractIconExW
ExtractIconExA
ExtractIconEx
DragQueryPoint
DragQueryFileA
DragAcceptFiles
CommandLineToArgvW
Shell_NotifyIconA
Shell_NotifyIcon
ShellExecuteExA
ShellAboutA
SHQueryRecycleBinW

ole32

CoTaskMemAlloc

shlwapi

StrRChrIW
StrRStrIA
StrStrA
StrStrIA
StrStrW
StrCmpNIW
StrChrA
StrRChrIA

comctl32

ImageList_Destroy
ImageList_Create
ImageList_DrawIndirect
ImageList_GetImageCount
ImageList_LoadImageW
InitCommonControlsEx
ImageList_AddMasked

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9275efde03c2c0e26841ab9eeca178fa

Code Sign

6d:41:ef:f2:9f:38:ad:46:b3:1e:18:49:99:7e:6e:8dCertificate

Extended Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

e1:58:27:dd:72:ae:85:f9:73:75:4f:21:1c:42:c1:78:c1:1f:6f:d8:10:53:d4:8f:9a:16:bf:60:c9:ee:79:63Signer

Signature Validations

Verification

17-04-2019 13:33 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

Sections

.text Size: 93KB - Virtual size: 92KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 572B

.rsrc Size: 2KB - Virtual size: 1KB

6d:41:ef:f2:9f:38:ad:46:b3:1e:18:49:99:7e:6e:8d
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

e1:58:27:dd:72:ae:85:f9:73:75:4f:21:1c:42:c1:78:c1:1f:6f:d8:10:53:d4:8f:9a:16:bf:60:c9:ee:79:63
Signer

17-04-2019 13:33
Valid: false

.text
Size: 93KB - Virtual size: 92KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 572B

.rsrc
Size: 2KB - Virtual size: 1KB