cd29e9f12faffd3f7f487051af426d71b339f77c855c30b83b0246848e0e8ff4

Sharing

Copy URL

Twitter E-mail

General

Target

cd29e9f12faffd3f7f487051af426d71b339f77c855c30b83b0246848e0e8ff4
Size

116KB
MD5

4bd4c647e92d54e89ed3a4ddbbbf1619
SHA1

62beaf4e76704b117a87819bf074a170b5cdc7c9
SHA256

cd29e9f12faffd3f7f487051af426d71b339f77c855c30b83b0246848e0e8ff4
SHA512

ca742f33b106ed7839f4229d4ca004aa20c12587d6de8f75139f623fc478aaa24ac3983a0bfd0fc3cdcb8f2cbb3ab0fd1868b1c59eee89c2be38031b262e1532
SSDEEP

3072:P8ENSRg5KrR52iOG7jWXlnYNav5KLdIIPst5tKRc:P8KSRg5KPHOGErRKL6GgP

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Files

cd29e9f12faffd3f7f487051af426d71b339f77c855c30b83b0246848e0e8ff4
.exe windows x86

1ec3bfe8eec34e810d7e68de32d124a7

Code Sign

09:2e:c7:00:ea:2d:c0:97:40:a6:0e:58:f1:06:dd:06
Certificate

Issuer

CN=MOEITMWPTGYIMDGFLU

Not Before

15-04-2019 20:49

Not After

31-12-2039 23:59

Subject

CN=MOEITMWPTGYIMDGFLU

Extended Key Usages

ExtKeyUsageCodeSigning

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

dc:28:65:90:94:3d:02:f2:93:76:41:0a:c5:98:8b:46:ee:30:b9:93:a8:76:ce:53:d1:f8:16:22:03:94:71:04
Signer

Actual PE Digest

dc:28:65:90:94:3d:02:f2:93:76:41:0a:c5:98:8b:46:ee:30:b9:93:a8:76:ce:53:d1:f8:16:22:03:94:71:04

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=MOEITMWPTGYIMDGFLU

16-04-2019 00:37
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
GetFileType
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemTimeAsFileTime
GetTickCount
GetVolumeInformationA
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
IsDebuggerPresent
IsValidCodePage
LCMapStringA
LCMapStringW
FindClose
GetExitCodeProcess
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
RemoveDirectoryA
RtlUnwind
SetEnvironmentVariableA
SetFilePointer
SetHandleCount
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
WaitForSingleObject
WideCharToMultiByte
WriteConsoleA
WriteConsoleW
WriteFile
LoadLibraryW
ExpandEnvironmentStringsA
ExitProcess
EnterCriticalSection
GetEnvironmentStringsW
GetEnvironmentStrings
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetConsoleOutputCP
GetConsoleMode
GetConsoleCP
GetCommandLineA
GetCPInfo
GetACP
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FlushFileBuffers
FindNextFileA
LoadLibraryA
FindFirstFileA
DeleteFileA
DeleteCriticalSection
CreateThread
CreateProcessA
CreateMutexA
CreateFileA
CompareStringW
CompareStringA
LeaveCriticalSection
CloseHandle

user32

LoadIconW
ValidateRgn
UpdateWindow
UnloadKeyboardLayout
TranslateMessage
TranslateAcceleratorA
TileChildWindows
ShowWindow
SetWindowPos
SetRectEmpty
SetMenuItemInfoA
SetForegroundWindow
SetFocus
SetDlgItemTextA
SetCaretPos
SendMessageTimeoutA
SendMessageCallbackA
RegisterClassW
RegisterClassExA
PostQuitMessage
MapDialogRect
LoadMenuIndirectW
LoadIconA
LoadCursorA
GetWindowThreadProcessId
GetWindowLongW
GetUserObjectSecurity
GetMessageA
GetMenuState
GetForegroundWindow
GetDlgItemTextA
GetClipboardData
GetClipCursor
GetClassInfoExW
EnumPropsExA
EnumDisplaySettingsExA
EndDialog
DrawTextExW
DrawEdge
DispatchMessageA
DialogBoxParamA
DefWindowProcA
DdeQueryStringA
DdeNameService
DdeCmpStringHandles
CreateWindowExW
ActivateKeyboardLayout
AttachThreadInput
CallNextHookEx
CharToOemA
CreateMDIWindowA
CreateWindowExA
RegisterDeviceNotificationW

gdi32

AnyLinkedFonts
CLIPOBJ_bEnum
CreateCompatibleDC
CreateSolidBrush
Escape
FillRgn
GdiInitSpool
GdiIsMetaFileDC
GetEnhMetaFileA
GetObjectA
GetTextCharacterExtra
OffsetViewportOrgEx
SaveDC
SetMagicColors
SetWindowOrgEx
BRUSHOBJ_hGetColorTransform

advapi32

RegDeleteKeyW
RegSetValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyExW
RegDeleteValueW
RegDeleteValueA
RegCloseKey
RegCreateKeyExW
RegDeleteKeyA

shell32

SHGetSpecialFolderPathW
SHInvokePrinterCommandW
SHLoadInProc
SHLoadNonloadedIconOverlayIdentifiers
SHPathPrepareForWriteA
SHQueryRecycleBinA
SHQueryRecycleBinW
ShellAboutW
ShellExecuteA
ShellExecuteExA
ShellExecuteExW
ShellExecuteW
Shell_NotifyIcon
Shell_NotifyIconA
SHGetSettings
SHGetInstanceExplorer
SHGetFolderLocation
SHGetFileInfo
SHGetDiskFreeSpaceA
SHGetDataFromIDListA
SHFreeNameMappings
SHFileOperationW
SHFileOperationA
SHEmptyRecycleBinW
SHCreateProcessAsUserW
SHCreateDirectoryExW
SHBrowseForFolder
SHAppBarMessage
FindExecutableW
FindExecutableA
ExtractAssociatedIconW
ExtractAssociatedIconExA
DragQueryFileW
DragQueryFileA
DoEnvironmentSubstA
CheckEscapesW
SHGetSpecialFolderPathA

ole32

CoRegisterMessageFilter
CoReleaseServerProcess
CoResumeClassObjects
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CreateOleAdviseHolder
CreateStreamOnHGlobal
OleInitialize
OleLockRunning
OleRegEnumVerbs
OleRegGetMiscStatus
OleRegGetUserType
OleSaveToStream
OleUninitialize
ReadClassStm
StringFromCLSID
StringFromGUID2
WriteClassStm
CoInitializeEx
CoGetClassObject
CoCreateInstance
CoAddRefServerProcess
CLSIDFromString
CLSIDFromProgID
CoRegisterClassObject

shlwapi

StrChrIW
StrCmpNA
StrCmpNIA
StrRStrIA
StrRStrIW
StrChrIA

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ec3bfe8eec34e810d7e68de32d124a7

Code Sign

09:2e:c7:00:ea:2d:c0:97:40:a6:0e:58:f1:06:dd:06Certificate

Extended Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

dc:28:65:90:94:3d:02:f2:93:76:41:0a:c5:98:8b:46:ee:30:b9:93:a8:76:ce:53:d1:f8:16:22:03:94:71:04Signer

Signature Validations

Verification

16-04-2019 00:37 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

Sections

.text Size: 72KB - Virtual size: 72KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 572B

.rsrc Size: 31KB - Virtual size: 30KB

09:2e:c7:00:ea:2d:c0:97:40:a6:0e:58:f1:06:dd:06
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

dc:28:65:90:94:3d:02:f2:93:76:41:0a:c5:98:8b:46:ee:30:b9:93:a8:76:ce:53:d1:f8:16:22:03:94:71:04
Signer

16-04-2019 00:37
Valid: false

.text
Size: 72KB - Virtual size: 72KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 572B

.rsrc
Size: 31KB - Virtual size: 30KB