f0162c86fc27deexe_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

f0162c86fc27deexe_JC.exe
Size

1.9MB
MD5

f0162c86fc27de23937e5e0da149b368
SHA1

c7730b431e3cfda3613014aca06f2d60383e908e
SHA256

11d126900cc822b6895e398f8bce7940830613a30dfd050133d5692a795af4ea
SHA512

edfea43a8e426aac2c25f7b09a6a50077e31230eaebce11d16892150a9050625850d15380095950a962ac4af3a0fe5a8fd867ffe2eeead2a0d4ff6d97723a0d8
SSDEEP

24576:OYNEefWVswVoaPhG/6UUkZV3Q3D2xl08Ar5adCN/j2GLl3iFSE33b9:JTWVs/N/9ZV3Q3qU8ArvN/j2U4FH

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
sample	cryptone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0162c86fc27deexe_JC.exe

Files

f0162c86fc27deexe_JC.exe
.exe windows x86

81c486f9ba99e1e0c5f4ede3805c4825

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

GetFileSizeEx
GetFileTime
GetStartupInfoW
RtlUnwind
HeapFree
HeapAlloc
RaiseException
HeapReAlloc
ExitProcess
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetFileAttributesW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CreateFileA
SetEnvironmentVariableA
FileTimeToLocalFileTime
SetErrorMode
WritePrivateProfileStringW
FileTimeToSystemTime
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
GlobalFlags
FindResourceExW
GetFullPathNameW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
SetFilePointer
ReadFile
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetCurrentProcessId
GetModuleHandleA
MulDiv
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryA
GetVersionExA
FreeResource
SetLastError
VirtualProtect
lstrlenA
GetSystemPowerStatus
GlobalUnlock
FindNextFileW
RemoveDirectoryW
FormatMessageW
LocalAlloc
LocalSize
LocalFree
GetTempPathW
GetLocalTime
WideCharToMultiByte
GlobalLock
GlobalAlloc
GlobalFree
DeviceIoControl
Beep
GetCurrentProcess
CompareStringW
lstrcmpW
GetModuleHandleW
GetVersionExW
GetDriveTypeW
lstrcpynW
GetDiskFreeSpaceExW
FindFirstFileW
FindClose
lstrcmpiW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CreateMutexW
InterlockedDecrement
LoadLibraryW
GetProcAddress
FreeLibrary
GetTickCount
CreateThread
Sleep
TerminateThread
CreateFileW
GetFileSize
CloseHandle
WriteFile
FlushFileBuffers
DeleteFileW
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
CopyFileW
GetLastError
GetVolumeInformationW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemTimeAsFileTime

user32

GetSysColorBrush
CharUpperW
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
PostQuitMessage
GetWindowThreadProcessId
DestroyMenu
EndPaint
BeginPaint
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
MoveWindow
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
CheckMenuItem
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
GetLastActivePopup
DispatchMessageW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
IsWindowVisible
UpdateWindow
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
ScreenToClient
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
PtInRect
GetMenu
SetWindowLongW
SystemParametersInfoA
GetWindowPlacement
GetWindow
GetDesktopWindow
CreateDialogIndirectParamW
DestroyWindow
GetNextDlgTabItem
EndDialog
ReleaseDC
GetDC
CopyRect
IsWindow
SetPropW
GetCapture
GetActiveWindow
MapDialogRect
UnregisterClassW
GetForegroundWindow
SetWindowPos
ShowWindow
GetPropW
RemovePropW
GetAsyncKeyState
GetFocus
SetFocus
GetWindowLongW
GetDlgItem
IsWindowEnabled
ExitWindowsEx
VkKeyScanW
MessageBeep
GetKeyboardLayout
LoadKeyboardLayoutW
ActivateKeyboardLayout
GetSystemMetrics
IsIconic
GetKeyState
RegisterWindowMessageW
MessageBoxW
SetForegroundWindow
SetActiveWindow
GetWindowRect
LoadCursorW
SetCursor
KillTimer
SetTimer
LoadIconW
PostMessageW
EnableWindow
GetParent
GetClientRect
GetSystemMenu
SendMessageW
EnableMenuItem
PeekMessageW

gdi32

EnumFontFamiliesExW
TextOutW
RectVisible
PtVisible
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
CreateFontIndirectW
DeleteObject
SetMapMode
RestoreDC
SaveDC
GetDeviceCaps
CreateBitmap
GetObjectW
SetBkColor
SetTextColor
GetClipBox
ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegQueryValueW
RegOpenKeyW
RegEnumKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
OpenSCManagerW
ControlService
StartServiceW
OpenServiceW
DeleteService
CreateServiceW
CloseServiceHandle
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW

shell32

ord165

shlwapi

StrCmpIW
PathFileExistsW
StrCpyNW
PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW

ole32

CoInitialize
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoDisconnectObject

oleaut32

VariantCopy
LoadTypeLi
SysAllocString
SysFreeString
VariantInit
VariantClear
SafeArrayGetElement
SafeArrayCreateVector
VariantChangeType
SysAllocStringLen
SysStringLen

Sections

.text
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

81c486f9ba99e1e0c5f4ede3805c4825

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

Sections

.text Size: 232KB - Virtual size: 232KB

.rdata Size: 98KB - Virtual size: 98KB

.data Size: 9KB - Virtual size: 28KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.text
Size: 232KB - Virtual size: 232KB

.rdata
Size: 98KB - Virtual size: 98KB

.data
Size: 9KB - Virtual size: 28KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB