231009-z28plaad66

Sharing

Copy URL

Twitter E-mail

General

Target

231009-z28plaad66
Size

1.2MB
MD5

136b9c85525ba66276b8c9f6b7014b0b
SHA1

0cf5ba13d14c28c60586c7f4b9679925fa4d4172
SHA256

a23ef053cccf6a35fda9adc5f1702ba99a7be695107d3ba5d1ea8c9c258299e4
SHA512

0c02b116029a7d4f4c44988dc6220ed4050c94cab6e57f4aeb29d8edd0b8b59e74c89d6bd62e6e828826f44ebfb478280051ca289ea712c52d5fd113541e2590
SSDEEP

6144:JanAo3boaSrTBRc6nWF84LvSkgNSjEtIovH6DgJG3uhRtSUgnSt9BYbC38g/T4J:JaAKoRrTBHWC4LINSjA/EMGU/SHomaI

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

Processes:

resource	yara_rule
sample	cryptone

Files

231009-z28plaad66
.exe windows:4 windows x86 arch:x86

68d91b46eb0976c4f7c6b9ba2c81af54

Code Sign

1d:7b:98:cc:48:0b:c3:73:b3:84:a0:fd:1f:c0:d0:6f
Certificate

Issuer

CN=PVENHMJAVNRFPSGGST

Not Before

28-05-2020 20:11

Not After

31-12-2039 23:59

Subject

CN=PVENHMJAVNRFPSGGST

Extended Key Usages

ExtKeyUsageCodeSigning

ee:d7:2a:b1:7c:a1:f9:c4:1d:45:e6:1c:64:d7:72:3a:aa:aa:87:2f
Signer

Actual PE Digest

ee:d7:2a:b1:7c:a1:f9:c4:1d:45:e6:1c:64:d7:72:3a:aa:aa:87:2f

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleW
IsValidLocale
GetOverlappedResult
CommConfigDialogW
lstrcmpiA
WriteConsoleOutputA
DeleteTimerQueueTimer
SetHandleCount
GetSystemTimeAsFileTime
GlobalGetAtomNameW
EnumSystemCodePagesA
GetNamedPipeHandleStateA
CompareStringW
GetProcessAffinityMask
ReadConsoleOutputCharacterW
SetMessageWaitingIndicator
GetProfileIntA
Process32FirstW
GetPrivateProfileSectionA
FlushConsoleInputBuffer
GetVersion
GetModuleHandleA
MultiByteToWideChar
GetVersionExW
CreateFileW
WriteFile
GetEnvironmentVariableW
GetSystemTime
GetCurrentProcessId
FindNextFileW
FindClose
GetSystemTimeAdjustment
QueryPerformanceCounter
FindFirstFileW
GlobalMemoryStatus
GetCurrentThreadId
GetLogicalDriveStringsW
QueryPerformanceFrequency
CloseHandle
CreateProcessW
WaitForSingleObject
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetTickCount
GetVersionExA
SleepEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FormatMessageA
SetLastError
FormatMessageW
LocalFree
OutputDebugStringW
FreeLibrary
LoadLibraryW
GetCurrentThread
SuspendThread
MulDiv
MoveFileExW
GetModuleFileNameW
SetErrorMode
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
CreateMutexW
ReleaseMutex
CreateSemaphoreW
ReleaseSemaphore
TlsSetValue
ExitProcess
SetThreadPriority
ResumeThread
TlsGetValue
TlsFree
TlsAlloc
FindResourceW
GetCPInfo
IsValidCodePage
TerminateProcess
SizeofResource
LockResource
LoadResource
GetFileAttributesW
GetTempPathW
GetFileTime
GetFileSize
GetTempFileNameW
CopyFileW
SetCurrentDirectoryW
GetACP
GetUserDefaultLCID
GetLocaleInfoW
SetThreadLocale
RaiseException
SetEvent
CreateThread
IsBadReadPtr
IsBadStringPtrA
ExpandEnvironmentStringsW
GetCommandLineW
FreeConsole
ReadConsoleOutputCharacterA
GetConsoleScreenBufferInfo
WriteConsoleA
WriteConsoleW
FillConsoleOutputCharacterW
SetConsoleCursorPosition
GlobalUnlock
GlobalAlloc
GlobalSize
GlobalLock
HeapSize
GetProcessHeap
GlobalFree
InterlockedExchange
EncodePointer
DecodePointer
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RtlUnwind
ExitThread
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFilePointer
GetDriveTypeA
FindFirstFileExA
GetTimeZoneInformation
CreateFileA
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetTimeFormatW
GetDateFormatW
DeleteFileW
GetConsoleCP
FlushFileBuffers
SetStdHandle
InitializeCriticalSectionAndSpinCount
MoveFileW
RemoveDirectoryW
CreateDirectoryW
GetFullPathNameW
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
IsProcessorFeaturePresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetFullPathNameA
GetExitCodeProcess
SetEndOfFile
GetStringTypeW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetDriveTypeW
GetLocaleInfoA
EnumSystemLocalesA
GetModuleFileNameA
GetCurrentProcess
GetCurrentDirectoryW
GetSystemDirectoryW
lstrlenW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetFileAttributesW
LocalAlloc
lstrcmpW
WriteProcessMemory
WritePrivateProfileStringW
VirtualProtect
VirtualFree
VirtualAlloc
TerminateThread
SystemTimeToFileTime
HeapDestroy
GlobalHandle
GetSystemInfo
GetPrivateProfileStringW
GetLocalTime
GetComputerNameW
InterlockedExchangeAdd
InterlockedCompareExchange
FlushInstructionCache
CreateFileMappingW
GetUserDefaultUILanguage

user32

CreatePopupMenu
CloseClipboard
AnyPopup
CreateMenu
CountClipboardFormats
EndMenu
LoadCursorFromFileW
GetWindowDC
GetWindowTextLengthW
IsCharLowerW
LoadCursorFromFileA
LoadIconW
MessageBoxW
GetScrollInfo
SetScrollInfo
EnableScrollBar
ScrollWindow
GetParent
WindowFromPoint
SetParent
RedrawWindow
ScreenToClient
ClientToScreen
IsWindowVisible
IsWindowEnabled
GetMessageTime
GetActiveWindow
GetWindow
ChildWindowFromPointEx
UnhookWindowsHookEx
CallNextHookEx
TrackPopupMenu
CallWindowProcW
IsDialogMessageW
InvalidateRect
FillRect
IsWindow
SetWindowTextW
GetSysColor
GetClientRect
SetFocus
ReleaseCapture
SetCursorPos
UpdateWindow
MoveWindow
DeferWindowPos
GetWindowRect
GetUpdateRgn
MapWindowPoints
BeginDeferWindowPos
EndDeferWindowPos
SystemParametersInfoW
GetMenuItemInfoW
GetMenuItemCount
SetWindowsHookExW
RegisterHotKey
UnregisterHotKey
PtInRect
InflateRect
SetMenu
CreateIconIndirect
BringWindowToTop
IsIconic
SetForegroundWindow
IsZoomed
FlashWindow
CreateDialogIndirectParamW
GetWindowPlacement
DrawMenuBar
EnableMenuItem
GetSystemMenu
CreateDialogParamW
GetDlgItem
SetWindowRgn
LoadImageW
MessageBeep
GetClassNameW
GetWindowTextW
DestroyCursor
BeginPaint
EndPaint
ChangeDisplaySettingsW
EnumDisplaySettingsW
GetDoubleClickTime
DrawFrameControl
OffsetRect
DrawIconEx
SetCapture
DrawTextW
CopyRect
DrawStateW
SetRectEmpty
DrawFocusRect
GetMenuState
GetSysColorBrush
CheckMenuItem
CheckMenuRadioItem
ShowWindow
SetRect
DrawEdge
GetClipboardFormatNameW
RegisterClipboardFormatW
DestroyMenu
GetSubMenu
InsertMenuW
InsertMenuItemW
RemoveMenu
ModifyMenuW
AppendMenuW
HideCaret
keybd_event
FindWindowExW
DestroyAcceleratorTable
CreateAcceleratorTableW
TranslateAcceleratorW
UnionRect
IsRectEmpty
ValidateRgn
ChildWindowFromPoint
IsClipboardFormatAvailable
GetDialogBaseUnits
wsprintfW
ShowCursor
AdjustWindowRectEx
DdeCreateStringHandleW
DdeClientTransaction
DdeDisconnect
DdeInitializeW
DdeGetLastError
DdeCreateDataHandle
DdeGetData
DdeFreeDataHandle
DdeQueryStringW
DdeUninitialize
DdeFreeStringHandle
LoadCursorW
SetCursor
MsgWaitForMultipleObjects
GetMessageW
DispatchMessageW
SetTimer
KillTimer
PeekMessageW
DestroyWindow
DefWindowProcW
UnregisterClassW
RegisterClassW
PostMessageW
CreateWindowExW
PostThreadMessageW
ValidateRect
SetWindowPos
GetFocus
EnableWindow
SetWindowLongW
GetWindowLongW
GetAsyncKeyState
SetActiveWindow
VkKeyScanW
MapVirtualKeyW
TranslateMessage
PostQuitMessage
GetMessagePos
GetIconInfo
LoadBitmapW
GetKeyState
DestroyIcon
DdePostAdvise
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
GetCapture
GetCursorPos
SendMessageA
FindWindowA
GetSystemMetrics
ReleaseDC
GetDC
RegisterWindowMessageW
SendMessageTimeoutW
SendMessageW
FindWindowW
DdeConnect
SetMenuItemInfoW
DdeNameService

gdi32

GetBkColor
DeleteObject
GetTextColor
AbortPath
CreateMetaFileA
GetFontLanguageInfo
GetBkMode
CreateMetaFileW
CancelDC
GetEnhMetaFileA
GetGraphicsMode
GetLayout
RealizePalette
CreateCompatibleDC
GetObjectType
CreateHalftonePalette
CreatePatternBrush
GetStockObject
SaveDC
DeleteDC
GetSystemPaletteUse
GetDCPenColor
GetEnhMetaFileW
BeginPath
WidenPath
GetStretchBltMode
CloseMetaFile
EndPath
FillPath
GdiGetBatchLimit
PathToRegion
SwapBuffers
AddFontResourceW
FlattenPath
AddFontResourceA
GetPixelFormat
GetTextCharset
GdiFlush
AbortDoc
GetTextAlign
GetMapMode
EndPage
DeleteColorSpace
EndDoc
DeleteMetaFile
CreateSolidBrush
UpdateColors
UnrealizeObject
GetPolyFillMode
DeleteEnhMetaFile
GetTextCharacterExtra
CloseEnhMetaFile
CloseFigure
GetDCBrushColor
GetColorSpace
GetROP2
SetMetaRgn
StrokePath
QueryFontAssocStatus
SetDIBColorTable
GdiEntry8
FontIsLinked
EngCreateSemaphore
OffsetViewportOrgEx
SetTextColor
GdiGetSpoolFileHandle
GetEnhMetaFilePixelFormat
EngStretchBltROP
GdiEndPageEMF
OffsetRgn
EngLockSurface
SetLayoutWidth
GdiPlayScript
Rectangle
XLATEOBJ_hGetColorTransform
FONTOBJ_pvTrueTypeFontFile
GetCharWidthA
GdiSwapBuffers
SetWorldTransform
GetPixel
GdiCleanCacheDC
ExtCreatePen
GetWorldTransform
ResetDCW
STROBJ_bEnumPositionsOnly
GetTextExtentPointI
GdiEntry14
CreateEllipticRgn
EngCheckAbort
CreateBitmapIndirect
CreateICA
SetBitmapBits
GdiQueryFonts
GetSystemPaletteEntries
CreateICW
SetTextAlign
CreateRectRgnIndirect
GetTextExtentExPointW
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
CreatePen
CreateHatchBrush
EnumFontFamiliesExW
Polyline
SetROP2
SetViewportOrgEx
SetPixel
PolyBezier
SetWindowOrgEx
PlayEnhMetaFile
SetAbortProc
StartDocW
StartPage
CreateDCW
GetEnhMetaFileHeader
CreateEnhMetaFileW
GetClipBox
CreateFontIndirectW
SetBkMode
StretchBlt
MoveToEx
SetWindowExtEx
SetViewportExtEx
SetMapMode
SelectClipRgn
SetStretchBltMode
ExtSelectClipRgn
ExtFloodFill
Arc
Pie
Polygon
LineTo
GetRegionData
ExtCreateRegion
SetBkColor
CreateBitmap
GetObjectW
ExcludeClipRect
SetBrushOrgEx
CreateRectRgn
SelectPalette
GetTextMetricsW
GetOutlineTextMetricsW
GetCharABCWidthsW
CombineRgn
RectInRegion
PtInRegion
EqualRgn
GetRgnBox
GetDIBColorTable
CreateDIBitmap
GetDIBits
CreateDIBSection
GetTextExtentPoint32W
StretchDIBits
ExtTextOutW
MaskBlt
Ellipse
RoundRect
PolyPolygon
SetPolyFillMode
GetDeviceCaps
BitBlt
SelectObject
CreateCompatibleBitmap

comdlg32

PageSetupDlgW
PrintDlgW
ChooseFontW
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

advapi32

GetUserNameA
RegOpenKeyA
RegQueryValueExA
FreeSid
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyW
RegDeleteKeyW
GetUserNameW
DeregisterEventSource
ReportEventA
RegisterEventSourceA

shell32

SHFileOperation
SHGetDesktopFolder
SHFileOperationW
SHPathPrepareForWriteW
SHBrowseForFolderA
WOWShellExecute
FindExecutableW
SHFormatDrive
ShellAboutW
SHLoadNonloadedIconOverlayIdentifiers
ExtractIconW
SHGetFileInfoW
DragFinish
SHGetMalloc
DragQueryFileW
ExtractIconExW
ShellExecuteExW
SHGetPathFromIDListW
DragAcceptFiles
DragQueryPoint
SHGetSpecialFolderLocation

ole32

OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
CoTaskMemAlloc
ReleaseStgMedium
OleInitialize
OleUninitialize
CoCreateInstance
CoCreateGuid
OleLockRunning
OleRun
OleSetContainedObject

shlwapi

StrChrIA

comctl32

ImageList_GetImageCount
ImageList_GetIconSize
ImageList_Create
ImageList_Add
ImageList_ReplaceIcon
ImageList_Replace
ImageList_Remove
ImageList_Draw
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_BeginDrag
ImageList_DragMove
ImageList_DragEnter
ImageList_DragLeave
ImageList_EndDrag
ImageList_Destroy

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 261B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

r2
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68d91b46eb0976c4f7c6b9ba2c81af54

Code Sign

1d:7b:98:cc:48:0b:c3:73:b3:84:a0:fd:1f:c0:d0:6fCertificate

Extended Key Usages

ee:d7:2a:b1:7c:a1:f9:c4:1d:45:e6:1c:64:d7:72:3a:aa:aa:87:2fSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

shlwapi

comctl32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 512B - Virtual size: 261B

.data Size: 20KB - Virtual size: 20KB

r2 Size: 42KB - Virtual size: 42KB

.rsrc Size: 68KB - Virtual size: 68KB

1d:7b:98:cc:48:0b:c3:73:b3:84:a0:fd:1f:c0:d0:6f
Certificate

ee:d7:2a:b1:7c:a1:f9:c4:1d:45:e6:1c:64:d7:72:3a:aa:aa:87:2f
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 512B - Virtual size: 261B

.data
Size: 20KB - Virtual size: 20KB

r2
Size: 42KB - Virtual size: 42KB

.rsrc
Size: 68KB - Virtual size: 68KB