7494dfce601f88205487e074f43c93a5bd8344be421a35d7f9c510e5fb08778b_0a64c3b18f10fa85be3a7e18029d30af1f3cecacc7d20976b1701527e315bcc1[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

7494dfce601f88205487e074f43c93a5bd8344be421a35d7f9c510e5fb08778b_0a64c3b18f10fa85be3a7e18029d30af1f3cecacc7d20976b1701527e315bcc1.exe
Size

521KB
MD5

4f8f818e636f157d640c8e003630d311
SHA1

2834f4726770237327355e6427fbde23eb4465e1
SHA256

0a64c3b18f10fa85be3a7e18029d30af1f3cecacc7d20976b1701527e315bcc1
SHA512

60c590a35e43453f4d5d062ea14c736f2fbf380cc343411566131441f0b45530fa71d6456007f870a479a60d941a9b56eac48737817d91dd905a2e6a17a49546
SSDEEP

6144:53iGEtpvg9pe3oUADfamC9EGqswger75gYK9KRCv/qn8TW:53mgLbtvswgK75b0o6Snj

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs
Detects CryptOne packer defined in NCC blogpost.
cryptone packer

Processes:

resource yara_rule

sample cryptone

resource	yara_rule
sample	cryptone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
7494dfce601f88205487e074f43c93a5bd8344be421a35d7f9c510e5fb08778b_0a64c3b18f10fa85be3a7e18029d30af1f3cecacc7d20976b1701527e315bcc1.exe

Files

7494dfce601f88205487e074f43c93a5bd8344be421a35d7f9c510e5fb08778b_0a64c3b18f10fa85be3a7e18029d30af1f3cecacc7d20976b1701527e315bcc1.exe
.exe windows:4 windows x86 arch:x86

01682bb6d240194c52f6db15fba30f95

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

Sleep
GetLastError
LoadLibraryA
GetProcAddress
GetModuleHandleW
DeleteFileW
DeleteFileA
CreateDirectoryA
CreateDirectoryW
FindClose
FindNextFileA
FindFirstFileA
FindNextFileW
FindFirstFileW
GetTickCount
WideCharToMultiByte
GlobalAlloc
GetVersionExW
GetFullPathNameA
GetFullPathNameW
GetModuleFileNameW
FindResourceW
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
CompareStringA
ExitProcess
GetLocaleInfoW
GetNumberFormatW
SetFileAttributesW
GetDateFormatW
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
WaitForSingleObject
GetTempPathW
MoveFileExW
UnmapViewOfFile
GetCommandLineW
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
SetEnvironmentVariableW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
MultiByteToWideChar
CompareStringW
IsDBCSLeadByte
GetCPInfo
SetCurrentDirectoryW
LoadLibraryW
FreeLibrary
SetFileAttributesA
GetFileAttributesW
GetFileAttributesA
WriteFile
GetStdHandle
ReadFile
GetCurrentDirectoryW
CreateFileW
CreateFileA
GetFileType
SetEndOfFile
SetFilePointer
MoveFileW
SetFileTime
GetCurrentProcess
CloseHandle
SetLastError
DosDateTimeToFileTime
ConnectNamedPipe
CreateEventA
DuplicateHandle
CopyFileExW
VerSetConditionMask
CompareFileTime
IsValidLanguageGroup
GetSystemTimeAdjustment
GetNamedPipeHandleStateW
EndUpdateResourceA
GetOverlappedResult
GetPrivateProfileSectionA
OpenSemaphoreA
OpenEventA
GetShortPathNameA
OutputDebugStringA
LoadLibraryExW
LocalAlloc
GlobalFree
GetCurrentThreadId
CreateProcessA
GetSystemDirectoryW
GetTimeZoneInformation
GetDiskFreeSpaceExW
GetUserDefaultLCID
IsValidLocale
GetStringTypeExW
IsValidCodePage
GetShortPathNameW
GetLongPathNameW
GetCurrentThread
GlobalMemoryStatus
ReleaseSemaphore
IsProcessorFeaturePresent
EnumUILanguagesW
EnumSystemLocalesW
GetCalendarInfoW
GetUserDefaultUILanguage
VirtualProtect
QueryPerformanceCounter
GetTempFileNameA
GetTempPathA
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
UnhandledExceptionFilter
IsDebuggerPresent
lstrcmpiW
GetThreadContext
GetThreadTimes
GetPriorityClass
HeapDestroy
HeapCreate
TerminateThread
GetThreadSelectorEntry
GetLocalTime
LeaveCriticalSection
EnterCriticalSection
ReleaseMutex
WaitForMultipleObjects
SetProcessWorkingSetSize
TerminateProcess
CreateThread
GetCurrentProcessId
SetUnhandledExceptionFilter
GetModuleHandleA
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
LocalFree
GetSystemWindowsDirectoryW
GetComputerNameA
SetPriorityClass
GetFileSize
CreateFileMappingA
SuspendThread
ExitThread
MulDiv
GetModuleFileNameA
GetSystemDefaultLangID
GetSystemDefaultUILanguage
GetUserDefaultLangID
GetACP
GetSystemDefaultLCID
SetEvent
CreateProcessW
GetSystemDirectoryA
SetThreadPriority
CreateRemoteThread
OpenProcess
LoadLibraryExA
SetEnvironmentVariableA
ReadProcessMemory
VirtualQueryEx
GetSystemInfo
HeapSize
HeapValidate
VirtualAlloc
RaiseException
TlsSetValue
CreateSemaphoreA
FlushFileBuffers
ResumeThread
InitializeCriticalSectionAndSpinCount
TlsAlloc
VirtualFree
TlsGetValue
TlsFree
GetVersion
GetProcessTimes
CreateMutexA
OpenMutexA
GetThreadPriority

user32

CreatePopupMenu
CloseClipboard
AnyPopup
CreateMenu
CountClipboardFormats
EndMenu
CharLowerA
GetWindowDC
GetWindowTextLengthW
IsCharLowerW
LoadCursorFromFileA
LoadCursorFromFileW
LoadIconW
wvsprintfW
ReleaseDC
GetDC
SendMessageW
SetDlgItemTextW
SetFocus
EndDialog
DestroyIcon
SendDlgItemMessageW
GetDlgItemTextW
GetClassNameW
DialogBoxParamW
IsWindowVisible
WaitForInputIdle
SetForegroundWindow
GetSysColor
PostMessageW
LoadBitmapW
CharToOemA
OemToCharA
FindWindowExW
wvsprintfA
GetParent
MapWindowPoints
CreateWindowExW
UpdateWindow
SetWindowTextW
LoadCursorW
RegisterClassExW
SetWindowLongW
GetWindowLongW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
GetClientRect
IsWindow
CharToOemBuffW
MessageBoxW
ShowWindow
GetDlgItem
EnableWindow
OemToCharBuffA
CharUpperA
CharToOemBuffA
LoadStringW
SetWindowPos
GetWindowTextW
GetSystemMetrics
GetWindow
CharUpperW
GetWindowRect
CopyRect
DdeCreateStringHandleA
LoadMenuIndirectW
GetWindowTextA
DrawIconEx
WINNLSGetIMEHotkey
GetMessageA
AdjustWindowRectEx
GetActiveWindow
GetMenuCheckMarkDimensions
wsprintfW
SendNotifyMessageW
GetClassInfoExW
CopyAcceleratorTableA
GetClassLongA
GetMonitorInfoA
DdeSetQualityOfService
EnumDisplaySettingsExW
GetClipboardViewer
InternalGetWindowText
DdeCmpStringHandles
CreateDialogIndirectParamA
CheckMenuRadioItem
SendIMEMessageExW
GetDlgCtrlID
DrawTextA
DrawTextW
MapDialogRect
CallWindowProcA
MoveWindow
GetKeyboardLayout
LoadBitmapA
CallWindowProcW
SetRectEmpty
PostMessageA
SendMessageA
DefWindowProcA
SetTimer
KillTimer
PostQuitMessage
DispatchMessageA
IsDialogMessageA
CreateWindowExA
RegisterClassExA
DialogBoxParamA
SystemParametersInfoA
GetWindowLongA
LoadIconA
SetWindowLongA
FillRect
GetSysColorBrush
SetWindowTextA
CreateDialogParamW
EnumDisplayMonitors
LoadCursorA
SetCursor
DrawFocusRect
InvalidateRect
SendDlgItemMessageA
CheckDlgButton
LoadStringA
IsDlgButtonChecked
SetDlgItemTextA
GetScrollInfo
SetScrollInfo
GetFocus
FlashWindowEx
GetForegroundWindow
GetWindowPlacement
IsIconic
GetWindowThreadProcessId
EnumWindows
SendMessageTimeoutA
IsWindowUnicode
GetClassNameA

gdi32

GetBkColor
DeleteObject
GetTextColor
AbortPath
CreateMetaFileA
GetFontLanguageInfo
GetBkMode
CreateMetaFileW
CancelDC
GetEnhMetaFileA
GetGraphicsMode
GetLayout
RealizePalette
CreateCompatibleDC
GetObjectType
CreateHalftonePalette
CreatePatternBrush
GetStockObject
SaveDC
DeleteDC
GetSystemPaletteUse
GetDCPenColor
GetEnhMetaFileW
BeginPath
WidenPath
GetStretchBltMode
CloseMetaFile
EndPath
FillPath
GdiGetBatchLimit
PathToRegion
SwapBuffers
AddFontResourceW
FlattenPath
AddFontResourceA
GetPixelFormat
GetTextCharset
GdiFlush
AbortDoc
GetTextAlign
GetMapMode
EndPage
DeleteColorSpace
EndDoc
DeleteMetaFile
CreateSolidBrush
UpdateColors
UnrealizeObject
GetPolyFillMode
DeleteEnhMetaFile
GetTextCharacterExtra
CloseEnhMetaFile
CloseFigure
GetDCBrushColor
GetColorSpace
GetROP2
SetMetaRgn
StrokePath
GetDeviceCaps
GetObjectW
CreateCompatibleBitmap
SelectObject
StretchBlt
GetOutlineTextMetricsA
GdiGetSpoolMessage
PATHOBJ_bEnum
CreateFontIndirectW
FONTOBJ_cGetAllGlyphHandles
RemoveFontResourceW
NamedEscape
RemoveFontResourceTracking
SelectClipPath
CreateRectRgn
Ellipse
StretchDIBits
CreateBitmap
GetCharABCWidthsW
CreateFontA
EnumObjects
CreateICA
GdiEntry6
StartDocW
EngMarkBandingSurface
GetTransform
RestoreDC
GetTextFaceA
SetMapMode
GetTextExtentPoint32W
SetTextAlign
GetTextMetricsA
GetObjectA
ExtTextOutW
SetBkMode
SetTextColor
GetTextFaceW
CreateDCA
TranslateCharsetInfo
CreateFontIndirectA
SetBkColor
CreateBrushIndirect

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

advapi32

GetUserNameA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExW
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
SetFileSecurityW
SetFileSecurityA
AdjustTokenPrivileges
GetSecurityDescriptorDacl
RegQueryInfoKeyW
ReportEventW
RegisterEventSourceW
ReportEventA
DeregisterEventSource
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
SetNamedSecurityInfoW
ConvertSidToStringSidA
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCreateKeyExA
RegDeleteValueW
RegOpenKeyExA
RegSetValueExA
RegEnumKeyW
RegEnumValueW
GetLengthSid
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
AllocateAndInitializeSid
CopySid
OpenThreadToken
IsValidSid
CheckTokenMembership
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
GetTokenInformation

shell32

SHChangeNotify
ShellExecuteExW
SHFileOperationW
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
ExtractIconEx
SHLoadNonloadedIconOverlayIdentifiers
DoEnvironmentSubstW
ExtractIconExA
SHGetSpecialFolderPathW
ShellExecuteExA

ole32

CreateStreamOnHGlobal
OleInitialize
CoCreateInstance
OleUninitialize
CLSIDFromString
StringFromIID
CoTaskMemFree
CoUninitialize
CoInitializeEx

shlwapi

SHAutoComplete
StrCmpNIA
AssocQueryStringW
UrlGetPartA
wnsprintfA

comctl32

InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Create
ImageList_Destroy

Sections

.text
Size: 425KB - Virtual size: 425KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

r2
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

01682bb6d240194c52f6db15fba30f95

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

shlwapi

comctl32

Sections

.text Size: 425KB - Virtual size: 425KB

.data Size: 17KB - Virtual size: 17KB

r2 Size: 2KB - Virtual size: 2KB

.rsrc Size: 37KB - Virtual size: 37KB

.bss Size: 512B - Virtual size: 512B

.text
Size: 425KB - Virtual size: 425KB

.data
Size: 17KB - Virtual size: 17KB

r2
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 37KB - Virtual size: 37KB

.bss
Size: 512B - Virtual size: 512B