Static

static

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ExecApp.zip

  • Size

    59.5MB

  • MD5

    cebbb7abc4f1b5a6c699fc5f7ec4e6f6

  • SHA1

    f5c0dca592076e056e49b4d1dfc1eec093c7c58b

  • SHA256

    b62cbbd647a39ace32b472a4291aa818f8af7767b6a0c33ac835228b84d2cd6b

  • SHA512

    45d3e5dc09e0146d59175cc48a3038df5d22531ec06901d893b52847429cc663dd3b14087530e33aaa83f45c8ff212afb0680041394d424c6f61b50bf3ecd168

  • SSDEEP

    1572864:5DGIRbbxc+pwUQAmtK1lJDMWBDmQPuZlCdNq1qnOylYj:5/bRweDJDTKQPuUrOylk

Score
9/10
cryptonepacker

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ExecApp.zip
    .zip

    Password: xeno

  • Executor/BootstrapperApp.exe
    .exe windows:6 windows x86 arch:x86

    Password: xeno

    285f07c66f98861b92460fa57c11d967


    Headers

    Imports

    Sections

  • Executor/Microsoft.Web.WebView2.Core.dll
    .dll windows:4 windows x86 arch:x86

    Password: xeno

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Executor/Microsoft.Web.WebView2.WinForms.dll
    .dll windows:4 windows x86 arch:x86

    Password: xeno

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Executor/autoexec/test.lua
  • Executor/autoexec/test2.lua
  • Executor/locales/af.pak
  • Executor/locales/am.pak
  • Executor/locales/ar.pak
  • Executor/locales/bg.pak
  • Executor/locales/bin/api
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: xeno

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Executor/locales/bn.pak
  • Executor/locales/ca.pak
  • Executor/locales/cs.pak
  • Executor/locales/da.pak
  • Executor/locales/de.pak
  • Executor/locales/el.pak
  • Executor/locales/en-GB.pak
  • Executor/locales/en-US.pak
  • Executor/locales/es-419.pak
  • Executor/locales/es.pak
  • Executor/locales/et.pak
  • Executor/locales/fa.pak
  • Executor/locales/fi.pak
  • Executor/locales/fil.pak
  • Executor/locales/fr.pak
  • Executor/locales/gu.pak
  • Executor/locales/he.pak
  • Executor/locales/hi.pak
  • Executor/locales/hr.pak
  • Executor/locales/hu.pak
  • Executor/locales/id.pak
  • Executor/locales/it.pak
  • Executor/locales/ja.pak
  • Executor/locales/kn.pak
  • Executor/locales/ko.pak
  • Executor/locales/lt.pak
  • Executor/locales/lv.pak
  • Executor/locales/ml.pak
  • Executor/locales/mr.pak
  • Executor/locales/ms.pak
  • Executor/locales/nb.pak
  • Executor/locales/nl.pak
  • Executor/locales/pl.pak
  • Executor/locales/pt-BR.pak
  • Executor/locales/pt-PT.pak
  • Executor/locales/ro.pak
  • Executor/locales/ru.pak
  • Executor/locales/sk.pak
  • Executor/locales/sl.pak
  • Executor/locales/sr.pak
  • Executor/locales/sv.pak
  • Executor/locales/sw.pak
  • Executor/locales/ta.pak
  • Executor/locales/te.pak
  • Executor/locales/th.pak
  • Executor/locales/tr.pak
  • Executor/locales/uk.pak
  • Executor/locales/ur.pak
  • Executor/locales/vi.pak
  • Executor/locales/zh-CN.pak
  • Executor/locales/zh-TW.pak
  • Executor/scripts/Dex.lua
    .js
  • Executor/scripts/Infinite Yield.lua
    .js
  • Executor/scripts/Sine Wave.lua
  • Executor/scripts/Spinning Donut.lua
  • Executor/scripts/UNCCheckEnv.lua
    .js
  • Executor/workspace/.tests/appendfile.txt
  • Executor/workspace/.tests/getcustomasset.txt
  • Executor/workspace/.tests/isfile.txt
  • Executor/workspace/.tests/listfiles/test_1.txt
  • Executor/workspace/.tests/listfiles/test_2.txt
  • Executor/workspace/.tests/loadfile.txt
  • Executor/workspace/.tests/readfile.txt
  • Executor/workspace/.tests/writefile
  • Executor/workspace/.tests/writefile.txt
  • Executor/workspace/EzHubLL.txt
  • Executor/workspace/IY_FE.iy
  • Executor/workspace/Sky Hub/Sky Hub Settings.json