0d02d3159a1191378b2e4d6306079ba499bfe4bbe3c4c43982352b488acd10f9[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

0d02d3159a1191378b2e4d6306079ba499bfe4bbe3c4c43982352b488acd10f9.exe
Size

787KB
MD5

0b52525faa9bde4bbf60ac20b5220e03
SHA1

611e5fbffcd7c1856fe7d9133ad6c50b5c3c56e2
SHA256

0d02d3159a1191378b2e4d6306079ba499bfe4bbe3c4c43982352b488acd10f9
SHA512

02f4d4d987c51935468acaacefc01fd79fbecba4f341d4ebaa6157af3b1f151e979f4f423c3e10fa86063511e1deb8735bebeb33d759dc457b7e8a180a3c2cb6
SSDEEP

6144:dmmO19e3qlOslMkn0an0D/jwsi5iC3Aip5ui8eYRKM1+ZpvpQKv+fFLXF2py4n0G:ENLPHLiHipGoM1D2+fBybn/

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
sample	cryptone

Files

0d02d3159a1191378b2e4d6306079ba499bfe4bbe3c4c43982352b488acd10f9.exe
.exe windows:1 windows x86 arch:x86

2b03f108307cbec4a1e125d023d4e183

Code Sign

48:04:2a:d2:76:ae:97:74:be:39:ab:b8:ac:3e:3a:da
Certificate

Issuer

CN=OHZOIPIFGKOQRMDDPN

Not Before

23-06-2020 09:20

Not After

31-12-2039 23:59

Subject

CN=OHZOIPIFGKOQRMDDPN

Extended Key Usages

ExtKeyUsageCodeSigning

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02-05-2019 00:00

Not After

01-08-2030 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ad:d2:3a:f6:dc:4a:e4:9f:f8:6f:3f:70:c1:be:a5:54:7d:e8:22:e9
Signer

Actual PE Digest

ad:d2:3a:f6:dc:4a:e4:9f:f8:6f:3f:70:c1:be:a5:54:7d:e8:22:e9

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetLastError
VirtualAllocEx
LoadLibraryA
GetProcAddress
GetDefaultCommConfigA
FatalAppExitA
SetupComm
MapUserPhysicalPagesScatter
ClearCommBreak
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
SetConsoleActiveScreenBuffer
WriteConsoleOutputW
CreateFileMappingW
CreateSemaphoreW
CloseHandle
SystemTimeToFileTime
SetLocalTime
MoveFileWithProgressW
BuildCommDCBAndTimeoutsA
IsBadReadPtr
GetVersion
GlobalGetAtomNameA
VerifyVersionInfoW
GetProfileSectionA
FindClose
GetEnvironmentVariableA
GetVolumeInformationA
WriteFile
GetConsoleAliasesA
HeapCreate
GetBinaryType
WriteProfileStringW
FindAtomA
GlobalUnWire
OpenMutexA
GetTapeParameters
EndUpdateResourceW
GetUserDefaultLangID
TlsAlloc
GetCommProperties
GetACP
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
lstrlenW
lstrcpyW
lstrcatW
lstrcpynW
WideCharToMultiByte
GetSystemDirectoryW
SetCurrentDirectoryW
OpenEventW
SetEvent
LocalAlloc
LocalFree
GetStartupInfoA
GetCurrentThreadId

user32

LoadIconA
LoadCursorA
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
wvsprintfA
mouse_event
keybd_event
WindowFromPoint
WinHelpA
WaitMessage
ValidateRect
UpdateWindow
UnregisterClassW
UnregisterClassA
UnionRect
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoA
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCursor
ShowCaret
SetWindowRgn
SetWindowsHookExW
SetWindowsHookExA
SetWindowTextW
SetWindowTextA
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetWindowLongA
SetTimer
SetSysColors
SetScrollRange
SetScrollPos
SetScrollInfo
SetRectEmpty
SetRect
SetPropA
SetParent
SetMenuItemInfoW
SetMenuItemInfoA
SetMenu
SetKeyboardState
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetClassLongA
SetCaretPos
SetCapture
SetActiveWindow
SendNotifyMessageA
SendMessageTimeoutA
SendMessageW
SendMessageA
SendDlgItemMessageA
ScrollWindowEx
ScrollWindow
ScreenToClient
RemovePropA
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageA
RegisterDeviceNotificationA
RegisterClipboardFormatA
RegisterClassW
RegisterClassA
RedrawWindow
PtInRect
PostQuitMessage
PostMessageW
PostMessageA
PeekMessageA
OpenClipboard
OffsetRect
OemToCharA
MsgWaitForMultipleObjects
MessageBeep
MapWindowPoints
MapVirtualKeyA
LockWindowUpdate
LoadStringW
LoadKeyboardLayoutA
LoadImageA
LoadBitmapA
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageW
IsDialogMessageA
IsClipboardFormatAvailable
IsChild
IsCharAlphaNumericA
IsCharAlphaA
InvalidateRect
IntersectRect
InsertMenuItemA
InsertMenuA
InflateRect
HideCaret
GetWindowThreadProcessId
GetWindowTextLengthW
GetWindowTextW
GetWindowTextA
GetWindowRgn
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowLongA
GetWindowDC
GetUpdateRect
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropA
GetParent
GetWindow
GetMessageTime
GetMessagePos
GetMessageA
GetMenuStringW
GetMenuStringA
GetMenuState
GetMenuItemInfoW
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetMenuDefaultItem
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextA
GetIconInfo
GetForegroundWindow
GetFocus
GetDoubleClickTime
GetDlgItem
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardFormatNameA
GetClipboardData
GetClientRect
GetClassNameW
GetClassNameA
GetClassInfoW
GetClassInfoA
GetCaretPos
GetCapture
GetActiveWindow
FrameRect
FindWindowExA
FindWindowA
FillRect
EqualRect
EnumWindows
EnumThreadWindows
EnumClipboardFormats
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextW
DrawTextA
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DrawCaption
DispatchMessageW
DispatchMessageA
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DestroyCaret
DeleteMenu
DefWindowProcW
DefWindowProcA
DefMDIChildProcW
DefMDIChildProcA
DefFrameProcW
DefFrameProcA
CreateWindowExW
CreateWindowExA
CreatePopupMenu
CreateMenu
CreateMDIWindowW
CreateIconIndirect
CreateIcon
CreateCaret
CopyImage
CloseClipboard
ClipCursor
ClientToScreen
ChildWindowFromPointEx
ChildWindowFromPoint
CheckMenuItem
CharUpperBuffW
CharUpperW
CharLowerBuffW
CallWindowProcW
CallWindowProcA
CallNextHookEx
BringWindowToTop
BeginPaint
AttachThreadInput
CharLowerBuffA
CharLowerA
CharUpperBuffA
CharUpperA
CharToOemA
AdjustWindowRectEx
ActivateKeyboardLayout
DefDlgProcW
DlgDirSelectExW
SetDlgItemTextA
BeginDeferWindowPos
ValidateRgn
GetMonitorInfoW
GetClipCursor
GetClassLongA
CreateCursor
DdeAccessData
UnloadKeyboardLayout
DdeCreateStringHandleW
BroadcastSystemMessageA
CopyAcceleratorTableA
GetGuiResources
SendNotifyMessageW
LoadBitmapW
DdeKeepStringHandle
FindWindowW
DdeQueryStringW
GetTabbedTextExtentA
GetTitleBarInfo
SendMessageTimeoutW
GetKeyboardLayoutNameW
GetMessageW
LoadIconW
LoadCursorW

gdi32

GetEnhMetaFileW
GetStockObject
UnrealizeObject
TextOutW
TextOutA
StretchDIBits
StretchBlt
StartPage
StartDocA
SetWindowOrgEx
SetWindowExtEx
SetWinMetaFileBits
SetViewportOrgEx
SetViewportExtEx
SetTextColor
SetTextAlign
SetStretchBltMode
SetRectRgn
SetROP2
SetPixelV
SetPixel
SetPaletteEntries
SetMapMode
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SelectClipRgn
SaveDC
RoundRect
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyPolyline
PolyBezier
PlayEnhMetaFile
PatBlt
OffsetWindowOrgEx
OffsetRgn
OffsetClipRgn
MoveToEx
MaskBlt
LineTo
LineDDA
LPtoDP
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsA
GetTextExtentPointW
GetTextExtentPointA
GetTextExtentPoint32W
GetTextExtentPoint32A
GetTextColor
GetSystemPaletteEntries
GetRgnBox
GetRegionData
GetPixel
GetPaletteEntries
GetObjectType
GetObjectA
GetNearestPaletteIndex
GetNearestColor
GetGlyphOutlineA
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetCurrentObject
GetClipRgn
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
FrameRgn
FillRgn
ExtTextOutW
ExtTextOutA
ExtCreatePen
ExcludeClipRect
EnumFontsA
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRoundRectRgn
CreateRectRgnIndirect
CreateRectRgn
CreatePolygonRgn
CreatePenIndirect
CreatePen
CreatePatternBrush
CreatePalette
CreateICA
CreateHalftonePalette
CreateFontIndirectA
CreateEllipticRgn
CreateDIBitmap
CreateDIBSection
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileA
CombineRgn
BitBlt
Arc
AbortDoc
GetTextFaceW
RemoveFontResourceExW
CloseFigure
GdiGetLocalBrush
CreateScalableFontResourceA
ModifyWorldTransform
GdiGradientFill

comdlg32

PrintDlgA
ChooseFontA
FindTextA
ChooseColorA
GetSaveFileNameW
GetSaveFileNameA
GetOpenFileNameW
GetOpenFileNameA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExW
RegQueryInfoKeyA
RegFlushKey
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExW

shell32

DragFinish
Shell_NotifyIconW
ShellHookProc
SHFormatDrive
DragQueryFile
DoEnvironmentSubstA
ExtractAssociatedIconW

imm32

ImmGetVirtualKey
ImmGetContext
ImmReleaseContext
ImmGetConversionStatus
ImmGetGuideLineW
ImmSetConversionStatus
ImmSimulateHotKey
ImmGetIMEFileNameW
ImmEscapeW
ImmDisableTextFrameService
ImmGetOpenStatus
ImmNotifyIME
ImmGetCandidateListW
ImmGetCompositionStringW
ImmGetProperty
ImmCreateContext
ImmAssociateContext
ImmSetOpenStatus
ImmDestroyContext
ImmIsIME

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 34B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata3
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata2
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata5
Size: 449KB - Virtual size: 449KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.rdata4
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b03f108307cbec4a1e125d023d4e183

Code Sign

48:04:2a:d2:76:ae:97:74:be:39:ab:b8:ac:3e:3a:daCertificate

Extended Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08Certificate

Extended Key Usages

Key Usages

ad:d2:3a:f6:dc:4a:e4:9f:f8:6f:3f:70:c1:be:a5:54:7d:e8:22:e9Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

imm32

Sections

.text Size: 113KB - Virtual size: 112KB

.rdata Size: 512B - Virtual size: 34B

.rdata3 Size: 20KB - Virtual size: 19KB

.rdata2 Size: 41KB - Virtual size: 41KB

.data Size: 134KB - Virtual size: 134KB

.rdata5 Size: 449KB - Virtual size: 449KB

.rdata4 Size: 20KB - Virtual size: 19KB

.rsrc Size: 2KB - Virtual size: 3KB

48:04:2a:d2:76:ae:97:74:be:39:ab:b8:ac:3e:3a:da
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08
Certificate

ad:d2:3a:f6:dc:4a:e4:9f:f8:6f:3f:70:c1:be:a5:54:7d:e8:22:e9
Signer

.text
Size: 113KB - Virtual size: 112KB

.rdata
Size: 512B - Virtual size: 34B

.rdata3
Size: 20KB - Virtual size: 19KB

.rdata2
Size: 41KB - Virtual size: 41KB

.data
Size: 134KB - Virtual size: 134KB

.rdata5
Size: 449KB - Virtual size: 449KB

.rdata4
Size: 20KB - Virtual size: 19KB

.rsrc
Size: 2KB - Virtual size: 3KB