3ced78b45d457c3b10ec16519f9e4b8a246d6d090c91e2d4065659ef95af641f

General

Target
3ced78b45d457c3b10ec16519f9e4b8a246d6d090c91e2d4065659ef95af641f
Size 78KB
Sample260812-pd7ghstwe1
SHA256 3ced78b45d457c3b10ec16519f9e4b8a246d6d090c91e2d4065659ef95af641f
MD5 c8cec089e69e37ff927dfa135237d9ae
SHA1 f2568ce8a0f0d101b2230929d2e65250be524b04
SHA512 12fc0ff4e9793322b22581383a2cc18e468ab3b2576f5d684b6a9fecbef27affd5176afd8ad9e11662a1dba6954f8eee22a4cb319ff94ca99a08ad91eef61ce0
SSDEEP 1536:d6UvHFfDMH1eUJpO7BwG0UJM7PaOxRbftdhBo3fxcO6eIVQu4OxnC:d6GYVdS7Bx04wxBbhi3ZcZ94OE
TLSH
T13673027494CD3DCD11EA34227BCE970456C2A228E55438EE49ED7C6E8D5CE483A29F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
static1/unpack001/5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe	cryptone

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe

File Explorer

3ced78b45d457c3b10ec16519f9e4b8a246d6d090c91e2d4065659ef95af641f

.zip 78KB
5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe

.exe 1.0MB

3ced78b45d457c3b10ec16519f9e4b8a246d6d090c91e2d4065659ef95af641f

SHA256 3ced78b45d457c3b10ec16519f9e4b8a246d6d090c91e2d4065659ef95af641f
MD5 c8cec089e69e37ff927dfa135237d9ae
SHA1 f2568ce8a0f0d101b2230929d2e65250be524b04
SHA512 12fc0ff4e9793322b22581383a2cc18e468ab3b2576f5d684b6a9fecbef27affd5176afd8ad9e11662a1dba6954f8eee22a4cb319ff94ca99a08ad91eef61ce0
SSDEEP 1536:d6UvHFfDMH1eUJpO7BwG0UJM7PaOxRbftdhBo3fxcO6eIVQu4OxnC:d6GYVdS7Bx04wxBbhi3ZcZ94OE
TLSH
T13673027494CD3DCD11EA34227BCE970456C2A228E55438EE49ED7C6E8D5CE483A29F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe

IMPHASH 227c7a3a12a7d92ffc2eaa1a92fda3d6
SHA256 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367
MD5 572fea5f025df78f2d316216fbeee52e
SHA1 91b2bf44b1f9282c09f07f16631deaa3ad9d956d
SHA512 eb238272227c5825477ff1e37dc4f7e467665049d4db5649fff59c39d7745e88b06234d6d1218c05c802e33e21577f9d4a533cb9e23ebe6fb09654f97759c187
SSDEEP 1536:oqRaSoNRhXeFFIEuz29JfZsIzYJerU+zjqFeKUO1z1gZCHW8LiLrXz4HE7bhj5Bs:oqRa/fhGFIZyJfZsqCGez5W1Ekxj5+
TLSH
T165357C63A05CAEC4F82F56B08C880DF5A3C6BD93D9600B7731F4BFAA67B5E024716855
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

cryptone packer
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

74:2e:73:be:5b:80:41:bc:c0:bb:7d:62:40:a2:bc:a5:94:7f:e6:e7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

987824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

3ced78b45d457c3b10ec16519f9e4b8a246d6d090c91e2d4065659ef95af641f

5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

imm32

generic

Sharing

General

Malware Config

Signatures

File Explorer

3ced78b45d457c3b10ec16519f9e4b8a246d6d090c91e2d4065659ef95af641f

5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

imm32

generic