f695017c1b191d81d2716dfca14b63bc3a0142e28cd49b7eb12d83341dca2576

General

Target
f695017c1b191d81d2716dfca14b63bc3a0142e28cd49b7eb12d83341dca2576
Size 141KB
Sample260812-pderhatwes
SHA256 f695017c1b191d81d2716dfca14b63bc3a0142e28cd49b7eb12d83341dca2576
MD5 bd4354a813f890773f7514066bbc7918
SHA1 e107a6f8616536eb2338fd9666eeab4c66929dbb
SHA512 90d0558aed47d3d49e630bfc3d263b837a8256fd077c0e76c439d65d98e045d3d191554e918de8a28005b4a1b93453f5d9a36317f7ff0db02af7fe9b03cc3a13
SSDEEP 3072:VruNbUST6hMJN0xKHAQJ5dUTVewNPQHkPOhe0+R2H:wpUST5pgiUppcxH
TLSH
T108E312D548FBEC94A0120CD57F188AD9FC65F31B39540D00D6149E8A833AEEE5AE9E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
static1/unpack001/ed0632acb266a4ec3f51dd803c8025bccd654e53c64eb613e203c590897079b3.exe	cryptone

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/ed0632acb266a4ec3f51dd803c8025bccd654e53c64eb613e203c590897079b3.exe

File Explorer

f695017c1b191d81d2716dfca14b63bc3a0142e28cd49b7eb12d83341dca2576

.zip 141KB
ed0632acb266a4ec3f51dd803c8025bccd654e53c64eb613e203c590897079b3.exe

.exe 951KB

f695017c1b191d81d2716dfca14b63bc3a0142e28cd49b7eb12d83341dca2576

SHA256 f695017c1b191d81d2716dfca14b63bc3a0142e28cd49b7eb12d83341dca2576
MD5 bd4354a813f890773f7514066bbc7918
SHA1 e107a6f8616536eb2338fd9666eeab4c66929dbb
SHA512 90d0558aed47d3d49e630bfc3d263b837a8256fd077c0e76c439d65d98e045d3d191554e918de8a28005b4a1b93453f5d9a36317f7ff0db02af7fe9b03cc3a13
SSDEEP 3072:VruNbUST6hMJN0xKHAQJ5dUTVewNPQHkPOhe0+R2H:wpUST5pgiUppcxH
TLSH
T108E312D548FBEC94A0120CD57F188AD9FC65F31B39540D00D6149E8A833AEEE5AE9E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

ed0632acb266a4ec3f51dd803c8025bccd654e53c64eb613e203c590897079b3.exe

IMPHASH 4bb6b9b596884a0c90778c39e2bd91ba
SHA256 ed0632acb266a4ec3f51dd803c8025bccd654e53c64eb613e203c590897079b3
MD5 edbf07eaca4fff5f2d3f045567a9dc6f
SHA1 9292fa66c917bfa47e8012d302a69bec48e9b98c
SHA512 731214358d4fcecdafe0d386a305a130185727b20704e6251e37ac5feb35eff8f3f31d8c740954feb57c699cc5975c3bb50fac5c5202c5933c4fe0dfd06bc8e6
SSDEEP 3072:SLu8kCHp4EYPZE5CIv4Nc4GiM9vAZTponZNLQuHmmYxpwbvANK:38Z2E5biM9MTKnXLQuHmmaQvaK
TLSH
T14925BE52A697CCC5FC271470C91B8EF807E2FE46AF491B8B55C0BD7ABD307882B25661
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

cryptone packer
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

28:a8:c4:87:0d:08:76:53:53:39:0d:bb:96:a0:14:9b:0a:9d:de:8f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

837488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA SetEndOfFile GetProcessHeap HeapAlloc SetStdHandle GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA SetEnvironmentVariableA GetOEMCP GetACP CompareStringW CompareStringA GetCPInfo MultiByteToWideChar InterlockedIncrement InterlockedDecrement GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW WriteFile FlushFileBuffers SetFilePointer GetStartupInfoA SetHandleCount GetFileType UnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsGetValue SetLastError TlsAlloc RtlUnwind DeleteCriticalSection InitializeCriticalSection HeapReAlloc VirtualAlloc VirtualFree HeapCreate HeapDestroy GetVersionExA GetEnvironmentVariableA ExitProcess WideCharToMultiByte FreeEnvironmentStringsA FreeLibrary CreateMutexA WaitForSingleObject ReleaseMutex Sleep CloseHandle GetCurrentThread GetCurrentThreadId GetProcAddress GetLastError LoadLibraryA GetModuleFileNameA GetModuleHandleA GetVersion GetPrivateProfileStringA GetSystemTime WriteConsoleInputA GetStdHandle GlobalUnlock GlobalLock GlobalAlloc HeapFree ResumeThread CreateThread TlsSetValue ExitThread EnterCriticalSection LeaveCriticalSection ReadFile GetCommandLineA LoadLibraryExA

user32

LoadIconA LoadCursorFromFileW

gdi32

GetStockObject

advapi32

RegOpenKeyA

Sharing

General

Malware Config

Signatures

File Explorer

f695017c1b191d81d2716dfca14b63bc3a0142e28cd49b7eb12d83341dca2576

ed0632acb266a4ec3f51dd803c8025bccd654e53c64eb613e203c590897079b3.exe

PE Signature issue

kernel32

user32

gdi32

advapi32

generic