bf19cdbcc1f0c033e4310aee1122d873274e4f438086c5c7a7a89281e3ea908c

Sharing

Copy URL Twitter E-mail

General

Target
bf19cdbcc1f0c033e4310aee1122d873274e4f438086c5c7a7a89281e3ea908c
Size 6.3MB
Sample260906-p5aa4abj2x
SHA256 bf19cdbcc1f0c033e4310aee1122d873274e4f438086c5c7a7a89281e3ea908c
MD5 684232c4692c2974e91c1c91b28559a1
SHA1 fa29a773e173814cb8f72032afed37e8765580c6
SHA512 c619645c569ecaa4899dec3962f28e5c291fefd25c47474afd430e0eeae189e7850400f81bb897ad491b712b233a0154dd970fd61f37c2f4c3d0eb04ac28c7a6
SSDEEP 98304:13/wvTwawYV00j9bZi+g0tCD9+NIOs/HG8uM5vKgHK6f2R6qd:NwNdZ3tszs6qd
TLSH
T16866AD11B640C035ECE112B1E6FD7FBB482E6D281B5942D3A2D43D8DDAB11D33A7A687
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
sample	cryptone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf19cdbcc1f0c033e4310aee1122d873274e4f438086c5c7a7a89281e3ea908c

File Explorer

bf19cdbcc1f0c033e4310aee1122d873274e4f438086c5c7a7a89281e3ea908c

.exe 6.3MB

bf19cdbcc1f0c033e4310aee1122d873274e4f438086c5c7a7a89281e3ea908c

IMPHASH e99c032cd8766dce65cbe5b00e03b56b
SHA256 bf19cdbcc1f0c033e4310aee1122d873274e4f438086c5c7a7a89281e3ea908c
MD5 684232c4692c2974e91c1c91b28559a1
SHA1 fa29a773e173814cb8f72032afed37e8765580c6
SHA512 c619645c569ecaa4899dec3962f28e5c291fefd25c47474afd430e0eeae189e7850400f81bb897ad491b712b233a0154dd970fd61f37c2f4c3d0eb04ac28c7a6
SSDEEP 98304:13/wvTwawYV00j9bZi+g0tCD9+NIOs/HG8uM5vKgHK6f2R6qd:NwNdZ3tszs6qd
TLSH
T16866AD11B640C035ECE112B1E6FD7FBB482E6D281B5942D3A2D43D8DDAB11D33A7A687
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

cryptone packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3539409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeEndPeriod timeBeginPeriod timeGetDevCaps timeGetTime

advapi32

RegOpenKeyExA RegSaveKeyA RegEnumValueA RegLoadKeyA RegFlushKey RegConnectRegistryA RegDeleteValueA RegQueryInfoKeyA RegCreateKeyExA RegCreateKeyA RegEnumKeyExA OpenProcessToken AddAccessAllowedAce AddAccessDeniedAce AllocateAndInitializeSid FreeSid GetLengthSid GetTokenInformation InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityInfo CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegOpenKeyExW RegQueryValueExW SetEntriesInAclA GetSecurityInfo BuildTrusteeWithSidA RegQueryValueA RegQueryValueExA RegOpenKeyA RegDeleteKeyA RegSetValueExA RegSetValueA RegSetValueExW RegCreateKeyExW

imm32

ImmGetIMEFileNameA ImmGetContext ImmReleaseContext ImmAssociateContext ImmGetCompositionStringW ImmSetCompositionStringW ImmGetCandidateListW ImmGetConversionStatus ImmNotifyIME ImmGetOpenStatus ImmIsIME ImmSetConversionStatus

iphlpapi

IcmpCloseHandle IcmpCreateFile GetPerAdapterInfo GetAdaptersInfo GetIpNetTable IcmpSendEcho2

oleaut32

OleLoadPicture VariantClear SysFreeString

crypt32

CryptStringToBinaryA

shell32

ShellExecuteA SHFileOperationA SHGetSpecialFolderPathA ShellExecuteW SHGetFolderPathW

ws2_32

send select recv ioctlsocket connect closesocket __WSAFDIsSet inet_addr socket WSAGetLastError WSAStartup WSACleanup htons gethostbyname

shlwapi

PathRemoveFileSpecW

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

imagehlp

GetTimestampForLoadedLibrary EnumerateLoadedModules StackWalk

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpSendRequest WinHttpConnect WinHttpCloseHandle

user32

CharNextW GetClipboardData CloseClipboard OpenClipboard GetKeyboardLayout GetKeyboardLayoutNameA ReleaseDC GetDC PeekMessageA DispatchMessageA TranslateMessage GetMessageA LoadCursorA SetWindowLongA GetWindowLongA AdjustWindowRectEx GetWindowRect InvalidateRect DeleteMenu GetSystemMenu GetMenu MoveWindow DestroyWindow IsWindow CreateWindowExA RegisterClassA DefWindowProcA MessageBoxW LoadStringA CharNextExA ShowWindow SetCursorPos LoadImageA DestroyCursor SetCursor ShowCursor GetKeyState BlockInput SystemParametersInfoA LoadIconA FindWindowA GetCursorPos SetWindowPos FlashWindowEx PostQuitMessage GetAncestor EqualRect SetRect ScreenToClient GetForegroundWindow GetSystemMetrics ReleaseCapture SetCapture GetCapture SetFocus CharPrevExA OffsetRect ClientToScreen GetClientRect GetAsyncKeyState EnumDisplayMonitors WindowFromPoint EnumWindows GetWindowTextA SendMessageA MessageBoxA MonitorFromPoint GetMonitorInfoA CharPrevA ChangeDisplaySettingsA GetDoubleClickTime

gdi32

CreateCompatibleDC GetPixel GetObjectA GetStockObject EnumFontFamiliesExA CreateFontIndirectA DeleteObject DeleteDC GetTextExtentPoint32W SelectObject SetBkColor SetTextColor TextOutW GetTextExtentPoint32A SetBkMode GetCharABCWidthsFloatW GetDIBits CreateDIBSection TextOutA GetDeviceCaps

ole32

CreateStreamOnHGlobal CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance

kernel32

SetCurrentDirectoryA GetEnvironmentVariableA GetExitCodeProcess GetProcessTimes SetFileTime GenerateConsoleCtrlEvent SystemTimeToFileTime GetFullPathNameW SetErrorMode IsDBCSLeadByte GetConsoleOutputCP ResetEvent WaitNamedPipeW SetEnvironmentVariableA SetEndOfFile WriteConsoleW HeapReAlloc SetStdHandle GetCurrentDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW VirtualFree GetVersionExW UnregisterWaitEx InitializeSListHead GetFileAttributesExW MoveFileExW ReadConsoleW GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers SetConsoleCtrlHandler GetOEMCP GetACP IsValidCodePage HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW MoveFileW CompareStringW GetTimeFormatW GetDateFormatW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue CreateSemaphoreW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter GetCPInfo FileTimeToSystemTime PeekNamedPipe GetFileType GetFileInformationByHandle FileTimeToLocalFileTime ExitThread GetFullPathNameA GetDriveTypeW QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW MoveFileA CreatePipe GetVersion GetSystemTime ExpandEnvironmentStringsW LCMapStringW FlushViewOfFile GetStdHandle VirtualQuery GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA SetConsoleMode ReadConsoleInputW LockFileEx UnlockFileEx HeapCompact FindFirstFileExW FormatMessageA CreateFileA IsDebuggerPresent AreFileApisANSI GetModuleHandleExW RtlUnwind RaiseException GetCommandLineA CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryExA CreateToolhelp32Snapshot Module32First Module32Next FindClose FindFirstFileA FindNextFileA Sleep CreateThread OpenProcess ReadProcessMemory Process32First Process32Next VerSetConditionMask LoadLibraryA VerifyVersionInfoA MultiByteToWideChar Beep SystemTimeToTzSpecificLocalTime DeviceIoControl GetEnvironmentVariableW SetEnvironmentVariableW CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW GetTempPathW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA SetThreadPriority GetTickCount GetModuleFileNameW GetModuleHandleW GlobalAlloc GlobalLock GlobalUnlock GlobalFree WaitForMultipleObjects LoadLibraryW WideCharToMultiByte SetFileAttributesA GetFileAttributesExA TerminateProcess CreateDirectoryA SetCurrentDirectoryW GetCurrentDirectoryA CreateFileW ReadFile WriteFile CheckRemoteDebuggerPresent SetLastError QueryPerformanceCounter QueryPerformanceFrequency ExitProcess GetCurrentThread CreateProcessA CreateProcessW GetPriorityClass GetProcessId GetThreadContext GetSystemInfo GetSystemDirectoryW VirtualAlloc VirtualProtect GetModuleFileNameA LoadLibraryExW LocalFree lstrlenA GetPrivateProfileStringA SetDllDirectoryW K32GetModuleFileNameExA K32EnumDeviceDrivers K32GetDeviceDriverFileNameA DeleteFileA RemoveDirectoryA GetTempPathA GetFileSize MapViewOfFile UnmapViewOfFile CreateFileMappingA OutputDebugStringA GetFileAttributesA SetUnhandledExceptionFilter GetCurrentThreadId GetSystemDirectoryA WinExec SetFilePointer GetLocalTime GetVersionExA lstrlenW CompareStringA GetLocaleInfoA ReleaseSemaphore CreateSemaphoreA SetFilePointerEx GetStringTypeW GetSystemTimeAsFileTime DuplicateHandle GetExitCodeThread EncodePointer DecodePointer HeapValidate IsProcessorFeaturePresent

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

460KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

217KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=206, productName=VS2012 UPD3 build 60610, version=60610,

count=125, id=207, productName=VS2012 UPD3 build 60610, version=60610,

count=1, id=48, version=9044,

count=31, id=225, productName=VS2013 UPD2 build 30501, version=30501,

count=25, id=199, version=41118,

count=83, id=223, productName=VS2013 build 21005, version=21005,

count=3, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=62, productName=Unmarked objects (old),

count=35, id=203, version=65501,

count=523, id=1, productName=Unmarked objects,

count=4, id=206, version=65501,

count=331, id=224, productName=VS2013 build 21005, version=21005,

count=167, id=229, version=40629,

count=155, id=225, productName=VS2013 build 21005, version=21005,

count=3, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=326, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,