c98003304c415872d6b65703abc6a9b1e9d2a683e4fe96018a6c2d3f0c2a35fc

Sharing

Copy URL Twitter E-mail

General

Target
c98003304c415872d6b65703abc6a9b1e9d2a683e4fe96018a6c2d3f0c2a35fc
Size 6.3MB
Sample260906-pc2jwathkd
SHA256 c98003304c415872d6b65703abc6a9b1e9d2a683e4fe96018a6c2d3f0c2a35fc
MD5 839da19d59c523db3ac5d465434480e3
SHA1 25360271696c1976125781a6992905e2c55664e2
SHA512 8d6931f38233af8095d72c33d300dbd87e89d9731d962dc0ac77adc9b6199c2ccc498fcf26caafdc521dd22862464ea1f58e139734a86314a53d9b63d4bb8a3e
SSDEEP 98304:IFU4gz9h6MqH+96aMvii/sHDNsMwvNgD42RqXinI:4Y/65HSNFdI
TLSH
T1A566BD21B600C075EDE112B1E7FEAFBB883D6D241B5941D3A2D43D4CDAB11D23A7A687
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
sample	cryptone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c98003304c415872d6b65703abc6a9b1e9d2a683e4fe96018a6c2d3f0c2a35fc

File Explorer

c98003304c415872d6b65703abc6a9b1e9d2a683e4fe96018a6c2d3f0c2a35fc

.exe 6.3MB

c98003304c415872d6b65703abc6a9b1e9d2a683e4fe96018a6c2d3f0c2a35fc

IMPHASH 71bd6b887a04f4e09b633ad7fafc6b59
SHA256 c98003304c415872d6b65703abc6a9b1e9d2a683e4fe96018a6c2d3f0c2a35fc
MD5 839da19d59c523db3ac5d465434480e3
SHA1 25360271696c1976125781a6992905e2c55664e2
SHA512 8d6931f38233af8095d72c33d300dbd87e89d9731d962dc0ac77adc9b6199c2ccc498fcf26caafdc521dd22862464ea1f58e139734a86314a53d9b63d4bb8a3e
SSDEEP 98304:IFU4gz9h6MqH+96aMvii/sHDNsMwvNgD42RqXinI:4Y/65HSNFdI
TLSH
T1A566BD21B600C075EDE112B1E7FEAFBB883D6D241B5941D3A2D43D4CDAB11D23A7A687
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

cryptone packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3533583

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeEndPeriod timeBeginPeriod timeGetDevCaps timeGetTime

advapi32

RegOpenKeyExA RegSetValueExW RegDeleteValueA RegQueryValueA RegSaveKeyA RegEnumValueA RegQueryInfoKeyA RegCreateKeyExA RegCreateKeyA RegEnumKeyExA RegDeleteKeyA OpenProcessToken AllocateAndInitializeSid FreeSid GetTokenInformation SetSecurityInfo CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash SetEntriesInAclA BuildTrusteeWithSidA RegCloseKey RegOpenKeyExW RegQueryValueExW GetSecurityInfo RegQueryValueExA RegOpenKeyA RegSetValueExA RegSetValueA RegLoadKeyA RegFlushKey RegConnectRegistryA RegCreateKeyExW

imm32

ImmGetIMEFileNameA ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmNotifyIME ImmGetOpenStatus ImmIsIME ImmGetContext ImmSetConversionStatus

psapi

GetModuleInformation GetModuleFileNameExA EnumProcessModules

iphlpapi

GetPerAdapterInfo IcmpCreateFile IcmpCloseHandle IcmpSendEcho2 GetAdaptersInfo GetIpNetTable

oleaut32

VariantClear SysFreeString OleLoadPicture

crypt32

CryptStringToBinaryA

shell32

ShellExecuteA ShellExecuteW SHGetFolderPathW SHFileOperationA SHGetSpecialFolderPathA

ws2_32

connect closesocket __WSAFDIsSet inet_addr ioctlsocket recv select send socket WSAGetLastError WSAStartup WSACleanup htons gethostbyname

shlwapi

PathRemoveFileSpecW

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

imagehlp

GetTimestampForLoadedLibrary EnumerateLoadedModules StackWalk

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpOpen WinHttpCloseHandle WinHttpConnect

user32

GetKeyboardLayout GetKeyboardLayoutNameA ReleaseDC GetDC PeekMessageA DispatchMessageA TranslateMessage GetMessageA LoadCursorA SetWindowLongA GetWindowLongA AdjustWindowRectEx GetWindowRect InvalidateRect DeleteMenu GetSystemMenu GetMenu MoveWindow DestroyWindow IsWindow CreateWindowExA RegisterClassA DefWindowProcA MessageBoxW LoadStringA ChangeDisplaySettingsA ShowWindow OpenClipboard LoadImageA DestroyCursor SetCursor ShowCursor GetKeyState BlockInput SystemParametersInfoA LoadIconA FindWindowA GetCursorPos SetWindowPos FlashWindowEx PostQuitMessage GetAncestor EqualRect SetRect ScreenToClient GetForegroundWindow GetSystemMetrics ReleaseCapture SetCapture GetCapture SetFocus GetDoubleClickTime OffsetRect CloseClipboard GetClientRect GetAsyncKeyState SendMessageA MessageBoxA GetClipboardData CharNextW CharNextExA CharPrevExA MonitorFromPoint GetMonitorInfoA CharPrevA SetCursorPos ClientToScreen

gdi32

CreateCompatibleDC GetPixel DeleteDC GetDIBits GetObjectA GetTextExtentPoint32A GetStockObject EnumFontFamiliesExA CreateFontIndirectA DeleteObject GetCharABCWidthsFloatW GetTextExtentPoint32W SelectObject SetBkColor SetTextColor TextOutW SetBkMode CreateDIBSection TextOutA GetDeviceCaps

ole32

CreateStreamOnHGlobal CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance

kernel32

GetEnvironmentVariableA GetExitCodeProcess GetProcessTimes SetFileTime GenerateConsoleCtrlEvent SystemTimeToFileTime GetFullPathNameW SetErrorMode IsDBCSLeadByte GetConsoleOutputCP FormatMessageA ResetEvent WaitNamedPipeW SetCurrentDirectoryA SetEndOfFile WriteConsoleW HeapReAlloc SetStdHandle GetCurrentDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW VirtualFree GetVersionExW UnregisterWaitEx InitializeSListHead GetFileAttributesExW MoveFileExW ReadConsoleW GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers SetConsoleCtrlHandler GetOEMCP GetACP IsValidCodePage GetStdHandle HeapSize EnumSystemLocalesW GetUserDefaultLCID MoveFileW GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue CreateSemaphoreW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter GetCPInfo FileTimeToSystemTime PeekNamedPipe GetFileType GetFileInformationByHandle FileTimeToLocalFileTime ExitThread GetFullPathNameA GetDriveTypeW QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW AreFileApisANSI GetModuleHandleExW RtlUnwind RaiseException MoveFileA CreatePipe GetVersion GetSystemTime ExpandEnvironmentStringsW FlushViewOfFile IsValidLocale GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA SetConsoleMode ReadConsoleInputW LockFileEx UnlockFileEx HeapCompact FindFirstFileExW SetEnvironmentVariableA CreateFileA IsProcessorFeaturePresent GetCommandLineA CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryExA CreateToolhelp32Snapshot Module32First Module32Next FindClose FindFirstFileA FindNextFileA Sleep CreateThread OpenProcess ReadProcessMemory Process32First Process32Next VerSetConditionMask LoadLibraryA VerifyVersionInfoA MultiByteToWideChar Beep SystemTimeToTzSpecificLocalTime ReadFile IsDebuggerPresent CheckRemoteDebuggerPresent DuplicateHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitOnceExecuteOnce ExitProcess TerminateProcess GetCurrentThread GetCurrentThreadId OpenThread SetThreadPriority GetSystemInfo GetTickCount GetWindowsDirectoryA VirtualQuery GetModuleFileNameA LocalFree Thread32First Thread32Next DeviceIoControl GetEnvironmentVariableW SetEnvironmentVariableW CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW GetTempPathW DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA GetModuleFileNameW GetModuleHandleW GlobalAlloc GlobalLock GlobalUnlock GlobalFree WaitForMultipleObjects LoadLibraryW WideCharToMultiByte SetFileAttributesA GetFileAttributesExA CreateDirectoryA SetCurrentDirectoryW GetCurrentDirectoryA CreateFileW WriteFile SetLastError QueryPerformanceCounter QueryPerformanceFrequency CreateProcessA CreateProcessW GetPriorityClass GetProcessId GetThreadContext GetSystemDirectoryW VirtualAlloc VirtualProtect LoadLibraryExW lstrlenA GetPrivateProfileStringA SetDllDirectoryW K32GetModuleFileNameExA K32EnumDeviceDrivers K32GetDeviceDriverFileNameA DeleteFileA RemoveDirectoryA GetTempPathA GetFileSize MapViewOfFile UnmapViewOfFile CreateFileMappingA OutputDebugStringA GetFileAttributesA SetUnhandledExceptionFilter GetSystemDirectoryA WinExec SetFilePointer GetLocalTime GetVersionExA lstrlenW CompareStringA GetLocaleInfoA ReleaseSemaphore CreateSemaphoreA SetFilePointerEx GetStringTypeW GetSystemTimeAsFileTime GetExitCodeThread EncodePointer DecodePointer HeapValidate

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

460KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

217KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=206, productName=VS2012 UPD3 build 60610, version=60610,

count=125, id=207, productName=VS2012 UPD3 build 60610, version=60610,

count=1, id=48, version=9044,

count=31, id=225, productName=VS2013 UPD2 build 30501, version=30501,

count=25, id=199, version=41118,

count=83, id=223, productName=VS2013 build 21005, version=21005,

count=3, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=62, productName=Unmarked objects (old),

count=37, id=203, version=65501,

count=531, id=1, productName=Unmarked objects,

count=4, id=206, version=65501,

count=331, id=224, productName=VS2013 build 21005, version=21005,

count=167, id=229, version=40629,

count=155, id=225, productName=VS2013 build 21005, version=21005,

count=3, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=326, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,