7dbf6a08b0748d6bf59d3645f52fc8aae79713224841376976f213f6f2c2a169

Sharing

Copy URL Twitter E-mail

General

Target
7dbf6a08b0748d6bf59d3645f52fc8aae79713224841376976f213f6f2c2a169
Size 6.3MB
Sample260906-pc33psba83
SHA256 7dbf6a08b0748d6bf59d3645f52fc8aae79713224841376976f213f6f2c2a169
MD5 9cae040fb7cd966e1a23b4144e409a3f
SHA1 9cfd6960a3931ba9ec4c755fd50a079a76ff95b8
SHA512 bc1880d663b6597f6c1225fb4185c459cc4aa2275aa0a6ba726c1950fefd9403e8c7c8e4a871c1b76bae89944065af3ddb9a96bfe98f1937e492ecd3ea2038b0
SSDEEP 196608:2qz/pWxOaqx6LHfPMYxSBrBEyMA6SHR4de7J1dccmNPHzfS3/ZgTZ2qxjap6qa9p:2qjpWxOaqx6LHfPMYxSBrBEyMA6SHR4B
TLSH
T12C66AD10B600C035EDE112B1E6FDBFBB446D6D581B2941D3A2D43D8EDAB11D23B7AA87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
sample	cryptone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7dbf6a08b0748d6bf59d3645f52fc8aae79713224841376976f213f6f2c2a169

File Explorer

7dbf6a08b0748d6bf59d3645f52fc8aae79713224841376976f213f6f2c2a169

.exe 6.3MB

7dbf6a08b0748d6bf59d3645f52fc8aae79713224841376976f213f6f2c2a169

IMPHASH 2627a86122f9aa7573ee4da8754a1e1d
SHA256 7dbf6a08b0748d6bf59d3645f52fc8aae79713224841376976f213f6f2c2a169
MD5 9cae040fb7cd966e1a23b4144e409a3f
SHA1 9cfd6960a3931ba9ec4c755fd50a079a76ff95b8
SHA512 bc1880d663b6597f6c1225fb4185c459cc4aa2275aa0a6ba726c1950fefd9403e8c7c8e4a871c1b76bae89944065af3ddb9a96bfe98f1937e492ecd3ea2038b0
SSDEEP 196608:2qz/pWxOaqx6LHfPMYxSBrBEyMA6SHR4de7J1dccmNPHzfS3/ZgTZ2qxjap6qa9p:2qjpWxOaqx6LHfPMYxSBrBEyMA6SHR4B
TLSH
T12C66AD10B600C035EDE112B1E6FDBFBB446D6D581B2941D3A2D43D8EDAB11D23B7AA87
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

cryptone packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3563655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeEndPeriod timeBeginPeriod timeGetDevCaps timeGetTime

advapi32

RegOpenKeyExA RegSetValueExW RegDeleteValueA RegQueryValueA RegSaveKeyA RegEnumValueA RegQueryInfoKeyA RegCreateKeyExA RegCreateKeyA RegEnumKeyExA RegDeleteKeyA OpenProcessToken AddAccessAllowedAce AddAccessDeniedAce AllocateAndInitializeSid FreeSid GetLengthSid GetTokenInformation InitializeAcl InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityInfo CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash SetEntriesInAclA BuildTrusteeWithSidA RegCloseKey RegOpenKeyExW RegQueryValueExW GetSecurityInfo RegQueryValueExA RegOpenKeyA RegSetValueExA RegSetValueA RegLoadKeyA RegFlushKey RegConnectRegistryA RegCreateKeyExW

imm32

ImmGetIMEFileNameA ImmGetConversionStatus ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmNotifyIME ImmGetOpenStatus ImmIsIME ImmGetContext ImmSetConversionStatus

psapi

GetModuleInformation GetModuleFileNameExA EnumProcessModules

iphlpapi

GetPerAdapterInfo IcmpCreateFile IcmpCloseHandle IcmpSendEcho2 GetAdaptersInfo GetIpNetTable

oleaut32

VariantClear SysFreeString OleLoadPicture

crypt32

CryptStringToBinaryA

shell32

ShellExecuteA ShellExecuteW SHGetFolderPathW SHFileOperationA SHGetSpecialFolderPathA

ws2_32

connect closesocket __WSAFDIsSet inet_addr ioctlsocket recv select send socket WSAGetLastError WSAStartup WSACleanup htons gethostbyname

shlwapi

PathRemoveFileSpecW

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

imagehlp

GetTimestampForLoadedLibrary EnumerateLoadedModules StackWalk

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpOpen WinHttpCloseHandle WinHttpConnect

user32

GetKeyboardLayout GetKeyboardLayoutNameA ReleaseDC GetDC PeekMessageA DispatchMessageA TranslateMessage GetMessageA LoadCursorA SetWindowLongA GetWindowLongA AdjustWindowRectEx GetWindowRect InvalidateRect DeleteMenu GetSystemMenu GetMenu MoveWindow DestroyWindow IsWindow CreateWindowExA RegisterClassA DefWindowProcA MessageBoxW LoadStringA ChangeDisplaySettingsA ShowWindow OpenClipboard LoadImageA DestroyCursor SetCursor ShowCursor GetKeyState BlockInput SystemParametersInfoA LoadIconA FindWindowA GetCursorPos SetWindowPos FlashWindowEx PostQuitMessage GetAncestor EqualRect SetRect ScreenToClient GetForegroundWindow GetSystemMetrics ReleaseCapture SetCapture GetCapture SetFocus GetDoubleClickTime OffsetRect CloseClipboard GetClientRect GetAsyncKeyState EnumDisplayMonitors WindowFromPoint EnumWindows GetWindowTextA SendMessageA MessageBoxA GetClipboardData CharNextW CharNextExA CharPrevExA MonitorFromPoint GetMonitorInfoA CharPrevA SetCursorPos ClientToScreen

gdi32

CreateCompatibleDC GetPixel DeleteDC GetDIBits GetObjectA GetTextExtentPoint32A GetStockObject EnumFontFamiliesExA CreateFontIndirectA DeleteObject GetCharABCWidthsFloatW GetTextExtentPoint32W SelectObject SetBkColor SetTextColor TextOutW SetBkMode CreateDIBSection TextOutA GetDeviceCaps

ole32

CreateStreamOnHGlobal CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance

kernel32

GetEnvironmentVariableA GetExitCodeProcess GetProcessTimes SetFileTime GenerateConsoleCtrlEvent SystemTimeToFileTime GetFullPathNameW SetErrorMode IsDBCSLeadByte GetConsoleOutputCP FormatMessageA ResetEvent WaitNamedPipeW SetCurrentDirectoryA SetEndOfFile WriteConsoleW HeapReAlloc SetStdHandle GetCurrentDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW VirtualFree GetVersionExW UnregisterWaitEx InitializeSListHead GetFileAttributesExW MoveFileExW ReadConsoleW GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers SetConsoleCtrlHandler GetOEMCP GetACP IsValidCodePage GetStdHandle HeapSize EnumSystemLocalesW GetUserDefaultLCID MoveFileW GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx CreateTimerQueue CreateSemaphoreW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter GetCPInfo FileTimeToSystemTime PeekNamedPipe GetFileType GetFileInformationByHandle FileTimeToLocalFileTime ExitThread GetFullPathNameA GetDriveTypeW QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW AreFileApisANSI GetModuleHandleExW RtlUnwind RaiseException MoveFileA CreatePipe GetVersion GetSystemTime ExpandEnvironmentStringsW FlushViewOfFile IsValidLocale GetNumberOfConsoleInputEvents PeekConsoleInputA ReadConsoleInputA SetConsoleMode ReadConsoleInputW LockFileEx UnlockFileEx HeapCompact FindFirstFileExW SetEnvironmentVariableA CreateFileA IsProcessorFeaturePresent GetCommandLineA CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryExA CreateToolhelp32Snapshot Module32First Module32Next FindClose FindFirstFileA FindNextFileA Sleep CreateThread OpenProcess ReadProcessMemory Process32First Process32Next VerSetConditionMask LoadLibraryA VerifyVersionInfoA MultiByteToWideChar Beep SystemTimeToTzSpecificLocalTime ReadFile IsDebuggerPresent CheckRemoteDebuggerPresent DuplicateHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitOnceExecuteOnce ExitProcess TerminateProcess GetCurrentThread GetCurrentThreadId OpenThread SetThreadPriority GetSystemInfo GetTickCount GetWindowsDirectoryA VirtualQuery GetModuleFileNameA LocalFree Thread32First Thread32Next DeviceIoControl GetEnvironmentVariableW SetEnvironmentVariableW CreateDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW GetTempPathW DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA GetModuleFileNameW GetModuleHandleW GlobalAlloc GlobalLock GlobalUnlock GlobalFree WaitForMultipleObjects LoadLibraryW WideCharToMultiByte SetFileAttributesA GetFileAttributesExA CreateDirectoryA SetCurrentDirectoryW GetCurrentDirectoryA CreateFileW WriteFile SetLastError QueryPerformanceCounter QueryPerformanceFrequency CreateProcessA CreateProcessW GetPriorityClass GetProcessId GetThreadContext GetSystemDirectoryW VirtualAlloc VirtualProtect LoadLibraryExW lstrlenA GetPrivateProfileStringA SetDllDirectoryW K32GetModuleFileNameExA K32EnumDeviceDrivers K32GetDeviceDriverFileNameA DeleteFileA RemoveDirectoryA GetTempPathA GetFileSize MapViewOfFile UnmapViewOfFile CreateFileMappingA OutputDebugStringA GetFileAttributesA SetUnhandledExceptionFilter GetSystemDirectoryA WinExec SetFilePointer GetLocalTime GetVersionExA lstrlenW CompareStringA GetLocaleInfoA ReleaseSemaphore CreateSemaphoreA SetFilePointerEx GetStringTypeW GetSystemTimeAsFileTime GetExitCodeThread EncodePointer DecodePointer HeapValidate

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

460KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

219KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=206, productName=VS2012 UPD3 build 60610, version=60610,

count=125, id=207, productName=VS2012 UPD3 build 60610, version=60610,

count=1, id=48, version=9044,

count=31, id=225, productName=VS2013 UPD2 build 30501, version=30501,

count=25, id=199, version=41118,

count=83, id=223, productName=VS2013 build 21005, version=21005,

count=3, id=28, version=9178,

count=76, id=29, version=9178,

count=1, id=18, version=8444,

count=62, productName=Unmarked objects (old),

count=37, id=203, version=65501,

count=531, id=1, productName=Unmarked objects,

count=4, id=206, version=65501,

count=331, id=224, productName=VS2013 build 21005, version=21005,

count=167, id=229, version=40629,

count=155, id=225, productName=VS2013 build 21005, version=21005,

count=3, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=326, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,