d05d47d12d553f360bb9378272963e691882268b1f450f13d2c229a4c928bf73

Sharing

Copy URL Twitter E-mail

General

Target
d05d47d12d553f360bb9378272963e691882268b1f450f13d2c229a4c928bf73
Size 420KB
Sample260908-apgynscb63
SHA256 d05d47d12d553f360bb9378272963e691882268b1f450f13d2c229a4c928bf73
MD5 8c3598dfd0aee57e4a43aea3276f844e
SHA1 38cdc658eb1b91283ccbf74feec38c782e25f80f
SHA512 4c4fca7daebd9e0586505778d4fcf206f2bf7c635a1e9cf026f69697c6042e4d1bf6ab2627251fb8d23f1eb7708101ff40f35ed3b286ec34382e3dc444a25dd1
SSDEEP 6144:24xlEgF0yrbegH9ZQIK3q6gK5WDxFHektdXXXXXXXXXXXXXXXXXXXXXXXXXXXXXB:f0Ubem9Ct6854tV5
TLSH
T17B949769EF72FF06C74B242D2444982FC1AF4E181DE1DE2EC350BF09859ABD0575E1AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
sample	cryptone

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d05d47d12d553f360bb9378272963e691882268b1f450f13d2c229a4c928bf73

File Explorer

d05d47d12d553f360bb9378272963e691882268b1f450f13d2c229a4c928bf73

.exe 420KB

d05d47d12d553f360bb9378272963e691882268b1f450f13d2c229a4c928bf73

IMPHASH 57c147a9bbc95fb84767ff1e061348f6
SHA256 d05d47d12d553f360bb9378272963e691882268b1f450f13d2c229a4c928bf73
MD5 8c3598dfd0aee57e4a43aea3276f844e
SHA1 38cdc658eb1b91283ccbf74feec38c782e25f80f
SHA512 4c4fca7daebd9e0586505778d4fcf206f2bf7c635a1e9cf026f69697c6042e4d1bf6ab2627251fb8d23f1eb7708101ff40f35ed3b286ec34382e3dc444a25dd1
SSDEEP 6144:24xlEgF0yrbegH9ZQIK3q6gK5WDxFHektdXXXXXXXXXXXXXXXXXXXXXXXXXXXXXB:f0Ubem9Ct6854tV5
TLSH
T17B949769EF72FF06C74B242D2444982FC1AF4E181DE1DE2EC350BF09859ABD0575E1AA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

CryptOne packer

Detects CryptOne packer defined in NCC blogpost.

cryptone packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

298992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetNumberOfConsoleMouseButtons lstrcatA IsValidLanguageGroup FreeResource IsDBCSLeadByte PostQueuedCompletionStatus GetConsoleMode DisableThreadLibraryCalls FindNextFileW GetVersion WaitForSingleObjectEx LCMapStringW WriteProfileSectionW GlobalFindAtomA CopyFileExA SetSystemPowerState SetMailslotInfo EnumSystemCodePagesW FindNextFileA GetThreadPriority EnumDateFormatsExW GlobalGetAtomNameW GetStartupInfoW GetProcessHeaps DebugBreak GetDiskFreeSpaceExW TryEnterCriticalSection SearchPathA GlobalUnlock UnregisterWait GetThreadTimes VirtualProtectEx GetLastError CreateMutexA ContinueDebugEvent ResumeThread OutputDebugStringA OutputDebugStringW SetThreadContext GetThreadContext WaitForDebugEvent WriteProcessMemory UnmapViewOfFile InitializeCriticalSection FreeConsole CreateThread SuspendThread DebugActiveProcess SetEnvironmentVariableA GetCurrentProcessId MapViewOfFile DuplicateHandle GetCurrentProcess CreateFileMappingA GetVersionExA GetProcAddress LoadLibraryA GetEnvironmentVariableA VirtualProtect VirtualAlloc SetLastError ReleaseMutex WaitForSingleObject OpenMutexA SetErrorMode GetShortPathNameA GetModuleFileNameA GetShortPathNameW GetModuleFileNameW GlobalLock GlobalAlloc WideCharToMultiByte IsBadReadPtr GlobalAddAtomA GlobalAddAtomW GlobalFree GlobalGetAtomNameA GlobalDeleteAtom ExitProcess GetLocalTime MultiByteToWideChar GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW GetWindowsDirectoryA CreateFileA GetPrivateProfileStringA WritePrivateProfileStringA EnterCriticalSection MoveFileA CreateProcessA GetStartupInfoA GetCommandLineA GetCurrentThreadId ReadFile GetFileSize GetProcessHeap FlushFileBuffers WriteConsoleW SetStdHandle GetConsoleCP SetFilePointer HeapReAlloc GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation LoadLibraryW FreeLibrary SetConsoleCtrlHandler FatalAppExitA IsValidCodePage GetOEMCP GetACP QueryPerformanceCounter HeapDestroy HeapCreate GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize GetLocaleInfoW GetStdHandle WriteFile IsProcessorFeaturePresent CompareStringW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo HeapAlloc GetDateFormatA GetTimeFormatA GetModuleHandleW HeapFree GetSystemTimeAsFileTime RaiseException ReadProcessMemory LeaveCriticalSection GetExitCodeProcess GetCurrentThread SetThreadPriority Sleep GetTickCount VirtualQueryEx CreateEventA SetEvent CloseHandle GetModuleHandleA DeleteFileA GetCommandLineW RtlUnwind FormatMessageA InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange DeleteCriticalSection SetEndOfFile SetFilePointerEx CreateFileW FindClose RemoveDirectoryW DeleteFileW DeviceIoControl GetFullPathNameW FindFirstFileW GetFileAttributesW CreateDirectoryExW CopyFileW GetCurrentDirectoryW SetCurrentDirectoryW GetFileInformationByHandle GetFileAttributesExW GetFileTime SetFileTime MoveFileExW CreateDirectoryW AreFileApisANSI LocalFree

user32

ChildWindowFromPointEx UnpackDDElParam GetMenuContextHelpId MapVirtualKeyExA IsZoomed GetClassNameA GetClassInfoExW CharToOemBuffW DialogBoxParamA DialogBoxIndirectParamA EndPaint CountClipboardFormats IsCharAlphaA SystemParametersInfoW FlashWindow DdeReconnect RemoveMenu SetDebugErrorLevel DdeFreeDataHandle GetWindowLongW AdjustWindowRectEx DdeGetLastError RegisterWindowMessageW GetMenuStringW GetWindowTextA InvalidateRgn PtInRect GetShellWindow SetTimer EnumThreadWindows CharUpperW GetWindowWord BeginPaint KillTimer GetAsyncKeyState DefDlgProcA DrawTextA CreateDialogParamA RegisterClassExA GetWindowTextLengthA SetWindowTextA GetDlgItem CreateDialogIndirectParamA ShowWindow UpdateWindow InSendMessage FreeDDElParam DefWindowProcW DefWindowProcA LoadCursorA RegisterClassW CreateWindowExW RegisterClassA CreateWindowExA GetWindowThreadProcessId SendMessageW PeekMessageA EnumWindows IsWindowUnicode PackDDElParam PostMessageW PostMessageA IsWindow LoadStringA LoadStringW FindWindowA DestroyWindow GetDesktopWindow GetSystemMetrics MoveWindow SendMessageA SetPropA GetPropA WaitForInputIdle GetMessageA TranslateMessage DispatchMessageA MessageBoxA GetKeyState GetMessageExtraInfo GetForegroundWindow GetMenuItemCount GetKBCodePage GetMessageTime GetKeyboardType DestroyCursor GetMenuCheckMarkDimensions IsClipboardFormatAvailable GetClipboardData IsCharAlphaNumericA IsWindowEnabled GetMenu VkKeyScanA IsMenu PaintDesktop

gdi32

RestoreDC PolylineTo BeginPath RectInRegion PATHOBJ_vEnumStart GdiGetLocalDC GdiGetCodePage EngFillPath GetPaletteEntries CheckColorsInGamut SetPaletteEntries CreateHatchBrush GetBitmapBits GetStretchBltMode SelectObject BitBlt DeleteObject CreatePalette CreateDCA SelectPalette RealizePalette CreateDIBitmap DeleteDC CreateCompatibleDC GetStockObject GetEnhMetaFileBits CreateMetaFileW WidenPath GetFontLanguageInfo GetBkColor CreateMetaFileA EndPage GetTextColor GetDCPenColor AddFontResourceA CloseFigure

advapi32

RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegDeleteKeyW RegCloseKey GetUserNameW StartServiceW OpenServiceW OpenSCManagerW CloseServiceHandle CryptVerifySignatureW CryptDestroyHash CryptHashData CryptCreateHash CryptImportKey CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegOpenKeyA

shell32

SHGetFolderPathW SHAppBarMessage SHChangeNotify DragAcceptFiles SHLoadNonloadedIconOverlayIdentifiers ShellExecuteW SHGetMalloc SHFreeNameMappings SHBrowseForFolder ExtractIconExW SHGetInstanceExplorer SHBrowseForFolderW SHGetPathFromIDListA DragQueryFileA SHCreateProcessAsUserW SHEmptyRecycleBinA SHGetDataFromIDListW SHAddToRecentDocs Shell_NotifyIcon Shell_NotifyIconW ShellAboutW SHGetIconOverlayIndexW Shell_NotifyIconA DragQueryFileAorW ShellHookProc SHInvokePrinterCommandA SHIsFileAvailableOffline SHFileOperationA SHGetSpecialFolderPathA

shlwapi

StrRChrA StrRStrIW StrCmpNIA StrChrIA StrStrA StrChrIW StrChrA

Sharing

General

Malware Config

Signatures

File Explorer

d05d47d12d553f360bb9378272963e691882268b1f450f13d2c229a4c928bf73

kernel32

user32

gdi32

advapi32

shell32

shlwapi

generic