General

Malware Config

Signatures

Files

• NoEscape.zip

  .zip

  Password: mysubsarethebest

• NoEscape.exe

  .exe windows x86

  Password: mysubsarethebest

  f400a8c725e9bcee856360087d72fec3

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  GetModuleHandleA

  GetProcAddress

  netapi32

  NetUserAdd

  ntdll

  RtlGetVersion

  user32

  GetDC

  gdi32

  BitBlt

  advapi32

  FreeSid

  shell32

  ShellExecuteW

  ole32

  CoTaskMemFree

  bcrypt

  BCryptGenRandom

  vcruntime140

  wcsstr

  api-ms-win-crt-string-l1-1-0

  wmemcpy_s

  api-ms-win-crt-runtime-l1-1-0

  exit

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-stdio-l1-1-0

  _set_fmode

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  api-ms-win-crt-heap-l1-1-0

  _set_new_mode

  Sections

  .MPRESS1

  Size: 609KB - Virtual size: 1.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .MPRESS2

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 18KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE