Static task
static1
Behavioral task
behavioral1
Sample
NoEscape.exe
Resource
win10-20220901-en
General
-
Target
NoEscape.zip
-
Size
616KB
-
MD5
ef4fdf65fc90bfda8d1d2ae6d20aff60
-
SHA1
9431227836440c78f12bfb2cb3247d59f4d4640b
-
SHA256
47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8
-
SHA512
6f560fa6dc34bfe508f03dabbc395d46a7b5ba9d398e03d27dbacce7451a3494fbf48ccb1234d40746ac7fe960a265776cb6474cf513adb8ccef36206a20cbe9
-
SSDEEP
12288:1PQuO1JLx2auoA82iqOxdOc7XPkmpOw6mqc5m937hnTMktj1H:1PVqJx2auYqw7dOw6mql3nNBd
Malware Config
Signatures
Files
-
NoEscape.zip.zip
Password: mysubsarethebest
-
NoEscape.exe.exe windows x86
Password: mysubsarethebest
f400a8c725e9bcee856360087d72fec3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
netapi32
NetUserAdd
ntdll
RtlGetVersion
user32
GetDC
gdi32
BitBlt
advapi32
FreeSid
shell32
ShellExecuteW
ole32
CoTaskMemFree
bcrypt
BCryptGenRandom
vcruntime140
wcsstr
api-ms-win-crt-string-l1-1-0
wmemcpy_s
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Sections
.MPRESS1 Size: 609KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE