Static task
static1
Behavioral task
behavioral1
Sample
NoWayHomeDebug.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
NoWayHomeDebug.exe
Resource
win10v2004-20230621-en
General
-
Target
NoWayHomeDebug.exe
-
Size
54KB
-
MD5
1a0ec7b1ccb1adb0a4ef099b3a34ce4f
-
SHA1
2a849d090471f56ce14ab9f16efc7ee9c44912b1
-
SHA256
8e1421d288a33b697525ee93b9dff6d9933a5218e2b82cefc6fb333abd09360a
-
SHA512
f4447cff6c20374e9a13c018899fbb06acc1346f321329f713380eb4e20689e99ad9819064b913287e0a5538c62799051bb8620e2258962d1e57e69c5959c667
-
SSDEEP
1536:RKUqE8vGT9kAOtJ20NmTxFw/2fxLrsJFk:RdR8v6kAOO0Nm1mF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NoWayHomeDebug.exe
Files
-
NoWayHomeDebug.exe.exe windows x86
Password: infected
9ebdf62c92564447d4dfe642d70773b6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileAttributesW
CopyFileA
GetSystemDirectoryA
TerminateThread
Beep
ExitProcess
CreateFileA
GetSystemTime
lstrcatW
GetLastError
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetModuleHandleA
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
CreateFileW
LocalAlloc
FindClose
SetFilePointer
RemoveDirectoryW
WriteFile
GetCurrentProcess
GetSystemDirectoryW
GetModuleFileNameA
lstrcmpW
lstrcpyW
FreeLibrary
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
GetCurrentThreadId
DeleteFileW
FindNextFileW
GetModuleHandleW
FindFirstFileW
user32
MessageBoxA
ExitWindowsEx
SendInput
GetForegroundWindow
GetDesktopWindow
BlockInput
FindWindowA
SystemParametersInfoW
FindWindowExW
GetWindowRect
GetDC
SetWindowPos
SendMessageW
GetSystemMetrics
ShowWindow
UpdateWindow
SetForegroundWindow
FindWindowW
GetWindowDC
gdi32
BitBlt
SelectObject
PatBlt
StretchBlt
TextOutW
SetTextColor
LineTo
SetBkColor
CreateSolidBrush
RoundRect
advapi32
SetNamedSecurityInfoW
OpenProcessToken
SetEntriesInAclW
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExW
RegSetValueExA
RegSetValueExW
RegCreateKeyExA
RegCloseKey
shell32
ShellExecuteA
ntdll
NtSetInformationProcess
RtlAdjustPrivilege
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msvcp140
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
vcruntime140
__current_exception
__current_exception_context
_CxxThrowException
_except_handler4_common
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
memset
memcpy
memmove
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
__p__commode
fputc
_fseeki64
_set_fmode
ungetc
_get_stream_buffer_pointers
setvbuf
fgetpos
fwrite
fsetpos
fread
fgetc
fclose
fflush
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initterm
_configure_narrow_argv
exit
_exit
_set_app_type
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_invalid_parameter_noinfo_noreturn
_get_narrow_winmain_command_line
_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_crt_atexit
_controlfp_s
terminate
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ