D:\source\repos\No Escape\Release\No Escape.pdb
Static task
static1
Behavioral task
behavioral1
Sample
No.Escape.exe
Resource
win10v2004-20240221-en
General
-
Target
No.Escape.exe
-
Size
1.0MB
-
MD5
2514103fef2220a3b084945380b5a700
-
SHA1
ef2a8291ce107b27c70e61ec7a3409ebe2a0821a
-
SHA256
3f5bf1b4d86283396677cbfefcad89f72ecc50fd9c993b5f75812789f4d3d81f
-
SHA512
56135fd329db8e5529e1adafbaeabb3ec2604eb5b6292ef877bf2af0f291f3ea1470b274de437cf08101a997a28ecb3cceb82405a472ee1644b17ecd078b3cef
-
SSDEEP
12288:3nnL32CPdWMpJsCaa7xGBW1Sg6edbjquhl0EQA5b:3D2yWMsCaaFQWvdnqVWb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource No.Escape.exe
Files
-
No.Escape.exe.exe windows:6 windows x86 arch:x86
38293fc0783d36a0ecbbfbc6a7d4eec9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetSystemDirectoryA
TerminateThread
LoadLibraryA
DeleteFileA
Process32FirstW
CloseHandle
CreateThread
GetProcAddress
ExitProcess
CreateProcessW
GetSystemTime
CreateToolhelp32Snapshot
SetFileAttributesW
GetModuleHandleW
CreateFileA
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OpenProcess
GetModuleHandleA
WaitForSingleObject
TerminateProcess
WriteFile
GetCurrentProcess
Process32NextW
CopyFileA
GetStartupInfoW
Sleep
GetTickCount
GetModuleFileNameA
user32
SetWindowPos
GetDC
FindWindowExW
ExitWindowsEx
SendMessageW
GetSystemMetrics
MessageBoxA
SendInput
ReleaseDC
BlockInput
GetAsyncKeyState
FindWindowW
SystemParametersInfoW
FindWindowA
UpdateWindow
SetForegroundWindow
gdi32
SelectObject
CreateSolidBrush
BitBlt
advapi32
OpenProcessToken
RegSetValueExA
RegSetValueExW
RegCreateKeyExA
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExW
shell32
ShellExecuteW
ShellExecuteA
msvcp140
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Xlength_error@std@@YAXPBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
netapi32
NetUserSetInfo
NetUserAdd
NetLocalGroupAddMembers
ntdll
RtlAdjustPrivilege
NtSetInformationProcess
vcruntime140
memset
_except_handler4_common
__current_exception
_CxxThrowException
__std_terminate
__std_exception_copy
__CxxFrameHandler3
memcpy
__current_exception_context
__std_exception_destroy
memmove
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-stdio-l1-1-0
_set_fmode
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fopen
__acrt_iob_func
fflush
fwrite
__p__commode
fgetwc
__stdio_common_vfprintf
fgetc
ungetwc
fputwc
fclose
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_controlfp_s
terminate
_set_app_type
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
malloc
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 988KB - Virtual size: 989KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ