AWayOut[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AWayOut.exe
Size 233.2MB
Sample260801-xa3cdstdne
SHA256 cece3d370f99abedb96ecba18d05e4a137c36db0e41fdeef1d5410476897ef60
MD5 de726d684c587a8b5849537427a5f430
SHA1 7a5c7522b3e97e9ed3c6c7e59f6d950ec08e1c69
SHA512 6d8db3ee2212b9174517fa6259d7f369b2abd545d5297be22bb330c5f9ddc68053e9144849816930abb3a78a9c4dd4d7792ecf73601f0c51421a9d144897d2f8
SSDEEP 3145728:JGB6LGUihHbNYlSX0VN8HdZ9NDoUmW73WvGLvAzZyo:Lg4rV29JGW7mGLYEo
TLSH
T1C5C8BDEBFAE620ADE4B7C3308535A16AD8B17A31133096EF91514396BD76ECC987C701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AWayOut.exe

File Explorer

AWayOut.exe

.exe 233.2MB

AWayOut.exe

IMPHASH 89006c0835da320be910f420551891b8
SHA256 cece3d370f99abedb96ecba18d05e4a137c36db0e41fdeef1d5410476897ef60
MD5 de726d684c587a8b5849537427a5f430
SHA1 7a5c7522b3e97e9ed3c6c7e59f6d950ec08e1c69
SHA512 6d8db3ee2212b9174517fa6259d7f369b2abd545d5297be22bb330c5f9ddc68053e9144849816930abb3a78a9c4dd4d7792ecf73601f0c51421a9d144897d2f8
SSDEEP 3145728:JGB6LGUihHbNYlSX0VN8HdZ9NDoUmW73WvGLvAzZyo:Lg4rV29JGW7mGLYEo
TLSH
T1C5C8BDEBFAE620ADE4B7C3308535A16AD8B17A31133096EF91514396BD76ECC987C701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

247799840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegSetValueExW

api-ms-win-crt-convert-l1-1-0

_itoa_s _strtoui64 _wcstoui64 _wtof _wtoi _wtoi64 atof atoi strtod strtoul wcstod wcstoul

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-heap-l1-1-0

_aligned_malloc calloc free malloc realloc _aligned_free

api-ms-win-crt-math-l1-1-0

_finite _fpclass _isnan ceil floor frexp ldexp log2f modf roundf

api-ms-win-crt-runtime-l1-1-0

_beginthread _beginthreadex _errno _invalid_parameter_noinfo_noreturn _set_invalid_parameter_handler strerror __sys_nerr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf __stdio_common_vswprintf_s _read _write fclose fgets fopen fopen_s fputc fread fseek ftell fwrite

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _strnicmp _wcsnicmp isdigit isspace isupper iswalnum iswalpha iswdigit iswspace isxdigit strcpy_s strncpy tolower toupper towlower towupper wcslen wcsncmp wcsncpy

api-ms-win-crt-time-l1-1-0

__timezone __tzname _ftime64_s _gmtime64 _localtime64 _mktime64 _time64 _tzset strftime

api-ms-win-crt-utility-l1-1-0

qsort rand srand bsearch

dbghelp

StackWalk64 SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64 SymGetModuleInfo64 SymGetSymFromAddr64

dwmapi

DwmFlush DwmGetCompositionTimingInfo DwmIsCompositionEnabled

gdi32

CreateFontIndirectW DeleteObject GetObjectW GetStockObject PtInRegion SwapBuffers CreateBitmap

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AttachConsole CloseHandle CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateMutexA CreateMutexW CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FindResourceW FormatMessageA FormatMessageW FreeConsole FreeLibrary GetCommandLineW GetComputerNameW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileSizeEx GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleW GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessHeap GetProcessTimes GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetThreadContext GetTickCount GetTickCount64 GetTimeZoneInformation GetUserDefaultLocaleName GetVersionExW GlobalAlloc GlobalLock GlobalMemoryStatus GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSRWLock LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile MoveFileW MultiByteToWideChar OpenThread OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlVirtualUnwind SetConsoleTextAttribute SetCriticalSectionSpinCount SetEvent SetFileAttributesW SetLastError SetThreadAffinityMask SetThreadIdealProcessor SetThreadPriority SetThreadPriorityBoost SizeofResource Sleep SleepEx SuspendThread SwitchToThread SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VerSetConditionMask VerifyVersionInfoA VerifyVersionInfoW VirtualProtect WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile lstrlenA

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??_7ios_base@std@@6B@ ?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z _Inf

normaliz

IdnToAscii

ole32

CoCreateInstance CoInitialize CoTaskMemFree CoUninitialize IIDFromString OleInitialize OleUninitialize

oleaut32

VariantCopy

opengl32

wglCreateContext wglDeleteContext wglGetCurrentContext wglGetCurrentDC wglGetProcAddress wglMakeCurrent

shell32

SHGetFolderPathW ShellExecuteW CommandLineToArgvW

user32

AdjustWindowRectEx ChangeDisplaySettingsExW ChangeDisplaySettingsW CloseClipboard CreateIconIndirect CreateWindowExW DestroyWindow DisableProcessWindowsGhosting DispatchMessageW EmptyClipboard EnumDisplayDevicesA EnumDisplaySettingsW GetActiveWindow GetAsyncKeyState GetClientRect GetCursorPos GetDC GetFocus GetForegroundWindow GetKeyState GetKeyboardLayout GetMonitorInfoW GetParent GetSystemMetrics GetWindowInfo GetWindowLongW GetWindowPlacement GetWindowRect GetWindowThreadProcessId IsChild IsIconic IsWindowEnabled IsZoomed LoadCursorW LoadIconW LoadImageW MapVirtualKeyW MessageBoxW MonitorFromRect MonitorFromWindow OpenClipboard PeekMessageW PostMessageW PostQuitMessage RegisterClassW RegisterRawInputDevices ReleaseDC SendInput SetClipboardData SetFocus SetLayeredWindowAttributes SetParent SetWindowPos SetWindowRgn SetWindowTextW ShowCursor ShowWindow SystemParametersInfoW TranslateMessage UnregisterClassW UpdateWindow WindowFromPoint

vcruntime140

__std_exception_copy __std_exception_destroy __std_type_info_compare __std_type_info_name _set_purecall_handler memmove strchr strrchr strstr wcschr wcsstr

wininet

HttpQueryInfoW InternetAttemptConnect InternetCloseHandle InternetGetConnectedState InternetOpenW InternetReadFile InternetSetOptionW InternetSetStatusCallbackW

winmm

timeGetDevCaps timeGetTime waveInMessage waveOutMessage timeBeginPeriod

ws2_32

accept ioctlsocket WSAGetLastError WSAStartup WSACleanup listen ntohl ntohs recv recvfrom select send bind sendto setsockopt shutdown socket closesocket connect getpeername gethostname getsockname getsockopt htonl htons freeaddrinfo getaddrinfo inet_pton

x3daudio1_7

X3DAudioInitialize

AmdPowerXpressRequestHighPerformance GetDenuvoTicketLocation GetDenuvoTimeTicketRequest NvOptimusEnablement OriginAcceptFriendInvite OriginAcceptFriendInviteSync OriginAcceptInvite OriginAcceptInviteSync OriginAddEvent OriginAddEventParameter OriginAddRecentPlayers OriginAddRecentPlayersSync OriginAreChunksInstalled OriginAreChunksInstalledSync OriginBlockUser OriginBlockUserSync OriginBroadcastCheckStatus OriginBroadcastStart OriginBroadcastStop OriginCheckOnline OriginCheckPermission OriginCheckout OriginCheckoutSync OriginConsumeEntitlement OriginConsumeEntitlementSync OriginCreateChunk OriginCreateChunkSync OriginCreateEventRecord OriginCreateGroup OriginCreateGroupSync OriginDestroyHandle OriginEnableDebug OriginEnableVoip OriginEnableVoipSync OriginEnterGroup OriginEnterGroupSync OriginGetAllGameInfo OriginGetAllGameInfoSync OriginGetCatalog OriginGetCatalogSync OriginGetChunkPriority OriginGetChunkPrioritySync OriginGetDefaultPersona OriginGetDefaultUser OriginGetEnumerateStatus OriginGetErrorDescription OriginGetErrorInfo OriginGetGameInfo OriginGetGameInfoSync OriginGetGroupInfo OriginGetGroupInfoSync OriginGetPresence OriginGetPresenceVisibility OriginGetProfile OriginGetProfileSync OriginGetSetting OriginGetSettingSync OriginGetSettings OriginGetSettingsSync OriginGetStore OriginGetStoreSync OriginGetUTCTime OriginGetVoipStatus OriginGetVoipStatusSync OriginGetWalletBalance OriginGetWalletBalanceSync OriginGoOnline OriginGrantAchievement OriginGrantAchievementSync OriginHookDebug OriginInviteUsersToGroup OriginInviteUsersToGroupSync OriginIsFileDownloaded OriginIsFileDownloadedSync OriginIsProgressiveInstallationAvailable OriginIsProgressiveInstallationAvailableSync OriginLeaveGroup OriginLeaveGroupSync OriginMuteUser OriginMuteUserSync OriginPostAchievementEvents OriginPostAchievementEventsSync OriginPostWincodes OriginPostWincodesSync OriginQueryAchievements OriginQueryAchievementsSync OriginQueryAreFriends OriginQueryAreFriendsSync OriginQueryBlockedUsers OriginQueryBlockedUsersSync OriginQueryCategories OriginQueryCategoriesSync OriginQueryChunkFiles OriginQueryChunkFilesSync OriginQueryChunkStatus OriginQueryChunkStatusSync OriginQueryContent OriginQueryContentSync OriginQueryEntitlements OriginQueryEntitlementsEX OriginQueryEntitlementsSync OriginQueryEntitlementsSyncEX OriginQueryFriends OriginQueryFriendsSync OriginQueryGroup OriginQueryGroupSync OriginQueryImage OriginQueryImageSync OriginQueryManifest OriginQueryManifestSync OriginQueryMuteState OriginQueryMuteStateSync OriginQueryOffers OriginQueryOffersEX OriginQueryOffersSync OriginQueryOffersSyncEX OriginQueryPresence OriginQueryPresenceSync OriginQueryUserId OriginQueryUserIdSync OriginReadEnumeration OriginReadEnumerationSync OriginRegisterErrorCallback OriginRegisterEventCallback OriginRemoveFriend OriginRemoveFriendSync OriginRemoveUsersFromGroup OriginRemoveUsersFromGroupSync OriginRequestAuthCode OriginRequestAuthCodeSync OriginRequestFriend OriginRequestFriendSync OriginRequestFriendUI OriginRequestFriendUISync OriginRequestTicket OriginRequestTicketSync OriginResetMemory OriginRestartGame OriginRestartGameSync OriginSelectInstance OriginSelectStore OriginSelectStoreEX OriginSendChatMessage OriginSendGameMessage OriginSendGroupGameInvite OriginSendGroupGameInviteSync OriginSendInvite OriginSendInviteSync OriginSetChunkPriority OriginSetChunkPrioritySync OriginSetDownloadUtilization OriginSetDownloadUtilizationSync OriginSetPresence OriginSetPresenceVisibility OriginSetupMemory OriginShowAchievementUI OriginShowAchievementUISync OriginShowBroadcastUI OriginShowBroadcastUISync OriginShowBrowserUI OriginShowBrowserUISync OriginShowChangeAvatarUI OriginShowChangeAvatarUISync OriginShowCheckoutUI OriginShowCheckoutUISync OriginShowCodeRedemptionUI OriginShowCodeRedemptionUISync OriginShowComposeChatUI OriginShowComposeChatUISync OriginShowFeedbackUI OriginShowFeedbackUISync OriginShowFindFriendsUI OriginShowFindFriendsUISync OriginShowFriendsProfileUI OriginShowFriendsProfileUISync OriginShowFriendsUI OriginShowFriendsUISync OriginShowGameDetailsUI OriginShowGameDetailsUISync OriginShowIGO OriginShowIGOSync OriginShowInviteUI OriginShowInviteUISync OriginShowLoginUI OriginShowLoginUISync OriginShowProfileUI OriginShowProfileUISync OriginShowRecentUI OriginShowRecentUISync OriginShowStoreUI OriginShowStoreUIEX OriginShowStoreUIEXSync OriginShowStoreUISync OriginShutdown OriginStartDownload OriginStartDownloadSync OriginStartGame OriginStartGameSync OriginStartup OriginSubscribePresence OriginUnblockUser OriginUnblockUserSync OriginUnregisterEventCallback OriginUnsubscribePresence OriginUpdate agsDeInit agsDriverExtensionsDX11_BeginUAVOverlap agsDriverExtensionsDX11_DeInit agsDriverExtensionsDX11_EndUAVOverlap agsDriverExtensionsDX11_GetMaxClipRects agsDriverExtensionsDX11_IASetPrimitiveTopology agsDriverExtensionsDX11_Init agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect agsDriverExtensionsDX11_MultiDrawInstancedIndirect agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect agsDriverExtensionsDX11_NumPendingAsyncCompileJobs agsDriverExtensionsDX11_SetClipRects agsDriverExtensionsDX11_SetDepthBounds agsDriverExtensionsDX11_SetDiskShaderCacheEnabled agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount agsDriverExtensionsDX11_SetViewBroadcastMasks agsGetCrossfireGPUCount agsInit agsSetDisplayMode opus_decode opus_decode_float opus_decoder_create opus_decoder_ctl opus_decoder_destroy opus_decoder_get_nb_samples opus_decoder_get_size opus_decoder_init opus_encode opus_encode_float opus_encoder_create opus_encoder_ctl opus_encoder_destroy opus_encoder_get_size opus_encoder_init opus_get_version_string opus_multistream_decode opus_multistream_decode_float opus_multistream_decoder_create opus_multistream_decoder_ctl opus_multistream_decoder_destroy opus_multistream_decoder_get_size opus_multistream_decoder_init opus_multistream_packet_pad opus_multistream_packet_unpad opus_packet_get_bandwidth opus_packet_get_nb_channels opus_packet_get_nb_frames opus_packet_get_nb_samples opus_packet_get_samples_per_frame opus_packet_pad opus_packet_parse opus_packet_unpad opus_pcm_soft_clip opus_repacketizer_cat opus_repacketizer_create opus_repacketizer_destroy opus_repacketizer_get_nb_frames opus_repacketizer_get_size opus_repacketizer_init opus_repacketizer_out opus_repacketizer_out_range opus_strerror

Name

.tls

Size

49.5MB

Virtual Size

49.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.code

Size

15.8MB

Virtual Size

15.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

547KB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sbss

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.trace

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.sdata

Size

32KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.xdata

Size

164.7MB

Virtual Size

164.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.srdata

Size

37KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xtls

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data1

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

24KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

332KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AWayOut.exe

advapi32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

dbghelp

dwmapi

gdi32

kernel32

msvcp140

normaliz

ole32

oleaut32

opengl32

shell32

user32

vcruntime140

wininet

winmm

ws2_32

x3daudio1_7

generic