No[.]Escape[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
No.Escape.exe
Size 1.0MB
Sample260828-e9xbbasyfs
SHA256 3f5bf1b4d86283396677cbfefcad89f72ecc50fd9c993b5f75812789f4d3d81f
MD5 2514103fef2220a3b084945380b5a700
SHA1 ef2a8291ce107b27c70e61ec7a3409ebe2a0821a
SHA512 56135fd329db8e5529e1adafbaeabb3ec2604eb5b6292ef877bf2af0f291f3ea1470b274de437cf08101a997a28ecb3cceb82405a472ee1644b17ecd078b3cef
SSDEEP 12288:3nnL32CPdWMpJsCaa7xGBW1Sg6edbjquhl0EQA5b:3D2yWMsCaaFQWvdnqVWb
TLSH
T1D435F013AA31CE7DDDAA54F4DDE74B0F856EE864369DED8F929233281E30BC07962141
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
No.Escape.exe

File Explorer

No.Escape.exe

.exe 1.0MB

No.Escape.exe

IMPHASH 38293fc0783d36a0ecbbfbc6a7d4eec9
SHA256 3f5bf1b4d86283396677cbfefcad89f72ecc50fd9c993b5f75812789f4d3d81f
MD5 2514103fef2220a3b084945380b5a700
SHA1 ef2a8291ce107b27c70e61ec7a3409ebe2a0821a
SHA512 56135fd329db8e5529e1adafbaeabb3ec2604eb5b6292ef877bf2af0f291f3ea1470b274de437cf08101a997a28ecb3cceb82405a472ee1644b17ecd078b3cef
SSDEEP 12288:3nnL32CPdWMpJsCaa7xGBW1Sg6edbjquhl0EQA5b:3D2yWMsCaaFQWvdnqVWb
TLSH
T1D435F013AA31CE7DDDAA54F4DDE74B0F856EE864369DED8F929233281E30BC07962141
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20375

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\source\repos\No Escape\Release\No Escape.pdb

kernel32

GetSystemDirectoryA TerminateThread LoadLibraryA DeleteFileA Process32FirstW CloseHandle CreateThread GetProcAddress ExitProcess CreateProcessW GetSystemTime CreateToolhelp32Snapshot SetFileAttributesW GetModuleHandleW CreateFileA IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter OpenProcess GetModuleHandleA WaitForSingleObject TerminateProcess WriteFile GetCurrentProcess Process32NextW CopyFileA GetStartupInfoW Sleep GetTickCount GetModuleFileNameA

user32

SetWindowPos GetDC FindWindowExW ExitWindowsEx SendMessageW GetSystemMetrics MessageBoxA SendInput ReleaseDC BlockInput GetAsyncKeyState FindWindowW SystemParametersInfoW FindWindowA UpdateWindow SetForegroundWindow

gdi32

SelectObject CreateSolidBrush BitBlt

advapi32

OpenProcessToken RegSetValueExA RegSetValueExW RegCreateKeyExA RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

msvcp140

?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ??Bid@locale@std@@QAEIXZ ?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?widen@?$ctype@_W@std@@QBE_WD@Z ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?id@?$ctype@_W@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?_Xlength_error@std@@YAXPBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?getloc@ios_base@std@@QBE?AVlocale@2@XZ

netapi32

NetUserSetInfo NetUserAdd NetLocalGroupAddMembers

ntdll

RtlAdjustPrivilege NtSetInformationProcess

vcruntime140

memset _except_handler4_common __current_exception _CxxThrowException __std_terminate __std_exception_copy __CxxFrameHandler3 memcpy __current_exception_context __std_exception_destroy memmove

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-stdio-l1-1-0

_set_fmode _fseeki64 fsetpos ungetc setvbuf fgetpos fopen __acrt_iob_func fflush fwrite __p__commode fgetwc __stdio_common_vfprintf fgetc ungetwc fputwc fclose

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-runtime-l1-1-0

_controlfp_s terminate _set_app_type _crt_atexit _configure_narrow_argv _initialize_narrow_environment _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _cexit _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn _seh_filter_exe _register_onexit_function _initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale