no_escape_all[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
no_escape_all.exe
Size 231KB
Sample260926-tt5ebafa73
SHA256 d8ec1113db9b006b3604da742d0bb265c7c2f66d40c0cab026f01c7072d8f57a
MD5 5176164f77097fa92ce9ce059e090d91
SHA1 d8bea56346699c9f47a6141f5d52af9c21a1ed2f
SHA512 be46b969e7bedac19f6c13eb678a928f4fae95f436465327a0f7cf38867b81dd8157b727c42f9c0908cf89985d9b75483fadf54ed232bf49ccb5cb88c6142ed1
SSDEEP 3072:xFrKNH3i++aHg1IGGFn0fWIe9JuyIXjkFxSdZQvw5UfzXiJjjhV:xAXiYGGYEJxGjkjSSw+ejH
TLSH
T1C0344B468B91DFFBD910873188F70724BB35E5421B428FDB2E496130BF13BE95DA6A48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
no_escape_all.exe

File Explorer

no_escape_all.exe

.exe 231KB

no_escape_all.exe

IMPHASH 2de5c5a48a55d11238a9b8243a7b3109
SHA256 d8ec1113db9b006b3604da742d0bb265c7c2f66d40c0cab026f01c7072d8f57a
MD5 5176164f77097fa92ce9ce059e090d91
SHA1 d8bea56346699c9f47a6141f5d52af9c21a1ed2f
SHA512 be46b969e7bedac19f6c13eb678a928f4fae95f436465327a0f7cf38867b81dd8157b727c42f9c0908cf89985d9b75483fadf54ed232bf49ccb5cb88c6142ed1
SSDEEP 3072:xFrKNH3i++aHg1IGGFn0fWIe9JuyIXjkFxSdZQvw5UfzXiJjjhV:xAXiYGGYEJxGjkjSSw+ejH
TLSH
T1C0344B468B91DFFBD910873188F70724BB35E5421B428FDB2E496130BF13BE95DA6A48
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iphlpapi

FlushIpNetTable

advapi32

CloseServiceHandle CreateServiceA OpenSCManagerA RegCloseKey RegCreateKeyExA RegOpenKeyA RegSetValueExA StartServiceA

user32

CreateWindowExA DestroyWindow DispatchMessageA DrawTextA FillRect GetClientRect GetDC GetMessageA GetSystemMetrics KillTimer MessageBoxA ReleaseDC SendInput SetLayeredWindowAttributes SetTimer TranslateMessage

kernel32

CheckRemoteDebuggerPresent CloseHandle CreateFileA CreateProcessA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCPInfo GetCurrentProcess GetCurrentProcessId GetDiskFreeSpaceExA GetFirmwareEnvironmentVariableA GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetSystemDirectoryA GetSystemInfo GetThreadContext GlobalMemoryStatusEx InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryA MultiByteToWideChar ReadFile ResumeThread SetConsoleCtrlHandler SetFileAttributesA SetFilePointer SetFirmwareEnvironmentVariableA SetThreadContext SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAlloc VirtualAllocEx VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode atexit _errno _exit _fmode _initterm _time64 abort calloc exit fflush fprintf fputc free localeconv malloc memcpy memset rand setvbuf srand strerror strlen strncmp system vfprintf wcslen

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkColor SetBkMode SetTextColor

Name

.text

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

no_escape_all.exe

iphlpapi

advapi32

user32

kernel32

msvcrt

gdi32

generic