no_escape_all[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
no_escape_all.exe
Size 235KB
Sample260926-txde1axdkh
SHA256 b2950dd8c46d2dbfb2dcb4379eedbe3fe5e6bc0a13b6dbfc1e47983ba10b1399
MD5 a989efe907b65345da48f7b578454015
SHA1 393102020d038d3b2ff74b148b3625318a95a8f2
SHA512 21156fe3648810c9d29208c995f7713d19341abd22cca8db28f87c0096b8e7c9f135167c249a2932df1a6513000ddb216f6f0a7d2f6175fd6a152e437e98520d
SSDEEP 3072:EHISgZSkTacN9Qj4WF3hoWbexz7r0doFVLdZQDNdUfzXiJOkSh3:EHeSxsWM3z8do3LeN6hkSh
TLSH
T182342A469B92EFFBD910873588F70324BB35E1421B464FDB2E496130BF13BE94D66A48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
no_escape_all.exe

File Explorer

no_escape_all.exe

.exe 235KB

no_escape_all.exe

IMPHASH 7c28c0b2f3a04da10114c7b464e26a21
SHA256 b2950dd8c46d2dbfb2dcb4379eedbe3fe5e6bc0a13b6dbfc1e47983ba10b1399
MD5 a989efe907b65345da48f7b578454015
SHA1 393102020d038d3b2ff74b148b3625318a95a8f2
SHA512 21156fe3648810c9d29208c995f7713d19341abd22cca8db28f87c0096b8e7c9f135167c249a2932df1a6513000ddb216f6f0a7d2f6175fd6a152e437e98520d
SSDEEP 3072:EHISgZSkTacN9Qj4WF3hoWbexz7r0doFVLdZQDNdUfzXiJOkSh3:EHeSxsWM3z8do3LeN6hkSh
TLSH
T182342A469B92EFFBD910873588F70324BB35E1421B464FDB2E496130BF13BE94D66A48
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iphlpapi

FlushIpNetTable

advapi32

CloseServiceHandle ControlService CreateServiceA DeleteService OpenSCManagerA OpenServiceA RegCloseKey RegCreateKeyExA RegOpenKeyA RegSetValueExA StartServiceA

user32

CreateWindowExA DestroyWindow DispatchMessageA DrawTextA FillRect GetClientRect GetDC GetMessageA GetSystemMetrics KillTimer MessageBoxA ReleaseDC SendInput SetLayeredWindowAttributes SetTimer TranslateMessage

kernel32

CheckRemoteDebuggerPresent CloseHandle CreateFileA CreateProcessA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCPInfo GetCurrentProcess GetCurrentProcessId GetDiskFreeSpaceExA GetFirmwareEnvironmentVariableA GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetSystemDirectoryA GetSystemInfo GetThreadContext GlobalMemoryStatusEx InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryA MultiByteToWideChar ReadFile ResumeThread SetConsoleCtrlHandler SetFileAttributesA SetFilePointer SetFirmwareEnvironmentVariableA SetThreadContext SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAlloc VirtualAllocEx VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode atexit _errno _exit _fmode _initterm _time64 abort calloc exit fflush fprintf fputc free localeconv malloc memcpy memset rand setvbuf srand strerror strlen strncmp system vfprintf wcslen

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkColor SetBkMode SetTextColor

Name

.text

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

no_escape_all.exe

iphlpapi

advapi32

user32

kernel32

msvcrt

gdi32

generic