mobsync[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

mobsync.exe
Size

91KB
MD5

89abad52870b9df217a187cf87865880
SHA1

bfedde8411ad34bc2480e5d0dc9fc45673fe4f9c
SHA256

2455b74524ea8f12aee8c6b47ce9a463bfd1e1de1bdec0b2a60abd28bcf357e1
SHA512

973dc2a74278945c4ff94abe6a3b77230834145cde90ee2e5a6efa9a0d4eb25b883d01cdd9baf1fd150aec3e738c6d423be68cb02b834a309244c4ffb9e3f667
SSDEEP

1536:PfRhGe9h9GtoWGPoCGVjGWmt8CXZ+63x+w4JD+0NL+fKb:7M6WGPo9St8WHxSD+09+Sb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mobsync.exe

Files

mobsync.exe
.exe windows:10 windows x86

524fa5ae0e8f82398fe321af3a71e9ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage

kernel32

lstrlenW
LocalAlloc
LocalFree
GetCommandLineW
HeapSetInformation
ResolveDelayLoadedAPI
DelayLoadFailureHook

user32

GetMessageW
TranslateMessage
DispatchMessageW

msvcrt

_initterm
_wcmdln
?terminate@@YAXXZ
_controlfp
_except_handler4_common
__setusermatherr
_lock
__p__fmode
_cexit
_exit
_unlock
__dllonexit
_onexit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
wcsstr
towupper
wcschr
_vsnwprintf
memcpy_s
memset

api-ms-win-core-com-l1-1-1

CoUninitialize
CoInitializeEx
CoCreateInstance

api-ms-win-core-synch-l1-2-0

Sleep
ReleaseMutex
CreateMutexExW
CreateSemaphoreExW
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObject

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetStartupInfoW

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleA
GetProcAddress

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-registry-l1-1-0

RegEnumValueW
RegQueryInfoKeyW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-heap-l1-2-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

shell32

CommandLineToArgvW

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

524fa5ae0e8f82398fe321af3a71e9ea

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

msvcrt

api-ms-win-core-com-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

shell32

Sections

.text Size: 16KB - Virtual size: 15KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 69KB - Virtual size: 68KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 16KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 69KB - Virtual size: 68KB

.reloc
Size: 1KB - Virtual size: 1KB