mobsync[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

mobsync.exe
Size

97KB
MD5

5990b373978022822c91c1b997b859aa
SHA1

e65d0219e0e0c7b564d7cc71a11f145a1ee7e358
SHA256

6e83030a6a3e447acb1d38cc07035c1fd5bd2c9e136a57ce99f3ac1be45a7d3d
SHA512

0ff669aa63d510a57ee834d0c9fba99faf2609a02765a8cf29befd29004ac7095ffb2a7b190e7723347941dee12be546ed55ec7558ca0c1c10f182b0b070a568
SSDEEP

1536:Egi6A/6n66FHGYzkZup0ZBN2GPoCGVjGWmt8CXZ+63x+w4JD+0NL+fK:ni6Bn66NYj2GPo9St8WHxSD+09+S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mobsync.exe

Files

mobsync.exe
.exe windows:10 windows x64 arch:x64

Password: 1

f247d587e13b170d2246bd033539dbfb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

mobsync.pdb

Imports

advapi32

GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceLoggerHandle

kernel32

lstrlenW
LocalAlloc
LocalFree
GetCommandLineW
HeapSetInformation
ResolveDelayLoadedAPI
DelayLoadFailureHook

user32

GetMessageW
TranslateMessage
DispatchMessageW

msvcrt

?terminate@@YAXXZ
_lock
_initterm
_commode
_fmode
__setusermatherr
_cexit
_unlock
__dllonexit
__C_specific_handler
_wcmdln
_onexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcsstr
towupper
wcschr
_vsnwprintf
memcpy_s
memset

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoInitializeEx
CoUninitialize

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetStartupInfoW
GetCurrentProcessId

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameA
GetProcAddress

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
CreateSemaphoreExW
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSemaphore
CreateMutexExW
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

shell32

CommandLineToArgvW

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 1

f247d587e13b170d2246bd033539dbfb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

shell32

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 1024B - Virtual size: 876B

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 69KB - Virtual size: 68KB

.reloc Size: 512B - Virtual size: 88B

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 1024B - Virtual size: 876B

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 69KB - Virtual size: 68KB

.reloc
Size: 512B - Virtual size: 88B