MosStorage[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

MosStorage.dll
Size

69KB
MD5

d876b7043feb0738b231a08c249efe32
SHA1

789c135d99522f52f77fb7031c77dff4f5dcc4ec
SHA256

198fea1f569edd8ca72da40fb2261630c0f88e313b2815719a501c5237305a02
SHA512

a688c58df25937aa9fdeeb445838621a6684437f873919bc8a7061b466816a24f01f3b95513d64c8ab6430181b018bdcd41f5f0c12dbb1af7d0a29c7420c4999
SSDEEP

1536:hjA0++3muwo3v4VHjSOi1ryZ0JFRegXHR9h0p8:1fNj3wZhQHHHr6p8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MosStorage.dll

Files

MosStorage.dll
.dll windows:10 windows x86 arch:x86

76f8c4cb2ebfc57b3ffbc9c4894ba81d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MosStorage.pdb

Imports

msvcp_win

?_Xinvalid_argument@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_message@std@@YAKKPADK@Z
?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__create_locale
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o__wtof_l
_o_free
_o_malloc
_o_memset
_o_rand
_o_srand
_o_strtoul
_o_terminate
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
wcsstr
__std_terminate
memmove

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
LoadLibraryExA
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObject
CreateMutexExW
InitializeCriticalSection
InitOnceBeginInitialize
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
InitOnceComplete

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

RaiseException
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
ResumeThread
SetThreadPriority
GetCurrentThreadId
CreateThread

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-com-l1-1-1

CoCreateGuid
StringFromGUID2
CoTaskMemFree
CLSIDFromString

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-file-l1-2-1

CreateFileW
FindNextFileW
FindFirstFileW
SetFileAttributesW
GetFileAttributesW
ReadFile
WriteFile
SetFilePointerEx
CreateDirectoryW
GetFileSizeEx
RemoveDirectoryW
GetVolumePathNameW
FindClose

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchCombine
PathAllocCanonicalize

api-ms-win-core-memory-l1-1-2

VirtualAlloc
VirtualQuery
VirtualProtect
VirtualFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-1

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead

api-ms-win-security-accesshlpr-l1-1-0

FreeTransientObjectSecurityDescriptor
QueryTransientObjectSecurityDescriptor

ztrace_maps

ZTraceReportPropagation
ZTraceInit
ZTraceClose
ZTraceReportOriginationNoThis
ZTraceReportOrigination
ZTraceReportIgnoreNoThis
ZTraceHelperNoThis
ZTraceReportPropagationNoThis

bcp47langs

GetUserLanguages

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

mapconfiguration

ConfigurationManager_Create

Exports

Exports

MosQueryAnyPackagesFromPath
MosQueryCatalogExists
MosQueryPackages
MosQueryPackagesFromPath
MosStorageDumpConfiguration
MosStorageEnsureIsAppContainerCompliant
MosStorageEnsureMapDataDirectory
MosStorageEnsureMapDataDirectoryReturnPath
MosStorageGetBrowseCacheSizeInMBytes
MosStorageGetCurrentLocation
MosStorageGetDataDirectory
MosStorageGetLocations
MosStorageGetMapDataMaxBrowseCacheSizeInBytes
MosStorageGetMapsRepairAttempts
MosStorageGetResourceDirectory
MosStorageGetStorageDeviceDataFromDeviceGuid
MosStorageGetStorageSizesInBytes
MosStorageGetSystemDataDirectory
MosStorageGetTotalMapDataInBytes
MosStorageGetWhetherSpaceAvailable
MosStorageIsStorageStateValid
MosStorageResetCacheValues
MosStorageResetPreferredLocationIfDefined
MosStorageResetPreferredLocationIfNotPresent
MosStorageSetLocation
MosStorageSetMapsRepairAttempts
MosStorageUseDefaultExternalStorage
MosStorageValidateLocation
MosStorage_SetServiceCallbacks

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

76f8c4cb2ebfc57b3ffbc9c4894ba81d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-interlocked-l1-2-0

api-ms-win-security-accesshlpr-l1-1-0

ztrace_maps

bcp47langs

api-ms-win-core-registry-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-apiquery-l1-1-0

mapconfiguration

Exports

Exports

Sections

.text Size: 57KB - Virtual size: 56KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 40B

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 57KB - Virtual size: 56KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 40B

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 3KB - Virtual size: 3KB