MosStorage[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

MosStorage.dll
Size

69KB
MD5

f1d2eb5b79599e195f7eeba9ec0c2147
SHA1

62e9b44804ffc024f33bbfae376c34e11aceb9dd
SHA256

297844668b13859a1b60e86accfaf425b3cd2a5b72bf5f27400e4ed2a395fc02
SHA512

78a882641339d784d22bf67f680819b8c0e912a6ac1b348abc7de316bbfb212c44e3a7fc131677d33fd0632205cd24cc4095ed6e855c934b618c62cc7bf68fd1
SSDEEP

1536:ejcj++3muwo3v4VHjSOi1ryZ0JFRegEHR9h07R:a0Nj3wZhQH0Hr67R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MosStorage.dll

Files

MosStorage.dll
.dll windows:10 windows x86 arch:x86

76f8c4cb2ebfc57b3ffbc9c4894ba81d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MosStorage.pdb

Imports

msvcp_win

?_Xinvalid_argument@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_message@std@@YAKKPADK@Z
?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configure_narrow_argv
_o__create_locale
_o__crt_atexit
_o__errno
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memcpy
_o__wtof_l
_o_free
_o_malloc
_o_memset
_o_rand
_o_srand
_o_strtoul
_o_terminate
_except_handler4_common
_CxxThrowException
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__CxxFrameHandler3
wcsstr
__std_terminate
memmove

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
LoadLibraryExA
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObject
CreateMutexExW
InitializeCriticalSection
InitOnceBeginInitialize
EnterCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
InitOnceComplete

api-ms-win-core-heap-l1-2-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-1

RaiseException
SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
ResumeThread
SetThreadPriority
GetCurrentThreadId
CreateThread

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-debug-l1-1-1

OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-com-l1-1-1

CoCreateGuid
StringFromGUID2
CoTaskMemFree
CLSIDFromString

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-core-file-l1-2-1

CreateFileW
FindNextFileW
FindFirstFileW
SetFileAttributesW
GetFileAttributesW
ReadFile
WriteFile
SetFilePointerEx
CreateDirectoryW
GetFileSizeEx
RemoveDirectoryW
GetVolumePathNameW
FindClose

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchCombine
PathAllocCanonicalize

api-ms-win-core-memory-l1-1-2

VirtualAlloc
VirtualQuery
VirtualProtect
VirtualFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-1

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-2-0

InitializeSListHead

api-ms-win-security-accesshlpr-l1-1-0

FreeTransientObjectSecurityDescriptor
QueryTransientObjectSecurityDescriptor

ztrace_maps

ZTraceReportPropagation
ZTraceInit
ZTraceClose
ZTraceReportOriginationNoThis
ZTraceReportOrigination
ZTraceReportIgnoreNoThis
ZTraceHelperNoThis
ZTraceReportPropagationNoThis

bcp47langs

GetUserLanguages

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW
RegDeleteKeyValueW

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

mapconfiguration

ConfigurationManager_Create

Exports

Exports

MosQueryAnyPackagesFromPath
MosQueryCatalogExists
MosQueryPackages
MosQueryPackagesFromPath
MosStorageDumpConfiguration
MosStorageEnsureIsAppContainerCompliant
MosStorageEnsureMapDataDirectory
MosStorageEnsureMapDataDirectoryReturnPath
MosStorageGetBrowseCacheSizeInMBytes
MosStorageGetCurrentLocation
MosStorageGetDataDirectory
MosStorageGetLocations
MosStorageGetMapDataMaxBrowseCacheSizeInBytes
MosStorageGetMapsRepairAttempts
MosStorageGetResourceDirectory
MosStorageGetStorageDeviceDataFromDeviceGuid
MosStorageGetStorageSizesInBytes
MosStorageGetSystemDataDirectory
MosStorageGetTotalMapDataInBytes
MosStorageGetWhetherSpaceAvailable
MosStorageIsStorageStateValid
MosStorageResetCacheValues
MosStorageResetPreferredLocationIfDefined
MosStorageResetPreferredLocationIfNotPresent
MosStorageSetLocation
MosStorageSetMapsRepairAttempts
MosStorageUseDefaultExternalStorage
MosStorageValidateLocation
MosStorage_SetServiceCallbacks

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

76f8c4cb2ebfc57b3ffbc9c4894ba81d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-interlocked-l1-2-0

api-ms-win-security-accesshlpr-l1-1-0

ztrace_maps

bcp47langs

api-ms-win-core-registry-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-apiquery-l1-1-0

mapconfiguration

Exports

Exports

Sections

.text Size: 57KB - Virtual size: 56KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 40B

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 57KB - Virtual size: 56KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 40B

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 3KB - Virtual size: 3KB