moonlight[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
moonlight.exe
Size 756KB
Sample260703-aptbpsgz7z
SHA256 4c7d5d5ea32102560842e9101631ae7e336227bc71686b52f27b5f3bab391da1
MD5 b33753e9339dc5c93d8cc0c8e1007862
SHA1 04eaf92b17c2f21ee0ff8ffeb761204e9cf5daf5
SHA512 64fb2cca5d1817ab02eb1d9d88418bfdcc41caac03650be439463db73a739c78c1666caae6c8e5ac5be32282353fbe79d47ccf135b7c428ecb1802984c3fddde
SSDEEP 12288:Q4nnsj3UfBad3ynC6C62zqCc/NfvtiCLnjo/zlK:aUQd3ynC22zqCcTiwnjWzlK
TLSH
T1E3F4AE95F2F941E9E037A139D59AB61BFA753808072059DB23E4065C3FB37E41ABB312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
moonlight.exe

File Explorer

moonlight.exe

.exe 756KB

moonlight.exe

IMPHASH b0170ecac0d56fe1f21ff7383b4e6aba
SHA256 4c7d5d5ea32102560842e9101631ae7e336227bc71686b52f27b5f3bab391da1
MD5 b33753e9339dc5c93d8cc0c8e1007862
SHA1 04eaf92b17c2f21ee0ff8ffeb761204e9cf5daf5
SHA512 64fb2cca5d1817ab02eb1d9d88418bfdcc41caac03650be439463db73a739c78c1666caae6c8e5ac5be32282353fbe79d47ccf135b7c428ecb1802984c3fddde
SSDEEP 12288:Q4nnsj3UfBad3ynC6C62zqCc/NfvtiCLnjo/zlK:aUQd3ynC22zqCcTiwnjWzlK
TLSH
T1E3F4AE95F2F941E9E037A139D59AB61BFA753808072059DB23E4065C3FB37E41ABB312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

436080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

user32

TranslateMessage DispatchMessageW PeekMessageW DefWindowProcA PostQuitMessage LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard FindWindowW MessageBoxW GetWindowRect ReleaseDC GetDC SendInput keybd_event GetAsyncKeyState SetWindowPos UpdateLayeredWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW

gdi32

DeleteDC CreateDIBSection SelectObject DeleteObject CreateCompatibleDC

kernel32

GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers LCMapStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter SetStdHandle GetStringTypeW CreateFileW HeapSize HeapReAlloc SetEndOfFile IsDebuggerPresent RtlVirtualUnwind GetCommandLineW IsProcessorFeaturePresent CloseHandle Sleep OpenProcess GetTickCount ReadProcessMemory WriteProcessMemory CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleBaseNameA OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WriteFile GetStdHandle GetModuleFileNameW GetEnvironmentStringsW FreeEnvironmentStringsW RtlCaptureContext GetProcessHeap WriteConsoleW GetStartupInfoW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReadFile GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW

shell32

ShellExecuteW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

572KB

Virtual Size

571KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

moonlight.exe

d3d11

user32

gdi32

kernel32

shell32

imm32

d3dcompiler_47

generic