moon_checker[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
moon_checker.exe
Size 516KB
Sample260924-v56l7axeqa
SHA256 ae4b628fe2489bbf7685ccef6f1226bd3346292be63e97315eddbf8b21fb3f98
MD5 ccdc86d2808c7de28843a1658a6c410f
SHA1 a3a791540079968b1a5ab7c54044af97e2dc6f20
SHA512 e394f0796c8e53447506cc082fca6031ba6dad29e907bb91f655c5b811c21d3cb3b3c51c300fa36e5affd4b9c7c27304c7eb2e23cdb4a67561b6a1c29f0291ef
SSDEEP 12288:tIwmJtn52LprF92oROG9XaFPRbtad3mhp:tItt52LprF92oROGxO5btad3c
TLSH
T1C1B49E00B4A2D072E57400B0967D7BAB593D1C781B2168E7B3D85DA96FB01D22BF6F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
moon_checker.exe

File Explorer

moon_checker.exe

.exe 516KB

moon_checker.exe

IMPHASH 9b0fec9000517235a4c1369217989b3b
SHA256 ae4b628fe2489bbf7685ccef6f1226bd3346292be63e97315eddbf8b21fb3f98
MD5 ccdc86d2808c7de28843a1658a6c410f
SHA1 a3a791540079968b1a5ab7c54044af97e2dc6f20
SHA512 e394f0796c8e53447506cc082fca6031ba6dad29e907bb91f655c5b811c21d3cb3b3c51c300fa36e5affd4b9c7c27304c7eb2e23cdb4a67561b6a1c29f0291ef
SSDEEP 12288:tIwmJtn52LprF92oROG9XaFPRbtad3mhp:tItt52LprF92oROGxO5btad3c
TLSH
T1C1B49E00B4A2D072E57400B0967D7BAB593D1C781B2168E7B3D85DA96FB01D22BF6F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

2009

Minor OS version

Major OS version

Entry point

276944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

iphlpapi

GetAdaptersInfo

ole32

CoInitializeSecurity CoInitializeEx CoUninitialize CoSetProxyBlanket CoCreateInstance

oleaut32

SysAllocString SysFreeString SysStringLen VariantInit VariantClear VariantCopy VariantChangeType

kernel32

GetCommandLineA GetCPInfo CreateFileA GetDiskFreeSpaceExA GetFileAttributesA GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle DeviceIoControl Sleep GetCurrentProcess CreateThread OpenProcess GlobalMemoryStatusEx GetSystemInfo GetSystemTime GetTickCount64 GetSystemFirmwareTable GetModuleHandleA GetProcAddress LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryFullProcessImageNameA GetComputerNameA WideCharToMultiByte K32EnumProcesses MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetLocaleInfoA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose FreeEnvironmentStringsW GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP GetCommandLineW LCMapStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW TerminateProcess ExitProcess ReadFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer GetProcessHeap FlsFree FlsSetValue SetStdHandle GetStringTypeW WriteConsoleW CreateFileW HeapSize FlsGetValue FlsAlloc SetLastError RtlUnwind RaiseException InitializeSListHead HeapReAlloc FlushFileBuffers GetEnvironmentStringsW SetEndOfFile DecodePointer GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter IsProcessorFeaturePresent GetLastError LocalFree

user32

PeekMessageA DispatchMessageA TranslateMessage PostMessageA LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetClipboardData SetProcessDPIAware MessageBoxA GetWindowRect ReleaseDC GetDC UpdateWindow GetSystemMetrics EmptyClipboard SetClipboardData CloseClipboard OpenClipboard ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW

gdi32

GetDeviceCaps

shell32

ShellExecuteA

advapi32

GetUserNameA RegCloseKey RegQueryValueExA RegOpenKeyExA

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpGetIEProxyConfigForCurrentUser

imm32

ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext

Name

.text

Size

396KB

Virtual Size

396KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

moon_checker.exe

d3d11

d3dcompiler_47

iphlpapi

ole32

oleaut32

kernel32

user32

gdi32

shell32

advapi32

winhttp

imm32

generic