Moka[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Moka.dll
Size 3.2MB
Sample261029-18n47sttev
SHA256 a01118e7199ff0d1048b8181f53a3d9666d6c7fe3be0886d4b9d90f8a4c1ee48
MD5 059e7316361cebd011335f2a8a3f4202
SHA1 0e004b5e7d563a6f4ca228aa2ee3da038e8d695a
SHA512 ebe000e253d3ae58da4cf093e5fc65909b565e69b7ab5fc5b01aa0ce4e719aab8650c4590aa7702021fb01dca7b97f27ec339f00a0e00f406f7f09cef5df2ee2
SSDEEP 49152:2AKZHb3UIxOCbPjtgEe7r/duE+Ljzo3csfIkdaBr/zFaytpiR99dbOMjC1YoW0EZ:MwD5jGWA1c
TLSH
T1FCF5AD05A3A701E8C9A9E43CC96A1627EB71745C0B387BFB5ED046751F623E4633FA12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Moka.dll

File Explorer

Moka.dll

.dll 3.2MB

Moka.dll

IMPHASH 1c44d8699a9ad6f3e3fcd9f7f648f32d
SHA256 a01118e7199ff0d1048b8181f53a3d9666d6c7fe3be0886d4b9d90f8a4c1ee48
MD5 059e7316361cebd011335f2a8a3f4202
SHA1 0e004b5e7d563a6f4ca228aa2ee3da038e8d695a
SHA512 ebe000e253d3ae58da4cf093e5fc65909b565e69b7ab5fc5b01aa0ce4e719aab8650c4590aa7702021fb01dca7b97f27ec339f00a0e00f406f7f09cef5df2ee2
SSDEEP 49152:2AKZHb3UIxOCbPjtgEe7r/duE+Ljzo3csfIkdaBr/zFaytpiR99dbOMjC1YoW0EZ:MwD5jGWA1c
TLSH
T1FCF5AD05A3A701E8C9A9E43CC96A1627EB71745C0B387BFB5ED046751F623E4633FA12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2048468

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceCounter VirtualFree VirtualAlloc GetSystemInfo VirtualQuery HeapCreate VirtualProtect HeapFree GetCurrentProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot Sleep HeapReAlloc CloseHandle HeapAlloc HeapDestroy GetThreadContext GetCurrentProcessId FlushInstructionCache SetThreadContext OpenThread GetModuleFileNameA SetConsoleTextAttribute GetStdHandle FormatMessageA InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter QueryPerformanceFrequency RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetTickCount64 SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx MoveFileExW GetLastError AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW WideCharToMultiByte GlobalLock GetProcAddress GlobalFree GlobalAlloc UnhandledExceptionFilter MultiByteToWideChar LocalFree

user32

GetForegroundWindow SetCursor GetClientRect ReleaseCapture SetCursorPos GetKeyboardLayout GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData TrackMouseEvent ClientToScreen GetCapture IsWindowUnicode ScreenToClient GetAsyncKeyState CallWindowProcA ClipCursor mouse_event SetWindowLongPtrA ShowCursor DestroyWindow DefWindowProcA CreateWindowExA UnregisterClassA RegisterClassExA GetKeyState GetMessageExtraInfo LoadCursorA SetCapture

msvcp140

?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Cnd_wait _Thrd_id ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Thrd_detach _Thrd_join _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAPEAV12@PEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency _Thrd_yield _Cnd_signal ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z _Query_perf_counter

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

winmm

PlaySoundA

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy __std_type_info_destroy_list _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception __C_specific_handler memcmp __std_exception_destroy memset memcpy longjmp strstr memmove strrchr __std_type_info_compare memchr __std_terminate

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _wassert exit _beginthreadex system terminate _errno _crt_atexit abort _seh_filter_dll _configure_narrow_argv _initterm_e _initterm _cexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf ftell fopen __acrt_iob_func _get_stream_buffer_pointers freopen_s _fseeki64 fflush fsetpos fclose ungetc fseek __stdio_common_vfprintf fgetpos fwrite _wfopen fread fgetc __stdio_common_vsprintf_s __stdio_common_vsscanf fputc setvbuf

api-ms-win-crt-convert-l1-1-0

atol atof strtol atoi strtoul

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-string-l1-1-0

strcmp strncpy_s isspace strncpy strncmp toupper tolower

api-ms-win-crt-heap-l1-1-0

calloc free _callnewh malloc _aligned_free

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

log10 logf pow powf log sin asinf sinf atan2f fminf expf acosf fmaxf cosf cos _fdclass sqrtf ceilf fmodf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func