MossX64[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MossX64.exe
Size 4.0MB
Sample261107-1pvsms112p
SHA256 f28cb3a2fe2773608e0897ee8ddb1a99320e56bfa562bf15ee713d1a243802fa
MD5 27f64a218981427510c013fa397c235a
SHA1 fee1ec9e2479821bbe3bf7e77b8b4c4720fa440a
SHA512 a4609b311ea74d319a6a66f76797900aff45088072a14e82a3fc24fdc34f14f995024a7e264c2f3eb81ac582c531d39792490c308c5ea1d6fed99ec48bedf34c
SSDEEP 49152:OGtlqyXOV7DxNNKkmT8FMDlK/glETGA93hNmqRH4pB:4gYglEiqh5
TLSH
T1CF168D55B7ED40D4D5A6E038CE178A4BD6F2BC410A34C39B15A4FB9E9F332610E2A376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MossX64.exe

File Explorer

MossX64.exe

.exe 4.0MB

MossX64.exe

IMPHASH cfd9898df8dbe3c55431f87e997d9eb1
SHA256 f28cb3a2fe2773608e0897ee8ddb1a99320e56bfa562bf15ee713d1a243802fa
MD5 27f64a218981427510c013fa397c235a
SHA1 fee1ec9e2479821bbe3bf7e77b8b4c4720fa440a
SHA512 a4609b311ea74d319a6a66f76797900aff45088072a14e82a3fc24fdc34f14f995024a7e264c2f3eb81ac582c531d39792490c308c5ea1d6fed99ec48bedf34c
SSDEEP 49152:OGtlqyXOV7DxNNKkmT8FMDlK/glETGA93hNmqRH4pB:4gYglEiqh5
TLSH
T1CF168D55B7ED40D4D5A6E038CE178A4BD6F2BC410A34C39B15A4FB9E9F332610E2A376
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1802016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\sources\oc2022\x64\RandomD3D_x64\Mossx64.pdb

winmm

timeBeginPeriod PlaySoundW timeEndPeriod timeGetTime

advapi32

RegEnumKeyExW RegOpenKeyExA RegCloseKey InitializeSecurityDescriptor RegCreateKeyExW RegQueryValueExA GetUserNameA OpenProcessToken GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExA RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW

gdi32

DeleteObject GetTextFaceW SetTextAlign SetROP2 SetPolyFillMode GetViewportOrgEx GetWindowOrgEx SetPixelV SetPaletteEntries ExtFloodFill PtInRegion GetBoundsRect FrameRgn FillRgn RoundRect OffsetRgn GetRgnBox Rectangle LPtoDP CreateRoundRectRgn Polyline GetLayout SetLayout SetMapMode SelectObject SetBkMode CreateCompatibleBitmap CreateCompatibleDC CreateDCW RealizePalette SelectPalette CreatePalette BitBlt Polygon CreatePolygonRgn GetTextColor Ellipse CreateEllipticRgn SetDIBColorTable CreateDIBSection StretchBlt SetPixel GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap GetBkColor GetSystemPaletteEntries GetPaletteEntries GetNearestPaletteIndex EnumFontFamiliesExW DPtoLP SetRectRgn PatBlt CreateRectRgnIndirect CombineRgn GetTextMetricsW GetTextExtentPoint32W CreateFontIndirectW ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW MoveToEx SetTextColor DeleteDC GetDeviceCaps CreateICW CopyMetaFileW CreateBitmap SetBkColor GetObjectW CreateHatchBrush CreatePen CreatePatternBrush CreateRectRgn CreateSolidBrush Escape ExcludeClipRect GetClipBox GetObjectType GetPixel GetStockObject GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn

shlwapi

PathIsUNCW PathFindFileNameW PathFindExtensionW PathAppendW PathStripToRootW StrFormatKBSizeW PathRemoveFileSpecW PathFileExistsA PathAppendA

shell32

DragAcceptFiles ShellExecuteW SHGetFolderPathA DragQueryFileW SHAppBarMessage DragFinish SHGetFolderPathW SHBrowseForFolderW SHGetDesktopFolder SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetFileInfoW

gdiplus

GdipDisposeImage GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipDrawImageRectI GdipSaveImageToFile GdipCreateFromHDC GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipSetInterpolationMode GdipCloneImage

imagehlp

MapFileAndCheckSumW MapFileAndCheckSumA

iphlpapi

GetAdaptersInfo

wininet

InternetOpenW InternetReadFile InternetOpenUrlW InternetCanonicalizeUrlW InternetGetConnectedState InternetCloseHandle

version

VerQueryValueA GetFileVersionInfoSizeA VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW GetFileVersionInfoA

urlmon

URLDownloadToFileW

psapi

GetModuleBaseNameW EnumProcesses GetModuleFileNameExW EnumProcessModules EnumProcessModulesEx

crypt32

CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptQueryObject

pdh

PdhAddEnglishCounterW PdhCollectQueryData PdhOpenQueryW PdhGetFormattedCounterValue

kernel32

WideCharToMultiByte GetComputerNameA GlobalMemoryStatusEx lstrcpyW lstrcmpA DeviceIoControl CreateDirectoryW SetFileTime SetFilePointer DuplicateHandle GetCurrentDirectoryW SystemTimeToFileTime GetFileType DosDateTimeToFileTime UnmapViewOfFile GetFileInformationByHandle CreateFileMappingW FileTimeToDosDateTime RtlVirtualUnwind GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GlobalAlloc GlobalSize GlobalLock GlobalUnlock GlobalFree MulDiv FormatMessageW GetVersionExW GetModuleHandleExW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW SystemTimeToTzSpecificLocalTime EncodePointer LoadLibraryExW InitializeCriticalSectionAndSpinCount CompareStringW TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc GlobalGetAtomNameW FreeResource GlobalDeleteAtom lstrcmpW GlobalAddAtomW GlobalFindAtomW GetLocaleInfoW GetUserDefaultUILanguage FlushFileBuffers GetFullPathNameW GetVolumeInformationW LockFile SetEndOfFile UnlockFile lstrcmpiW GlobalFlags CreateEventW SetThreadPriority GetFileTime FindResourceExW GetWindowsDirectoryW GetTickCount GetProfileIntW SearchPathW GetUserDefaultLCID RtlLookupFunctionEntry UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime LocalAlloc GetStartupInfoW DecodePointer HeapAlloc RaiseException HeapReAlloc HeapSize InitializeCriticalSectionEx HeapFree GetCurrentThreadId OutputDebugStringA GetVersionExA ReadProcessMemory GetThreadContext SuspendThread RtlCaptureContext GetEnvironmentVariableA GetModuleFileNameA GetCurrentDirectoryA SetLastError GetEnvironmentVariableW FindNextFileW FindFirstFileExW SetCurrentDirectoryW GetFileAttributesExW GetTempFileNameW WriteFile CreateSemaphoreW CopyFileW GetFileSizeEx GetProcessTimes FindFirstFileW ReadFile GetFileSize CreateFileA FindClose FindNextFileA FindFirstFileExA OpenProcess FileTimeToSystemTime FileTimeToLocalFileTime LocalFree VerifyVersionInfoW VerSetConditionMask GetProcessHeap LeaveCriticalSection CreateFileW EnterCriticalSection GetFirmwareEnvironmentVariableW WaitForSingleObject TerminateThread ResumeThread CreateThread GetExitCodeThread Sleep FreeLibrary SetUnhandledExceptionFilter GetProcAddress LoadLibraryW InitializeCriticalSection IsDebuggerPresent SetProcessDEPPolicy GetSystemDirectoryW GetLocalTime GetLastError MoveFileExW GetFileAttributesW SetFileAttributesW GetTempPathW MultiByteToWideChar CloseHandle DeleteFileW GetCurrentThread GetCurrentProcessId GetCurrentProcess FindResourceW LoadResource LockResource SizeofResource GetModuleFileNameW GetModuleHandleW GetCPInfo RtlUnwindEx RtlPcToFileHeader RtlUnwind ExitProcess HeapQueryInformation ExitThread FreeLibraryAndExitThread GetCommandLineA GetCommandLineW VirtualAlloc QueryPerformanceFrequency SetStdHandle GetStdHandle GetTimeZoneInformation FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTime InitializeSListHead IsValidLocale EnumSystemLocalesW GetConsoleMode ReadConsoleW GetConsoleOutputCP SetFilePointerEx IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW DeleteCriticalSection WriteConsoleW MapViewOfFile OutputDebugStringW GetStringTypeW SwitchToThread LCMapStringW

user32

ToUnicodeEx GetKeyboardState CreateAcceleratorTableW DestroyAcceleratorTable CopyAcceleratorTableW LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW RegisterClipboardFormatW CharUpperBuffW IsClipboardFormatAvailable GetUpdateRect DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel SubtractRect CreateMenu GetWindowRgn DestroyCursor PtInRect ReleaseCapture SetCapture GetNextDlgGroupItem MapWindowPoints ScreenToClient AdjustWindowRectEx IsCharLowerW GetKeyboardLayout GetWindowRect RemovePropW WaitMessage PostThreadMessageW GetComboBoxInfo ReuseDDElParam UnpackDDElParam InsertMenuItemW MonitorFromPoint UpdateLayeredWindow DrawIcon FrameRect CopyIcon SetCursorPos GetSystemMenu IsZoomed DrawFrameControl SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow RedrawWindow ValidateRect GetForegroundWindow SetActiveWindow TrackPopupMenu SetMenu GetCapture GetKeyState GetDlgCtrlID GetDlgItem IsIconic IsWindowVisible EndDeferWindowPos DeferWindowPos GetMenuDefaultItem SetWindowPlacement GetWindowPlacement IsChild IsMenu GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW PostMessageW GetMessageTime GetMessagePos PeekMessageW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps CheckMenuItem GetWindowTextLengthW GetLastActivePopup GetWindowThreadProcessId GetWindowLongW GetSysColorBrush GetSysColor ReleaseDC GetDC DrawEdge SystemParametersInfoW CopyImage GetParent IsWindowEnabled EnableWindow GetFocus SetFocus IsWindow SendMessageW RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID GetSubMenu GetMenuState GetMenuStringW GetSystemMetrics FindWindowW GetWindowLongPtrW GetWindowTextW BringWindowToTop SetCursor GetCursorPos GetAsyncKeyState CreatePopupMenu KillTimer SetTimer DeleteMenu ShowOwnedPopups LoadImageW TrackMouseEvent IntersectRect MapDialogRect SetRectEmpty SendDlgItemMessageA InflateRect GetMenuItemInfoW DestroyMenu FillRect GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW RealChildWindowFromPoint ClientToScreen CharUpperW DestroyIcon GetNextDlgTabItem CreateDialogIndirectParamW IsDialogMessageW SetWindowTextW MoveWindow MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx SetWindowsHookExW EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetParent SetWindowRgn GetWindow GetTopWindow GetClassNameW GetClassLongPtrW SetWindowPos PostQuitMessage GetClientRect DrawStateW DefWindowProcW DestroyWindow DrawTextA EndPaint BeginPaint DialogBoxParamW EnableMenuItem GetMenu UpdateWindow InvalidateRect ShowWindow SetLayeredWindowAttributes LoadBitmapW GetDesktopWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW LoadStringW GetPropW IsDlgButtonChecked CheckDlgButton SetForegroundWindow SetDlgItemTextW EndDialog EnumDisplayMonitors OffsetRect EqualRect CopyRect UnionRect SetRect GetMonitorInfoW wsprintfW GetActiveWindow MessageBoxW MessageBoxA SetWindowLongPtrW SetClassLongPtrW LoadMenuW GetKeyNameTextW MapVirtualKeyW NotifyWinEvent InvertRect HideCaret EnableScrollBar MessageBeep GetIconInfo DrawIconEx MapVirtualKeyExW IsRectEmpty DrawFocusRect UnhookWindowsHookEx WindowFromPoint BeginDeferWindowPos SetWindowLongW RegisterWindowMessageW

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

uxtheme

GetThemePartSize GetThemeSysColor IsThemeBackgroundPartiallyTransparent IsAppThemed GetWindowTheme GetCurrentThemeName GetThemeColor DrawThemeBackground CloseThemeData DrawThemeParentBackground DrawThemeText OpenThemeData

ole32

CoTaskMemFree CoTaskMemAlloc CoSetProxyBlanket OleUninitialize CoCreateInstance ReleaseStgMedium CoUninitialize CoInitialize CoDisconnectObject CreateStreamOnHGlobal DoDragDrop OleGetClipboard CoLockObjectExternal RegisterDragDrop RevokeDragDrop OleLockRunning OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleDuplicateData CoInitializeEx

oleaut32

VarBstrFromDate VariantChangeType VariantCopy SysStringLen SysAllocStringLen LoadTypeLi GetErrorInfo VariantClear VariantInit SystemTimeToVariantTime VariantTimeToSystemTime SysFreeString SysAllocString

setupapi

SetupDiGetDeviceRegistryPropertyW CM_Get_Device_IDW SetupDiGetClassDevsW SetupDiEnumDeviceInfo

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

698KB

Virtual Size

698KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MossX64.exe

winmm

advapi32

gdi32

shlwapi

shell32

gdiplus

imagehlp

iphlpapi

wininet

version

urlmon

psapi

crypt32

pdh

kernel32

user32

msimg32

winspool.drv

uxtheme

ole32

oleaut32

setupapi

oleacc

imm32

generic