File name:

moschat_s4.exe

Full analysis: https://app.any.run/tasks/477b6b45-b50f-4d93-bb09-51deea27169f
Verdict: Malicious activity
Analysis date: January 11, 2019, 22:00:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1C6C69261C125941C0AEC28960B573BB

SHA1:

1A8540A7115D519FA99CA1F94ADBBC384C9F5DB6

SHA256:

96ACFCE0ECB9D057D24C5B1367F0340B5E7B6D13A998A2C88241D8A5AAE2B3FC

SSDEEP:

49152:zrXfx3LOloE6QMHH9jWdH6T3Jsv6tWKFdu9Cs8kxoqqNSq:fXJ7CvkJsv6tWKFdu9CUw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • MosChat.exe (PID: 4052)

    • Application was dropped or rewritten from another process

      • MosChat.exe (PID: 4052)
      • MosChat.exe (PID: 2416)

  • SUSPICIOUS

    • Creates a software uninstall entry

      • moschat_s4.exe (PID: 3424)

    • Connects to unusual port

      • MosChat.exe (PID: 4052)

    • Modifies the open verb of a shell class

      • moschat_s4.exe (PID: 3424)

    • Application launched itself

      • MosChat.exe (PID: 4052)

    • Creates files in the user directory

      • MosChat.exe (PID: 4052)
      • moschat_s4.exe (PID: 3424)

    • Executable content was dropped or overwritten

      • moschat_s4.exe (PID: 3424)

  • INFO

    • Reads settings of System Certificates

      • MosChat.exe (PID: 4052)

    • Dropped object may contain Bitcoin addresses

      • moschat_s4.exe (PID: 3424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:05 06:15:24+01:00
PEType: PE32
LinkerVersion: 14
CodeSize: 1376256
InitializedDataSize: 899072
UninitializedDataSize: -
EntryPoint: 0x121a5c
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.0.10.0
ProductVersionNumber: 2.0.10.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: YY Inc.
FileDescription: MosChat
FileVersion: 2.0.10
LegalCopyright: Copyright © 2007-2017 YY Inc. All rights reserved.
ProductName: MosChat
ProductVersion: 2.0.10
OriginalFileName: MosChat.exe

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-Dec-2018 05:15:24
Detected languages:
  • English - United States
Debug artifacts:
  • E:\DUOWAN_BUILD\build\Build_Src\ycube\ycube_lastrel_mb\bin\release\pdb\MosChat.pdb
CompanyName: YY Inc.
FileDescription: MosChat
FileVersion: 2.0.10
LegalCopyright: Copyright © 2007-2017 YY Inc. All rights reserved.
ProductName: MosChat
ProductVersion: 2.0.10
OriginalFilename: MosChat.exe

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000130

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 7
Time date stamp: 05-Dec-2018 05:15:24
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0014FEE1
0x00150000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.28145
.rdata
0x00151000
0x000A2914
0x000A2A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.66013
.data
0x001F4000
0x000058B0
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.51031
.tls
0x001FA000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.gfids
0x001FB000
0x00000160
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.04328
.rsrc
0x001FC000
0x00029BD0
0x00029C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.84555
.reloc
0x00226000
0x00009400
0x00009400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.68802

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.33361
1068
UNKNOWN
English - United States
RT_MANIFEST
2
4.09118
2216
UNKNOWN
English - United States
RT_ICON
3
2.73779
1384
UNKNOWN
English - United States
RT_ICON
4
7.96391
22256
UNKNOWN
English - United States
RT_ICON
5
5.05049
16936
UNKNOWN
English - United States
RT_ICON
6
5.1588
9640
UNKNOWN
English - United States
RT_ICON
7
5.40602
4264
UNKNOWN
English - United States
RT_ICON
8
5.82064
1128
UNKNOWN
English - United States
RT_ICON
9
7.94649
20344
UNKNOWN
English - United States
RT_ICON
10
2.48805
16936
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
CRYPT32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
WINHTTP.dll
WS2_32.dll
gdiplus.dll
ole32.dll

Exports

Title
Ordinal
Address
checkConnective
1
0x0010619D
getNativeMessage
2
0x00106496
getNativeMessageLen
3
0x00106439
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start moschat_s4.exe moschat.exe moschat.exe

Process information

PID
CMD
Path
Indicators
Parent process
2416C:\Users\admin\AppData\Roaming\moschat\MosChat.exe update -sourceVersion 2.0.20.0C:\Users\admin\AppData\Roaming\moschat\MosChat.exe
MosChat.exe
User:
admin
Company:
YY Inc.
Integrity Level:
MEDIUM
Description:
MosChat
Exit code:
0
Version:
2.0.20
Modules
Images
c:\users\admin\appdata\roaming\moschat\moschat.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
3424"C:\Users\admin\AppData\Local\Temp\moschat_s4.exe" C:\Users\admin\AppData\Local\Temp\moschat_s4.exe
explorer.exe
User:
admin
Company:
YY Inc.
Integrity Level:
MEDIUM
Description:
MosChat
Exit code:
0
Version:
2.0.10
Modules
Images
c:\users\admin\appdata\local\temp\moschat_s4.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
4052C:\Users\admin\AppData\Roaming\moschat\MosChat.exe C:\Users\admin\AppData\Roaming\moschat\MosChat.exe
moschat_s4.exe
User:
admin
Company:
YY Inc.
Integrity Level:
MEDIUM
Description:
MosChat
Exit code:
0
Version:
2.0.20
Modules
Images
c:\users\admin\appdata\roaming\moschat\moschat.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
Total events
517
Read events
473
Write events
44
Delete events
0

Modification events

(PID) Process:(3424) moschat_s4.exeKey:HKEY_CURRENT_USER\Software\duowan\moschat
Operation:writeName:MachineUuid
Value:
{43ba91d8-c377-4492-b5b7-1ab5c19c4f5d}
(PID) Process:(3424) moschat_s4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\moschat
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Roaming\moschat\MosChat.exe
(PID) Process:(3424) moschat_s4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\moschat
Operation:writeName:DisplayName
Value:
Moschat
(PID) Process:(3424) moschat_s4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\moschat
Operation:writeName:NoModify
Value:
1
(PID) Process:(3424) moschat_s4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\moschat
Operation:writeName:NoRepair
Value:
1
(PID) Process:(3424) moschat_s4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\moschat
Operation:writeName:Publisher
Value:
YY Inc
(PID) Process:(3424) moschat_s4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\moschat
Operation:writeName:URLInfoAbout
Value:
true
(PID) Process:(3424) moschat_s4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\moschat
Operation:writeName:UninstallString
Value:
C:\Users\admin\AppData\Roaming\moschat\MosChat.exe uninstall
(PID) Process:(3424) moschat_s4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\moschat
Operation:writeName:DisplayVersion
Value:
2.0.20
(PID) Process:(3424) moschat_s4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\moschat
Operation:writeName:Distributor
Value:
s4
Executable files
154
Suspicious files
17
Text files
671
Unknown types
65

Dropped files

PID
Process
Filename
Type
3424moschat_s4.exeC:\Users\admin\AppData\Roaming\duowan\moschat\packages\cef\2.0.0.7z.partial —
MD5:—
SHA256:—
3424moschat_s4.exeC:\Users\admin\AppData\Roaming\duowan\moschat\packages\cef\2.0.0.7z —
MD5:—
SHA256:—
3424moschat_s4.exeC:\Users\admin\AppData\Roaming\duowan\moschat\packages\protocol\2.0.17.7z.partial —
MD5:—
SHA256:—
3424moschat_s4.exeC:\Users\admin\AppData\Roaming\duowan\moschat\packages\protocol\2.0.17.7z —
MD5:—
SHA256:—
3424moschat_s4.exeC:\Users\admin\AppData\Roaming\duowan\moschat\packages\gameassistant\2.0.17.7z.partial —
MD5:—
SHA256:—
3424moschat_s4.exeC:\Users\admin\AppData\Roaming\duowan\moschat\packages\overlay\2.0.10.7z.partial —
MD5:—
SHA256:—
3424moschat_s4.exeC:\Users\admin\AppData\Roaming\duowan\moschat\packages\moschat\2.0.20.7z.partial —
MD5:—
SHA256:—
3424moschat_s4.exeC:\Users\admin\AppData\Roaming\duowan\moschat\packages\qtcore\2.0.11.7z.partial —
MD5:—
SHA256:—
3424moschat_s4.exeC:\Users\admin\AppData\Roaming\duowan\moschat\packages\obs\2.0.14.7z.partial —
MD5:—
SHA256:—
3424moschat_s4.exeC:\Users\admin\AppData\Roaming\duowan\moschat\packages\obs\2.0.14.7z —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
66
DNS requests
25
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3424
moschat_s4.exe
GET
—
128.1.97.165:80
http://hlog.hiido.com/c.gif?act=pcsdkprotocol&time=1547244037&key=3f3649385282fdc0288800e9ddcc969c&eventid=20025833&moreinfo=%7B%22act_type%22%3A%22102%22%2C%22code%22%3A%22%7B43ba91d8-c377-4492-b5b7-1ab5c19c4f5d%7D%22%2C%22sys%22%3A%223%22%7D&prodid=moschat&ver=2.0.10
US
—
—
unknown
3424
moschat_s4.exe
GET
—
128.1.97.165:80
http://hlog.hiido.com/c.gif?act=pcclientinstall&time=1547244168&key=96520aec767e1e2664fb42c7e35affff&cliver=2.0.20&code=%7B43ba91d8-c377-4492-b5b7-1ab5c19c4f5d%7D&from=s4&moreinfo=%7B%22key2%22%3Anull%7D&prodid=moschat&type=1
US
—
—
unknown
3424
moschat_s4.exe
GET
—
128.1.97.165:80
http://hlog.hiido.com/c.gif?act=pcsdkprotocol&time=1547244169&key=57e14ef86cd8bf4c5d5c549b26b22cbb&eventid=20025833&moreinfo=%7B%22act_type%22%3A%22104%22%2C%22code%22%3A%22%7B43ba91d8-c377-4492-b5b7-1ab5c19c4f5d%7D%22%2C%22sys%22%3A%223%22%7D&prodid=moschat&ver=2.0.20
US
—
—
unknown
4052
MosChat.exe
GET
—
47.254.67.167:80
http://hlog.hiido.com/c.gif?act=pcsdkprotocol&time=1547244177&key=ba683597f112433a2e51df75efba4b71&eventid=20027211&moreinfo=%7B%22loadState%22%3A0%2C%22total_time%22%3A0%2C%22web_time_ready%22%3A0%7D&prodid=moschat&ver=2.0.20
US
—
—
unknown
3424
moschat_s4.exe
GET
—
128.1.97.165:80
http://hlog.hiido.com/c.gif?act=pcsdkprotocol&time=1547244031&key=603efef0656f46f26e17597f07033fb7&eventid=20025833&moreinfo=%7B%22act_type%22%3A%22101%22%2C%22code%22%3A%22%7B43ba91d8-c377-4492-b5b7-1ab5c19c4f5d%7D%22%2C%22sys%22%3A%223%22%7D&prodid=moschat&ver=2.0.10
US
—
—
unknown
4052
MosChat.exe
GET
—
47.254.67.167:80
http://hlog.hiido.com/c.gif?act=pcsdkprotocol&time=1547244180&key=ce95d293d0a0339a813c01759e59fbc4&eventid=20027211&moreinfo=%7B%22loadState%22%3A1%2C%22total_time%22%3A10%2C%22web_time_ready%22%3A29973%7D&prodid=moschat&ver=2.0.20
US
—
—
unknown
4052
MosChat.exe
GET
—
47.254.67.167:80
http://hlog.hiido.com/c.gif?act=ystap&smkdata=0&EC=1&ec2=1&ylog=1&guid=ecd6b72d3d4f4b04993367c08aecc941&sdkver=1.2.11&key=d57fbbc40459569464c6977ff9070ad0&time=1547244177&mcode=5254004A04AF&pcos=9&mid=ffdd033190cfb8063b0afe081e0a2165&uid=0&seid=50156eff41954e609a3437df63e3c58f&appkey=d3d89fb33cd9e0e9b95dadc1e0ba975d&said=1494645593&dnt=0&lbt=300&apt=731&no=0&code=0&lbip=47.254.213.117]&apip=47.75.115.233]&uip=185.212.170.89&pf=1&sv=2
US
—
—
unknown
4052
MosChat.exe
POST
200
47.254.67.167:80
http://hlog.hiido.com/i.gif?act=mmetric&smkdata=0000000432a9982db0a258a2d7ff70d37a60e9a3&EC=1&enc=b64&ec2=1&ylog=1&guid=2dcf4db68fa04afc9a8336d6e4b71d7d&sdkver=1.2.11
US
—
—
unknown
3424
moschat_s4.exe
GET
200
162.62.3.20:80
http://dianhu-1253537286.cosru.myqcloud.com/pc/cef/cef_2.0.0.7z
US
compressed
35.0 Mb
unknown
—
—
GET
200
195.27.31.231:80
http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR3enuod9bxDxzpICGW%2B2sabjf17QQUkFj%2FsJx1qFFUd7Ht8qNDFjiebMUCEAcKTjZpAUOQxeplyDmpk9s%3D
DE
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3424
moschat_s4.exe
128.1.97.165:80
hlog.hiido.com
Zenlayer Inc
US
unknown
3424
moschat_s4.exe
47.89.65.41:443
static.moschat.com
Zhejiang Taobao Network Co.,Ltd
US
unknown
—
—
195.27.31.231:80
ocsp.dcocsp.cn
CW Vodafone Group PLC
DE
unknown
3424
moschat_s4.exe
162.62.4.226:443
iupdateplf.yy.com
—
US
unknown
3424
moschat_s4.exe
162.62.3.20:80
dianhu-1253537286.cosru.myqcloud.com
—
US
unknown
3424
moschat_s4.exe
47.89.65.225:443
static.moschat.com
Zhejiang Taobao Network Co.,Ltd
US
unknown
4052
MosChat.exe
47.52.60.230:443
—
Alibaba (China) Technology Co., Ltd.
HK
unknown
4052
MosChat.exe
47.75.115.233:107
aplbs.service.yy.com
—
US
unknown
4052
MosChat.exe
221.228.105.173:80
trans.hiido.com
No.31,Jin-rong Street
CN
malicious

DNS requests

Domain
IP
Reputation
hlog.hiido.com
  • 128.1.97.165
  • 47.254.150.73
  • 128.1.97.164
  • 128.1.97.137
  • 128.1.97.162
  • 47.90.200.249
  • 47.254.67.167
  • 128.1.97.138
  • 128.1.97.130
  • 45.255.126.60
  • 45.255.126.57
  • 47.89.191.230
  • 47.254.148.127
  • 45.255.126.58
  • 162.62.18.202
  • 45.255.126.59
unknown
static.moschat.com
  • 47.89.65.41
  • 47.89.65.43
  • 47.89.65.195
  • 47.89.65.194
  • 47.89.65.225
  • 47.89.65.44
  • 47.89.65.224
  • 47.89.65.42
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.dcocsp.cn
  • 195.27.31.231
  • 195.27.31.232
whitelisted
iupdateplf.yy.com
  • 162.62.4.226
unknown
ocsp.digicert-cn.com
  • 93.184.220.29
whitelisted
dianhu-1253537286.cosru.myqcloud.com
  • 162.62.3.20
  • 162.62.3.11
unknown
trans.hiido.com
  • 221.228.105.173
  • 58.215.143.62
  • 14.17.119.61
  • 14.17.119.57
malicious
moschat-cdn.yy.com
  • 213.244.178.206
  • 213.244.178.209
  • 213.244.178.244
  • 213.244.178.207
  • 213.244.178.205
  • 213.244.178.208
  • 213.244.178.210
malicious
www.moschat.com
  • 47.89.65.44
  • 47.89.65.42
  • 47.89.65.43
  • 47.89.65.194
  • 47.89.65.41
  • 47.89.65.224
  • 47.89.65.195
  • 47.89.65.225
malicious

Threats

PID
Process
Class
Message
4052
MosChat.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious Base64 from server instead image
Process
Message
MosChat.exe
[0111/220257.081:ERROR:url_request_context_getter_impl.cc(128)] Cannot use V8 Proxy resolver in single process mode.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
moschat_s4.exe