boiii[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

boiii.exe
Size

2.4MB
MD5

72878601f5b307105a603382ded69db3
SHA1

9d8d6cd4d3a353b61d6cb3d98f1a78c578fb0236
SHA256

9cf53bb40d691af8dd931915402851aee558bcc455fbcdbd92b6ad0fa2533c63
SHA512

0b614488431d82037538d6fe28d458778f728d07780b15b738bfab5d74db89be91ae0c0c902e68cb8f321dfb4907cb3af6ea508b7397f310cbaf63d9ec8ce0e7
SSDEEP

24576:4QI6gsNtH5kfoV6dULP4M8Fh0C7oc0CMfrDsRCYigjyk33oHfV/xw9W2hT3qEkmM:NisKfaN8FhR7oc01Ds5yMSk8UWEkmrH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
boiii.exe

Files

boiii.exe
.exe windows x64

c1541179d766bad112cab5c52584f495

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

crypt32

CertCloseStore
CertEnumCertificatesInStore
CryptStringToBinaryA
CertFreeCertificateContext
PFXImportCertStore
CryptDecodeObjectEx
CertGetCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CryptProtectData
CertOpenStore
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringA
CertFindExtension
CertCreateCertificateChainEngine
CertFindCertificateInStore

kernel32

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetThreadContext
GetThreadContext
HeapDestroy
HeapCreate
MoveFileExA
FormatMessageW
SleepEx
GetEnvironmentVariableA
VerifyVersionInfoW
GetSystemDirectoryA
MapViewOfFile
CreateFileMappingW
CreateMutexExA
InitializeCriticalSection
OpenProcess
AddVectoredExceptionHandler
GetProcAddress
GetVolumeInformationA
LocalFree
CreateMutexA
GetLastError
CloseHandle
SetProcessAffinityMask
GetProcessAffinityMask
MulDiv
SetConsoleTitleA
AttachConsole
AllocConsole
GetConsoleWindow
SetEnvironmentVariableA
OutputDebugStringA
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
CreateThread
GetTickCount64
DeleteCriticalSection
UnmapViewOfFile
InitializeCriticalSectionEx
GetTickCount
WaitForSingleObject
GetCommandLineA
ExitProcess
VirtualProtect
GetModuleHandleA
GetCurrentThreadId
GetVersionExA
SetUnhandledExceptionFilter
GetCurrentDirectoryA
DecodePointer
WriteConsoleW
SetEndOfFile
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapSize
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
GetTimeZoneInformation
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetStdHandle
FreeLibraryAndExitThread
ExitThread
RtlUnwind
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
CreateEventW
ReadFile
WriteFile
PeekNamedPipe
CreateFileW
WaitNamedPipeW
lstrlenW
GetModuleFileNameW
SizeofResource
FindResourceA
GetModuleHandleExA
LoadLibraryA
LockResource
LoadResource
FreeLibrary
CreateProcessA
VirtualFree
VirtualAlloc
GetSystemInfo
FlushInstructionCache
GetSystemFirmwareTable
DeleteFileW
MoveFileW
VirtualQuery
GetCommandLineW
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetThreadId
OpenThread
SetFilePointer
GetTempPathA
CreateFileA
GetTempFileNameA
FlushFileBuffers
ReleaseMutex
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
MultiByteToWideChar
WaitForSingleObjectEx
Sleep
GetExitCodeThread
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageA
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
WideCharToMultiByte
GetLocaleInfoEx
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
GetModuleHandleExW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
TryAcquireSRWLockExclusive

user32

GetMessageA
DispatchMessageA
MoveWindow
GetWindowLongPtrA
SetProcessDPIAware
SetFocus
SetWindowLongPtrA
SendMessageA
CreateWindowExA
MessageBoxA
RegisterClassExA
GetWindowTextA
LoadIconA
GetClientRect
UnregisterClassA
PostQuitMessage
UpdateWindow
SetWindowRgn
SetWindowPos
GetWindowRect
DefWindowProcA
SetWindowTextA
DestroyWindow
IsWindow
ShowCursor
DispatchMessageW
LoadCursorA
RegisterClassA
AdjustWindowRect
GetDC
GetDesktopWindow
ReleaseDC
SetForegroundWindow
TranslateMessage
GetWindowTextW
PeekMessageW
GetSystemMetrics
ShowWindow

gdi32

CreateFontA
CreateRoundRectRgn
CreateBitmap
GetDeviceCaps
SetTextColor
SetBkColor
CreateSolidBrush
DeleteObject

advapi32

CryptAcquireContextW
CryptGenRandom
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
GetUserNameA
RegCreateKeyExA
GetCurrentHwProfileA

shell32

CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteA

ole32

OleUninitialize
CoTaskMemFree
OleSetContainedObject
CoInitialize
CoCreateInstance
OleInitialize
CoGetClassObject
CoUninitialize

oleaut32

VariantCopy
VariantClear
VariantInit
SysAllocString

ntdll

NtQueryObject
RtlPcToFileHeader
VerSetConditionMask

ws2_32

getpeername
getsockname
freeaddrinfo
ntohl
gethostbyname
connect
closesocket
send
WSASetLastError
recv
sendto
recvfrom
__WSAFDIsSet
select
ioctlsocket
socket
setsockopt
htonl
htons
bind
WSAStartup
WSACleanup
WSAEnumNetworkEvents
getsockopt
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
WSAGetLastError
WSAIoctl
listen
accept
ntohs
getaddrinfo

dwmapi

DwmSetWindowAttribute

dbghelp

MiniDumpWriteDump

bcrypt

BCryptGenRandom

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 448KB - Virtual size: 448KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 148KB - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 582KB - Virtual size: 581KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c1541179d766bad112cab5c52584f495

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ntdll

ws2_32

dwmapi

dbghelp

bcrypt

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 448KB - Virtual size: 448KB

.data Size: 148KB - Virtual size: 392KB

.pdata Size: 47KB - Virtual size: 47KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 582KB - Virtual size: 581KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 448KB - Virtual size: 448KB

.data
Size: 148KB - Virtual size: 392KB

.pdata
Size: 47KB - Virtual size: 47KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 582KB - Virtual size: 581KB

.reloc
Size: 12KB - Virtual size: 12KB