BioIso[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BioIso.exe
Size

728KB
MD5

a6cf19d44ed3e7b17cf1568577ded266
SHA1

b7029312d45f8d21f45c39978c0cdac623fe5d9b
SHA256

ccc68738cc7da7516a9c8b35c23cff8b9c278e8b059c698fa2c4be31c7a5a4e4
SHA512

b3111fcb8d00fbc65e68ecef9496647f166d7395de360cca86e22fb47ddd8ebbc1a6ae5dded2a7fe549c2905e6610861323c3390b77e70e701b02a397001517a
SSDEEP

6144:NSpU4EgQnVu7snutn+PE8UX4a/9mzuPxcZN4INBby170h0z4AcDpvleakvRWly9b:2TQYocia/9mzuPmTZby170h0z4AepNkF

Score

1^/10

Malware Config

Signatures

Files

BioIso.exe
.exe windows x64

3f5b796077b309628770294c7b57ec57

Code Sign

33:00:00:03:12:75:62:47:81:61:e8:1f:04:00:00:00:00:03:12
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/06/2021, 18:55

Not After

09/06/2022, 18:55

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a1:91:43:6a:3e:a7:16:b0:1a:1f:57:34:b2:1d:b3:22:94:64:0e:e0:90:3c:ad:ce:3a:80:d2:01:be:08:07:dc
Signer

Actual PE Digest

a1:91:43:6a:3e:a7:16:b0:1a:1f:57:34:b2:1d:b3:22:94:64:0e:e0:90:3c:ad:ce:3a:80:d2:01:be:08:07:dc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_initterm
_c_exit
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__crt_atexit
memmove
_o_atoi
_o_bsearch_s
_o_exit
_o_free
_o_isdigit
_o_malloc
_o_terminate
_o_towupper
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
SetEvent
InitializeCriticalSectionAndSpinCount
ResetEvent
ReleaseSRWLockShared
CreateSemaphoreExW
ReleaseSemaphore
CreateMutexExW
LeaveCriticalSection
EnterCriticalSection
OpenEventW
OpenSemaphoreW
WaitForSingleObjectEx
CreateEventW
DeleteCriticalSection

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThread
OpenThreadToken
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
OpenProcessToken
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWriteTransfer
EventSetInformation
EventActivityIdControl
EventRegister

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-security-base-l1-1-0

GetLengthSid
IsValidSid
GetTokenInformation
EqualSid

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-core-sysinfo-l1-1-0

GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount64

api-ms-win-core-file-l1-1-0

CompareFileTime

rpcrt4

RpcServerListen
RpcServerUseProtseqIfW
RpcServerRegisterIfEx
RpcServerUnregisterIf
NdrServerCall2
RpcMgmtWaitServerListen
RpcMgmtStopServerListening
RpcRevertToSelfEx
RpcImpersonateClient
UuidFromStringA
NdrServerCallAll

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-memory-l1-1-0

VirtualQuery
MapViewOfFile
UnmapViewOfFile

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
RtlCompareMemory

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

ntdll

RtlTimeFieldsToTime
RtlFreeHeap
RtlEqualSid
NtQuerySystemInformation
RtlImageNtHeader
RtlNtStatusToDosError
RtlAllocateHeap

iumsdk

GetSignedReport
EncryptData
GetTaggedData
GetSecureIdentitySigningKey
OpenSecureSection
GetTaggedDataSize
DecryptData

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

__ImagePolicyMetadata

Sections

.text
Size: 539KB - Virtual size: 538KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tPolicy
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGECONS
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGEDATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f5b796077b309628770294c7b57ec57

Code Sign

33:00:00:03:12:75:62:47:81:61:e8:1f:04:00:00:00:00:03:12Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

a1:91:43:6a:3e:a7:16:b0:1a:1f:57:34:b2:1d:b3:22:94:64:0e:e0:90:3c:ad:ce:3a:80:d2:01:be:08:07:dcSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

rpcrt4

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

ntdll

iumsdk

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 539KB - Virtual size: 538KB

PAGE Size: 5KB - Virtual size: 4KB

.rdata Size: 125KB - Virtual size: 125KB

.data Size: 3KB - Virtual size: 6KB

.pdata Size: 17KB - Virtual size: 17KB

.didat Size: 512B - Virtual size: 200B

.tPolicy Size: 1KB - Virtual size: 1KB

PAGECONS Size: 12KB - Virtual size: 12KB

PAGEDATA Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 3KB - Virtual size: 2KB

33:00:00:03:12:75:62:47:81:61:e8:1f:04:00:00:00:00:03:12
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

a1:91:43:6a:3e:a7:16:b0:1a:1f:57:34:b2:1d:b3:22:94:64:0e:e0:90:3c:ad:ce:3a:80:d2:01:be:08:07:dc
Signer

.text
Size: 539KB - Virtual size: 538KB

PAGE
Size: 5KB - Virtual size: 4KB

.rdata
Size: 125KB - Virtual size: 125KB

.data
Size: 3KB - Virtual size: 6KB

.pdata
Size: 17KB - Virtual size: 17KB

.didat
Size: 512B - Virtual size: 200B

.tPolicy
Size: 1KB - Virtual size: 1KB

PAGECONS
Size: 12KB - Virtual size: 12KB

PAGEDATA
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 3KB - Virtual size: 2KB