AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
Static task
static1
1 signatures
General
-
Target
boiii.exe
-
Size
2.6MB
-
MD5
14378716061897cbeb24d74007dd4178
-
SHA1
a1c44afaf634547ed7116f0e1eb3dff0a601d752
-
SHA256
c5a67df0ab284af24753da2dcb6e038c79d60785c1c140a9fdb4b40cec2a937d
-
SHA512
041abbadeaede1803f6d9c5f78e82511bcf7626e043090376088366b962ef867945907b8461eca185709c7f78b56bf4289cf5da8a6491bd28a357a6097cb8723
-
SSDEEP
49152:Jpjix3u4mAxSz/YD/kyotm/tM9WEkmrH:J9g+O/Botd9WEnj
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource boiii.exe
Files
-
boiii.exe.exe windows x64
715a8b7a9a2698553d0116867656294f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
crypt32
CertCloseStore
CertEnumCertificatesInStore
CryptStringToBinaryA
CertFreeCertificateContext
PFXImportCertStore
CryptDecodeObjectEx
CertGetCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CryptProtectData
CertOpenStore
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringA
CertFindExtension
CertCreateCertificateChainEngine
CertFindCertificateInStore
kernel32
CreateMutexExA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
MoveFileExA
FormatMessageW
SleepEx
GetEnvironmentVariableA
VerifyVersionInfoW
GetSystemDirectoryA
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
InitializeCriticalSection
OpenProcess
AddVectoredExceptionHandler
OutputDebugStringA
GetVolumeInformationA
LocalFree
CreateMutexA
GetLastError
CloseHandle
SetProcessAffinityMask
GetProcessAffinityMask
MulDiv
SetConsoleTitleA
AttachConsole
AllocConsole
GetConsoleWindow
SetEnvironmentVariableA
GetCurrentThreadId
GetVersionExA
SetUnhandledExceptionFilter
K32GetModuleInformation
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
CreateThread
GetTickCount64
DeleteCriticalSection
DecodePointer
GetProcAddress
GetTickCount
WaitForSingleObject
GetCommandLineA
ExitProcess
VirtualProtect
MultiByteToWideChar
GetCurrentDirectoryA
InitializeCriticalSectionEx
WriteConsoleW
SetEndOfFile
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapSize
ReadConsoleW
GetFileSizeEx
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
GetTimeZoneInformation
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStdHandle
FreeLibraryAndExitThread
ExitThread
RtlUnwind
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetCPInfo
CompareStringEx
LCMapStringEx
EncodePointer
ReadFile
WriteFile
PeekNamedPipe
CreateFileW
WaitNamedPipeW
lstrlenW
GetModuleFileNameW
HeapCreate
HeapFree
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
HeapAlloc
HeapDestroy
GetThreadContext
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
SizeofResource
FindResourceA
GetModuleHandleExA
LoadLibraryA
LockResource
LoadResource
FreeLibrary
CreateProcessA
GetSystemFirmwareTable
DeleteFileW
MoveFileW
GetCommandLineW
GetThreadId
SetFilePointer
GetTempPathA
CreateFileA
GetTempFileNameA
GetModuleHandleA
ReleaseMutex
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
FormatMessageA
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
DeviceIoControl
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
GetModuleHandleExW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
FlushFileBuffers
user32
ShowCursor
IsWindow
DestroyWindow
DefWindowProcA
GetWindowRect
SetWindowPos
SetWindowRgn
UpdateWindow
TranslateMessage
UnregisterClassA
MessageBoxA
GetClientRect
PeekMessageW
ShowWindow
SetWindowTextA
SetFocus
SetWindowLongPtrA
SendMessageA
CreateWindowExA
ReleaseDC
GetDesktopWindow
GetDC
AdjustWindowRect
RegisterClassA
LoadCursorA
RegisterClassExA
SetForegroundWindow
GetMessageA
DispatchMessageA
LoadIconA
GetWindowTextA
DispatchMessageW
GetSystemMetrics
GetWindowTextW
PostQuitMessage
MoveWindow
SetProcessDPIAware
GetWindowLongPtrA
gdi32
CreateRoundRectRgn
CreateFontA
GetDeviceCaps
CreateBitmap
SetTextColor
SetBkColor
CreateSolidBrush
DeleteObject
advapi32
CryptAcquireContextW
CryptGenRandom
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
GetUserNameA
RegCreateKeyExA
GetCurrentHwProfileA
shell32
SHGetFolderPathA
ShellExecuteA
CommandLineToArgvW
SHGetKnownFolderPath
ole32
CoUninitialize
CoInitialize
OleInitialize
CoTaskMemFree
OleUninitialize
CoGetClassObject
OleSetContainedObject
CoCreateInstance
oleaut32
VariantCopy
VariantClear
VariantInit
SysAllocString
ntdll
NtQueryObject
RtlPcToFileHeader
VerSetConditionMask
ws2_32
ntohl
ntohs
bind
htons
htonl
setsockopt
socket
ioctlsocket
select
__WSAFDIsSet
recvfrom
sendto
recv
WSASetLastError
accept
getaddrinfo
freeaddrinfo
getpeername
getsockname
gethostbyname
connect
closesocket
send
listen
WSAStartup
WSACleanup
WSAEnumNetworkEvents
getsockopt
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
WSAGetLastError
WSAIoctl
dwmapi
DwmSetWindowAttribute
dbghelp
MiniDumpWriteDump
bcrypt
BCryptGenRandom
Exports
Exports
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 452KB - Virtual size: 451KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 150KB - Virtual size: 394KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 685KB - Virtual size: 684KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ