boiii[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

boiii.exe
Size

2.5MB
MD5

a06e431acf3d0bb1cfcb93a8760276d2
SHA1

05197a5cbae6a6f6b17dcb6252ff09342bfc6b9f
SHA256

2a8ed51131cc0485f6b2b769288bad347a21618314d9d46c47d16b2df0fae052
SHA512

b056e2e035e4b3a067846343bd0c9824088fa16abbf02b1932377698a6b2ac546aba2c096d7c7c92fc689774091271c8eec7b54559495c18766cfaef5e2efcd5
SSDEEP

49152:8pf1YbRWt3DhCX7EhVfwX+ZseGlJM7WEkmrH:8JD1jvZsXoWEnj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
boiii.exe

Files

boiii.exe
.exe windows:6 windows x64 arch:x64

2652d262e0eaafed0427e05fa1ca7cb4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\boiii-free\boiii-free\build\bin\x64\Release\boiii.pdb

Imports

crypt32

CertCloseStore
CertEnumCertificatesInStore
CryptStringToBinaryA
CertFreeCertificateContext
PFXImportCertStore
CryptDecodeObjectEx
CertGetCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CryptProtectData
CertOpenStore
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringA
CertFindExtension
CertCreateCertificateChainEngine
CertFindCertificateInStore

kernel32

CreateMutexExA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
RtlUnwind
SetThreadContext
GetThreadContext
HeapDestroy
HeapCreate
MoveFileExA
FormatMessageW
SleepEx
VerifyVersionInfoW
GetSystemDirectoryA
MapViewOfFile
CreateFileMappingW
OutputDebugStringA
InitializeCriticalSection
OpenProcess
AddVectoredExceptionHandler
GetProcAddress
GetVolumeInformationA
LocalFree
CreateMutexA
GetLastError
CloseHandle
SetProcessAffinityMask
GetProcessAffinityMask
MulDiv
SetConsoleTitleA
AttachConsole
AllocConsole
GetConsoleWindow
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
CreateThread
GetTickCount64
GetEnvironmentVariableA
DeleteCriticalSection
UnmapViewOfFile
InitializeCriticalSectionEx
GetTickCount
WaitForSingleObject
GetCommandLineA
ExitProcess
VirtualProtect
GetModuleHandleA
GetCurrentThreadId
GetVersionExA
SetUnhandledExceptionFilter
GetCurrentDirectoryA
DecodePointer
WriteConsoleW
SetEndOfFile
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapSize
ReadConsoleW
GetFileSizeEx
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
HeapReAlloc
GetTimeZoneInformation
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetStdHandle
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetStringTypeW
ReadFile
WriteFile
PeekNamedPipe
CreateFileW
WaitNamedPipeW
lstrlenW
GetModuleFileNameW
SizeofResource
FindResourceA
GetModuleHandleExA
LoadLibraryA
LockResource
LoadResource
FreeLibrary
CreateProcessA
VirtualFree
VirtualAlloc
GetSystemInfo
FlushInstructionCache
GetSystemFirmwareTable
DeleteFileW
MoveFileW
VirtualQuery
GetCommandLineW
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetThreadId
OpenThread
SetFilePointer
GetTempPathA
CreateFileA
GetTempFileNameA
FlushFileBuffers
ReleaseMutex
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
Sleep
GetExitCodeThread
GetNativeSystemInfo
FormatMessageA
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
DeviceIoControl
GetModuleHandleW
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
GetModuleHandleExW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
ReleaseSRWLockExclusive

user32

RegisterClassExA
SetForegroundWindow
GetMessageA
DispatchMessageA
MoveWindow
GetWindowLongPtrA
SetProcessDPIAware
SetWindowLongPtrA
SendMessageA
GetSystemMetrics
MessageBoxA
LoadIconA
LoadCursorA
UnregisterClassA
PostQuitMessage
UpdateWindow
SetWindowRgn
SetWindowPos
GetWindowRect
SetFocus
DefWindowProcA
DestroyWindow
IsWindow
ShowCursor
DispatchMessageW
TranslateMessage
RegisterClassA
AdjustWindowRect
GetDC
GetDesktopWindow
ReleaseDC
CreateWindowExA
GetClientRect
PeekMessageW
GetWindowTextW
ShowWindow
GetWindowTextA
SetWindowTextA

gdi32

CreateRoundRectRgn
CreateFontA
GetDeviceCaps
CreateBitmap
SetTextColor
SetBkColor
CreateSolidBrush
DeleteObject

advapi32

CryptAcquireContextW
CryptGenRandom
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
GetUserNameA
RegCreateKeyExA
GetCurrentHwProfileA

shell32

CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteA

ole32

CoInitialize
OleInitialize
CoTaskMemFree
CoUninitialize
OleUninitialize
CoGetClassObject
CoCreateInstance
OleSetContainedObject

oleaut32

VariantCopy
VariantClear
VariantInit
SysAllocString

ntdll

RtlPcToFileHeader
NtQueryObject
VerSetConditionMask

ws2_32

freeaddrinfo
getaddrinfo
getpeername
getsockname
gethostbyname
connect
closesocket
send
WSASetLastError
recv
sendto
recvfrom
__WSAFDIsSet
select
ioctlsocket
socket
setsockopt
htonl
WSAStartup
WSACleanup
WSAEnumNetworkEvents
getsockopt
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
WSAGetLastError
WSAIoctl
listen
accept
ntohl
ntohs
htons
bind

dwmapi

DwmSetWindowAttribute

dbghelp

MiniDumpWriteDump

bcrypt

BCryptGenRandom

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 439KB - Virtual size: 439KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 150KB - Virtual size: 394KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 685KB - Virtual size: 684KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2652d262e0eaafed0427e05fa1ca7cb4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ntdll

ws2_32

dwmapi

dbghelp

bcrypt

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 439KB - Virtual size: 439KB

.data Size: 150KB - Virtual size: 394KB

.pdata Size: 48KB - Virtual size: 48KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 685KB - Virtual size: 684KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 439KB - Virtual size: 439KB

.data
Size: 150KB - Virtual size: 394KB

.pdata
Size: 48KB - Virtual size: 48KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 685KB - Virtual size: 684KB

.reloc
Size: 13KB - Virtual size: 12KB