boiii[.]exe | Triage

Resubmissions

05-04-2024 18:49

240405-xgdmlsbd6v 3

05-04-2024 18:48

240405-xfyw6abh69 3

Sharing

Copy URL

Twitter E-mail

General

Target

boiii.exe
Size

2.5MB
MD5

2cc3292db6248bf722c10820b0440386
SHA1

97368ba537202268ea45e41d4b1ca7b2f759b76a
SHA256

ea45a595246d04c975da85787772cdaeb46b957b4bf138d52a876e1e6428dd87
SHA512

29184e2e0f564d19f846c467d9235f68807a4e17dc9ac9d4fcfd444bc5af17247e0629543733e26f5a16bf91c3e43139facef6595d94c1cdc484a042baaf6318
SSDEEP

49152:6NyPGNRnUUGdjwHw34jMHP6owHVWEkmrH:6NyKg2jM6o2WEnj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
boiii.exe

Files

boiii.exe
.exe windows:6 windows x64 arch:x64

860344d00f2cbf3973bd4de6fb861a29

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\hgmpl\Pictures\boiii\build\bin\x64\Release\boiii.pdb

Imports

crypt32

CertCloseStore
CertEnumCertificatesInStore
CryptStringToBinaryA
CertFreeCertificateContext
PFXImportCertStore
CryptDecodeObjectEx
CertGetCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CryptProtectData
CertOpenStore
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringA
CertFindExtension
CertCreateCertificateChainEngine
CertFindCertificateInStore

kernel32

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetThreadContext
GetThreadContext
HeapDestroy
HeapCreate
MoveFileExA
FormatMessageW
SleepEx
GetEnvironmentVariableA
VerifyVersionInfoW
GetSystemDirectoryA
MapViewOfFile
CreateFileMappingW
CreateMutexExA
InitializeCriticalSection
OpenProcess
AddVectoredExceptionHandler
GetProcAddress
GetVolumeInformationA
LocalFree
CreateMutexA
GetLastError
CloseHandle
SetProcessAffinityMask
GetProcessAffinityMask
MulDiv
SetConsoleTitleA
AttachConsole
AllocConsole
GetConsoleWindow
SetEnvironmentVariableA
OutputDebugStringA
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
CreateThread
GetTickCount64
DeleteCriticalSection
UnmapViewOfFile
InitializeCriticalSectionEx
GetTickCount
WaitForSingleObject
GetCommandLineA
ExitProcess
VirtualProtect
GetModuleHandleA
GetCurrentThreadId
GetVersionExA
SetUnhandledExceptionFilter
GetCurrentDirectoryA
DecodePointer
WriteConsoleW
SetEndOfFile
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapSize
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
GetTimeZoneInformation
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetStdHandle
FreeLibraryAndExitThread
ExitThread
RtlUnwind
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
CreateEventW
ReadFile
WriteFile
PeekNamedPipe
CreateFileW
WaitNamedPipeW
lstrlenW
GetModuleFileNameW
SizeofResource
FindResourceA
GetModuleHandleExA
LoadLibraryA
LockResource
LoadResource
FreeLibrary
CreateProcessA
VirtualFree
VirtualAlloc
GetSystemInfo
FlushInstructionCache
GetSystemFirmwareTable
DeleteFileW
MoveFileW
VirtualQuery
GetCommandLineW
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetThreadId
OpenThread
SetFilePointer
GetTempPathA
CreateFileA
GetTempFileNameA
FlushFileBuffers
ReleaseMutex
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
MultiByteToWideChar
WaitForSingleObjectEx
Sleep
GetExitCodeThread
GetNativeSystemInfo
FormatMessageA
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
DeviceIoControl
GetModuleHandleW
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
GetModuleHandleExW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
TryAcquireSRWLockExclusive

user32

GetMessageA
DispatchMessageA
MoveWindow
GetWindowLongPtrA
SetProcessDPIAware
SetWindowTextA
SetFocus
SetWindowLongPtrA
SendMessageA
GetSystemMetrics
RegisterClassExA
LoadIconA
LoadCursorA
GetClientRect
MessageBoxA
UnregisterClassA
PostQuitMessage
UpdateWindow
SetWindowRgn
SetWindowPos
GetWindowRect
ShowWindow
DefWindowProcA
DestroyWindow
IsWindow
ShowCursor
RegisterClassA
AdjustWindowRect
GetDC
GetDesktopWindow
ReleaseDC
CreateWindowExA
SetForegroundWindow
DispatchMessageW
GetWindowTextW
TranslateMessage
GetWindowTextA
PeekMessageW

gdi32

CreateFontA
CreateRoundRectRgn
CreateBitmap
GetDeviceCaps
SetTextColor
SetBkColor
CreateSolidBrush
DeleteObject

advapi32

CryptAcquireContextW
CryptGenRandom
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
GetUserNameA
RegCreateKeyExA
GetCurrentHwProfileA

shell32

CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteA

ole32

OleUninitialize
CoTaskMemFree
OleSetContainedObject
CoInitialize
CoCreateInstance
OleInitialize
CoGetClassObject
CoUninitialize

oleaut32

VariantCopy
VariantClear
VariantInit
SysAllocString

ntdll

NtQueryObject
RtlPcToFileHeader
VerSetConditionMask

ws2_32

getpeername
getsockname
freeaddrinfo
ntohl
gethostbyname
connect
closesocket
send
WSASetLastError
recv
sendto
recvfrom
__WSAFDIsSet
select
ioctlsocket
socket
setsockopt
htonl
htons
bind
WSAStartup
WSACleanup
WSAEnumNetworkEvents
getsockopt
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
WSAGetLastError
WSAIoctl
listen
accept
ntohs
getaddrinfo

dwmapi

DwmSetWindowAttribute

dbghelp

MiniDumpWriteDump

bcrypt

BCryptGenRandom

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 450KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 150KB - Virtual size: 394KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 582KB - Virtual size: 581KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

860344d00f2cbf3973bd4de6fb861a29

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ntdll

ws2_32

dwmapi

dbghelp

bcrypt

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 450KB - Virtual size: 450KB

.data Size: 150KB - Virtual size: 394KB

.pdata Size: 48KB - Virtual size: 48KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 582KB - Virtual size: 581KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 450KB - Virtual size: 450KB

.data
Size: 150KB - Virtual size: 394KB

.pdata
Size: 48KB - Virtual size: 48KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 582KB - Virtual size: 581KB

.reloc
Size: 13KB - Virtual size: 12KB