boiii[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

boiii.exe
Size

2.6MB
MD5

97bfa7a540f19c30482674b2f21b67f9
SHA1

6894ecf6ad21f4d235c239d88ff707bf65cb1cfa
SHA256

d081be1b5d2a03669ebb3e6da0bbaec5719eff055f2fa0907f9c14babc52805d
SHA512

31a5d89d5a2c6b2b728831344c4e0ce57940f75eb0e18a6f7e6442f79c820471de1a0d779c29e10c8218e2ab3aefb4a2f16b1b9cb15c87c2910e348dbf7a5347
SSDEEP

49152:8fon7Bdlt0qstfATd66FaebBiUJWEkmrH:4o7HGd68ebLWEnj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
boiii.exe

Files

boiii.exe
.exe windows:6 windows x64 arch:x64

ead638135bbe0dd6279bc544317fc101

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Documents\ezz-actions-runner\_work\boiii-free\boiii-free\build\bin\x64\Release\boiii.pdb

Imports

crypt32

CertCloseStore
CertEnumCertificatesInStore
CryptStringToBinaryA
CertFreeCertificateContext
PFXImportCertStore
CryptDecodeObjectEx
CertGetCertificateChain
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
CryptProtectData
CertOpenStore
CryptQueryObject
CertFreeCertificateChain
CertGetNameStringA
CertFindExtension
CertCreateCertificateChainEngine
CertFindCertificateInStore

kernel32

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetThreadContext
GetThreadContext
HeapDestroy
HeapCreate
MoveFileExA
FormatMessageW
SleepEx
GetEnvironmentVariableA
VerifyVersionInfoW
GetSystemDirectoryA
MapViewOfFile
CreateFileMappingW
CreateMutexExA
InitializeCriticalSection
OpenProcess
AddVectoredExceptionHandler
GetProcAddress
GetVolumeInformationA
LocalFree
CreateMutexA
GetLastError
CloseHandle
SetProcessAffinityMask
GetProcessAffinityMask
MulDiv
SetConsoleTitleA
AttachConsole
AllocConsole
GetConsoleWindow
SetEnvironmentVariableA
OutputDebugStringA
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
CreateThread
GetTickCount64
DeleteCriticalSection
UnmapViewOfFile
InitializeCriticalSectionEx
GetTickCount
WaitForSingleObject
GetCommandLineA
ExitProcess
VirtualProtect
GetModuleHandleA
GetCurrentThreadId
GetVersionExA
SetUnhandledExceptionFilter
GetCurrentDirectoryA
DecodePointer
WriteConsoleW
SetEndOfFile
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapSize
ReadConsoleW
GetFileSizeEx
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
HeapReAlloc
GetTimeZoneInformation
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetStdHandle
FreeLibraryAndExitThread
ExitThread
RtlUnwind
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
CreateEventW
ResetEvent
ReadFile
WriteFile
PeekNamedPipe
CreateFileW
WaitNamedPipeW
lstrlenW
GetModuleFileNameW
SizeofResource
FindResourceA
GetModuleHandleExA
LoadLibraryA
LockResource
LoadResource
FreeLibrary
CreateProcessA
VirtualFree
VirtualAlloc
GetSystemInfo
FlushInstructionCache
GetSystemFirmwareTable
DeleteFileW
MoveFileW
VirtualQuery
GetCommandLineW
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetThreadId
OpenThread
SetFilePointer
GetTempPathA
CreateFileA
GetTempFileNameA
FlushFileBuffers
ReleaseMutex
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
MultiByteToWideChar
WaitForSingleObjectEx
Sleep
GetExitCodeThread
GetNativeSystemInfo
FormatMessageA
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
DeviceIoControl
GetModuleHandleW
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
GetModuleHandleExW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetEvent
TryAcquireSRWLockExclusive

user32

DispatchMessageA
MoveWindow
GetWindowLongPtrA
SetProcessDPIAware
SetWindowTextA
SetFocus
SetWindowLongPtrA
SendMessageA
GetSystemMetrics
SetForegroundWindow
LoadIconA
LoadCursorA
RegisterClassExA
GetClientRect
MessageBoxA
UnregisterClassA
PostQuitMessage
UpdateWindow
SetWindowRgn
SetWindowPos
GetWindowRect
ShowWindow
DefWindowProcA
DestroyWindow
IsWindow
RegisterClassA
AdjustWindowRect
GetDC
GetDesktopWindow
ReleaseDC
CreateWindowExA
GetMessageA
ShowCursor
DispatchMessageW
GetWindowTextW
TranslateMessage
GetWindowTextA
PeekMessageW

gdi32

CreateFontA
CreateRoundRectRgn
CreateBitmap
GetDeviceCaps
SetTextColor
SetBkColor
CreateSolidBrush
DeleteObject

advapi32

CryptAcquireContextW
CryptGenRandom
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
GetUserNameA
RegCreateKeyExA
GetCurrentHwProfileA

shell32

SHGetKnownFolderPath
CommandLineToArgvW
ShellExecuteA
SHGetFolderPathA

ole32

OleUninitialize
CoTaskMemFree
OleSetContainedObject
CoInitialize
CoCreateInstance
OleInitialize
CoGetClassObject
CoUninitialize

oleaut32

VariantCopy
VariantClear
VariantInit
SysAllocString

ntdll

NtQueryObject
RtlPcToFileHeader
VerSetConditionMask

ws2_32

getpeername
getsockname
freeaddrinfo
ntohl
gethostbyname
connect
closesocket
send
WSASetLastError
recv
sendto
recvfrom
__WSAFDIsSet
select
ioctlsocket
socket
setsockopt
htonl
htons
bind
WSAStartup
WSACleanup
WSAEnumNetworkEvents
getsockopt
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSACreateEvent
WSACloseEvent
WSAGetLastError
WSAIoctl
listen
accept
ntohs
getaddrinfo

dwmapi

DwmSetWindowAttribute

dbghelp

MiniDumpWriteDump

bcrypt

BCryptGenRandom

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 451KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 150KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 685KB - Virtual size: 684KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ead638135bbe0dd6279bc544317fc101

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ntdll

ws2_32

dwmapi

dbghelp

bcrypt

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 451KB - Virtual size: 451KB

.data Size: 150KB - Virtual size: 393KB

.pdata Size: 48KB - Virtual size: 48KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 685KB - Virtual size: 684KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 451KB - Virtual size: 451KB

.data
Size: 150KB - Virtual size: 393KB

.pdata
Size: 48KB - Virtual size: 48KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 685KB - Virtual size: 684KB

.reloc
Size: 13KB - Virtual size: 12KB