BoyKisserUncentral[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

BoyKisserUncentral.exe
Size

1.6MB
MD5

840b8b53214874a8f83dbc930e8bb422
SHA1

16c843110f5805d289caba1af16315688d8131b1
SHA256

3c4776a8a42705c258a95669b44ef418aeb8bb4d57e7a72747fc98672174466b
SHA512

72b2a9a4b8484c2dc178a63df490598cd511a060323c4cf018f2c267dcb5da1770cb81d8cf35cb32ca757b2e907fc0f49b6e0e86b8777bb898c6cfa55af85f97
SSDEEP

24576:+4/cHicUTKPmH2rEvBkzjCqSUDNyJQzx0DuMTr5gMQn6521O8Wb:+40CciJ2Ev8CUHxcLr5gTj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BoyKisserUncentral.exe

Files

BoyKisserUncentral.exe
.exe windows:6 windows x64 arch:x64

4c7ddd16be37c74b28aba294eae12eae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

CreateToolhelp32Snapshot
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Process32Next
OpenProcess
VirtualAllocEx
GetOverlappedResult
IsDebuggerPresent
GetQueuedCompletionStatusEx
InitializeSListHead
GetSystemTimeAsFileTime
CreateIoCompletionPort
SwitchToThread
GetConsoleScreenBufferInfo
SetHandleInformation
CreateFileW
WaitForMultipleObjects
GetCurrentThread
MultiByteToWideChar
WriteConsoleW
SetLastError
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
FillConsoleOutputAttribute
FormatMessageW
lstrlenW
GetEnvironmentVariableW
SetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
CreateDirectoryW
GetFileInformationByHandle
FindFirstFileW
SetFileCompletionNotificationModes
ReadConsoleW
IsProcessorFeaturePresent
FillConsoleOutputCharacterA
SetConsoleMode
Sleep
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentProcess
DuplicateHandle
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
CreateEventW
CancelIo
ReadFile
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
RtlVirtualUnwind
GetSystemTimePreciseAsFileTime
PostQueuedCompletionStatus
SetConsoleCursorPosition
GetExitCodeProcess
GetFileInformationByHandleEx
HeapReAlloc
HeapFree
SetThreadStackGuarantee
FindClose
WaitForSingleObject
AddVectoredExceptionHandler
VirtualFreeEx
CreateRemoteThread
GetProcAddress
WideCharToMultiByte
GetConsoleMode
GetLastError
GetStdHandle
SetConsoleTitleW
CloseHandle
GetCurrentThreadId
GetModuleHandleA
GetModuleHandleW
WriteProcessMemory

ws2_32

WSASend
shutdown
WSASocketW
recv
ioctlsocket
send
getsockopt
bind
closesocket
setsockopt
freeaddrinfo
WSAStartup
WSAIoctl
getpeername
WSACleanup
connect
getsockname
WSAGetLastError
getaddrinfo

ntdll

NtReadFile
NtWriteFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile

secur32

ApplyControlToken
FreeContextBuffer
DeleteSecurityContext
FreeCredentialsHandle
EncryptMessage
QueryContextAttributesW
AcquireCredentialsHandleA
AcceptSecurityContext
InitializeSecurityContextW
DecryptMessage

crypt32

CertFreeCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateChain
CertDuplicateCertificateContext

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

psapi

GetModuleBaseNameW

vcruntime140

__current_exception_context
memcpy
__current_exception
__CxxFrameHandler3
__C_specific_handler
memcmp
memmove
memset

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
exit
_exit
_initialize_narrow_environment
__p___argc
_set_app_type
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_seh_filter_exe
_get_initial_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
__p___argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 901KB - Virtual size: 901KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 527KB - Virtual size: 526KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c7ddd16be37c74b28aba294eae12eae

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ws2_32

ntdll

secur32

crypt32

advapi32

psapi

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 901KB - Virtual size: 901KB

.rdata Size: 527KB - Virtual size: 526KB

.data Size: 7KB - Virtual size: 8KB

.pdata Size: 29KB - Virtual size: 29KB

.rsrc Size: 110KB - Virtual size: 110KB

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 901KB - Virtual size: 901KB

.rdata
Size: 527KB - Virtual size: 526KB

.data
Size: 7KB - Virtual size: 8KB

.pdata
Size: 29KB - Virtual size: 29KB

.rsrc
Size: 110KB - Virtual size: 110KB

.reloc
Size: 14KB - Virtual size: 13KB