Borion[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Borion.dll
Size 6.8MB
Sample260703-a79fmsd14r
SHA256 972ab8cad9731b37b4f6f9af931a44ec2ac4dfedc4b943d75f163d4527984bce
MD5 fc17c805025edb8ef36f7260ae5adc49
SHA1 5e97d4fc855b22871767cb7a8383601a42dc2dd9
SHA512 85a9ff81f2f4c6a4588720d6e1e24a8f5a7c490d36fcacb93ab00fae1fbf7ca8817f125de13f2c586ff3dcfd4cba0dffb40278e7e3d65ef4941f8a11ed210257
SSDEEP 98304:NbyXgo1ldI42gcUfVng6wd4MAvvpoQvVVh9DIwWm+:NbigcP8Tm+
TLSH
T11E66C23D18EF05B8E17681F8CED625069AF33C189320A6CB465C5E9ECE7FE9C65A4C11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Borion.dll

File Explorer

Borion.dll

.dll 6.8MB

Borion.dll

IMPHASH b59e04d4eb565e7688bcc65ecafb54ab
SHA256 972ab8cad9731b37b4f6f9af931a44ec2ac4dfedc4b943d75f163d4527984bce
MD5 fc17c805025edb8ef36f7260ae5adc49
SHA1 5e97d4fc855b22871767cb7a8383601a42dc2dd9
SHA512 85a9ff81f2f4c6a4588720d6e1e24a8f5a7c490d36fcacb93ab00fae1fbf7ca8817f125de13f2c586ff3dcfd4cba0dffb40278e7e3d65ef4941f8a11ed210257
SSDEEP 98304:NbyXgo1ldI42gcUfVng6wd4MAvvpoQvVVh9DIwWm+:NbigcP8Tm+
TLSH
T11E66C23D18EF05B8E17681F8CED625069AF33C189320A6CB465C5E9ECE7FE9C65A4C11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3552896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitOnceComplete Sleep

api-ms-win-core-processthreads-l1-1-0

ExitProcess GetCurrentThreadId OpenThread SuspendThread ResumeThread GetCurrentProcessId GetExitCodeThread SwitchToThread CreateThread GetStartupInfoW ExitThread TerminateProcess GetCurrentProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA GetModuleFileNameW FreeLibraryAndExitThread GetModuleHandleW GetModuleHandleExW FreeLibrary GetProcAddress DisableThreadLibraryCalls LoadLibraryExW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetSystemTimeAsFileTime

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW SetStdHandle SetEnvironmentVariableW GetCommandLineA GetCommandLineW GetEnvironmentVariableA GetStdHandle GetEnvironmentStringsW GetCurrentDirectoryW

api-ms-win-core-memory-l1-1-0

VirtualProtect VirtualAlloc VirtualQuery VirtualFree

api-ms-win-core-heap-l2-1-0

GlobalAlloc GlobalFree LocalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetLastError UnhandledExceptionFilter RaiseException SetUnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

HeapSize GetProcessHeap HeapAlloc HeapDestroy HeapReAlloc HeapFree HeapCreate

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent FlushInstructionCache SetThreadContext GetThreadContext

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Thread32First Thread32Next

api-ms-win-core-string-l1-1-0

CompareStringW GetStringTypeW CompareStringEx MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-console-l1-1-0

ReadConsoleW WriteConsoleA GetConsoleMode GetConsoleOutputCP WriteConsoleW

api-ms-win-core-file-l1-1-0

FindFirstFileW WriteFile GetFileSizeEx ReadFile FindNextFileW FlushFileBuffers FindFirstFileExW FindClose GetFileType CreateFileW GetDriveTypeW GetFileInformationByHandle SetFileInformationByHandle GetFullPathNameW DeleteFileW SetEndOfFile GetFileAttributesExW SetFilePointerEx CreateDirectoryW

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformation SystemTimeToTzSpecificLocalTime GetTimeZoneInformation FileTimeToSystemTime

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo SetConsoleTextAttribute

kernel32

IsBadReadPtr

user32

SetClipboardData DefWindowProcA OpenClipboard CloseClipboard EmptyClipboard

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

winmm

PlaySoundA

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx LCMapStringEx FormatMessageA GetUserDefaultLCID IsValidCodePage LCMapStringW GetLocaleInfoW IsValidLocale GetCPInfo GetOEMCP GetACP EnumSystemLocalesW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

CopyFile2 GetFileInformationByHandleEx

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwind RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind RtlPcToFileHeader

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx InitializeCriticalSectionEx DeleteCriticalSection AcquireSRWLockShared ReleaseSRWLockShared EnterCriticalSection

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork SubmitThreadpoolWork FreeLibraryWhenCallbackReturns CloseThreadpoolWork

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedFlushSList

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsFree FlsAlloc FlsGetValue

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

684KB

Virtual Size

683KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Borion.dll

version

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-console-l2-1-0

kernel32

user32

shell32

urlmon

winmm

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-datetime-l1-1-0

generic