Boost[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Boost.dll
Size 3.2MB
Sample260715-cehtbsb19v
SHA256 f69d0f0610030b11aaed55f2c34ac4ba80625333b6dea1f312b06192c62d4ac9
MD5 35ebb6caa0ca9125f73f70ad2271feda
SHA1 2f82a89b3be072159fbe0b746e3551704e9ceac4
SHA512 67059da40ad760338f0799a2e93d1cda1256356bae4b53a2817a84a5d3ba84e8bbad94f4ae2e50a5ca4f67533c8dd1da1534add4dc25bf8f9d0fcccf1cd1dd59
SSDEEP 49152:eNlU/mO7I6cyWYfGbni7sE3uiluEY9M94GF07BWauWlmmJlgle54sPPw7:gKf2i7ruilB99F07BTuWgmLgle5X
TLSH
T192F59E1575E10594D0A8C1B8CE43A73BEB3178848B724AE717E0D7B5AF727E06A3EE50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Boost.dll

File Explorer

Boost.dll

.dll 3.2MB

Boost.dll

IMPHASH acda6f6a4ab50ea2c09655c4192530d7
SHA256 f69d0f0610030b11aaed55f2c34ac4ba80625333b6dea1f312b06192c62d4ac9
MD5 35ebb6caa0ca9125f73f70ad2271feda
SHA1 2f82a89b3be072159fbe0b746e3551704e9ceac4
SHA512 67059da40ad760338f0799a2e93d1cda1256356bae4b53a2817a84a5d3ba84e8bbad94f4ae2e50a5ca4f67533c8dd1da1534add4dc25bf8f9d0fcccf1cd1dd59
SSDEEP 49152:eNlU/mO7I6cyWYfGbni7sE3uiluEY9M94GF07BWauWlmmJlgle54sPPw7:gKf2i7ruilB99F07BTuWgmLgle5X
TLSH
T192F59E1575E10594D0A8C1B8CE43A73BEB3178848B724AE717E0D7B5AF727E06A3EE50
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1619244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\famig\source\repos\DaniIsBack\x64\Release\Boost.pdb

dwrite

DWriteCreateFactory

d2d1

ord1

wininet

InternetOpenA InternetSetOptionA HttpOpenRequestW InternetOpenW InternetOpenUrlA InternetReadFile HttpSendRequestA HttpQueryInfoA HttpOpenRequestA InternetCrackUrlA InternetConnectA InternetConnectW InternetCloseHandle

kernel32

GlobalUnlock Sleep VirtualQuery CreateDirectoryW ReadFile SetFilePointer CreateFileW GetFileAttributesW GetLastError CloseHandle GetTickCount LoadLibraryExW ReleaseSemaphore WriteFile SetThreadPriority WaitForSingleObject GetFileInformationByHandle CreateFileA SetEvent LoadLibraryA QueryPerformanceFrequency CreateThread ResetEvent FreeLibrary CreateSemaphoreW WideCharToMultiByte CreateEventA QueryPerformanceCounter FlushFileBuffers VirtualProtect TerminateProcess FreeLibraryAndExitThread K32EnumProcessModules MultiByteToWideChar GetModuleHandleW K32GetModuleInformation GetEnvironmentVariableA GetSystemTimeAsFileTime AreFileApisANSI CreateFile2 GetTempPathW SetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree VirtualFree VirtualAlloc GetSystemInfo Thread32Next Thread32First CreateToolhelp32Snapshot FlushInstructionCache SetThreadContext GetThreadContext ResumeThread SuspendThread OpenThread GetCurrentThreadId GetCurrentProcessId HeapFree ExitProcess GlobalLock GetProcAddress GlobalFree GlobalAlloc GetTickCount64 GetModuleHandleA lstrlenW GetCurrentProcess GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive HeapReAlloc HeapAlloc HeapDestroy HeapCreate SleepConditionVariableSRW InitializeSListHead SystemTimeToFileTime WakeAllConditionVariable

user32

OpenClipboard EmptyClipboard FindWindowA GetDpiForWindow GetCursorPos GetKeyState CloseClipboard SetWindowTextA MessageBoxA GetForegroundWindow GetClipboardData GetAsyncKeyState SetClipboardData DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW

gdi32

AddFontMemResourceEx RemoveFontMemResourceEx AddFontResourceExW

advapi32

CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData GetCurrentHwProfileW CryptCreateHash CryptAcquireContextW

shell32

ShellExecuteA

ole32

CoCreateInstance CoInitializeEx

msvcp140

?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?uncaught_exceptions@std@@YAHXZ ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Strcoll _Query_perf_counter ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0_Lockit@std@@QEAA@H@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Xbad_function_call@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Random_device@std@@YAIXZ _Mtx_lock _Mtx_unlock _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??7ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency __crtLCMapStringA _Strxfrm ?_Xlength_error@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?id@?$ctype@D@std@@2V0locale@2@A

winmm

mciSendStringW

winhttp

WinHttpSendRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSetOption WinHttpQueryOption WinHttpCrackUrl WinHttpCloseHandle WinHttpOpenRequest WinHttpReceiveResponse WinHttpReadData WinHttpOpen WinHttpConnect

crypt32

CertFreeCertificateContext CryptHashCertificate

bcrypt

BCryptGenRandom BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptGetProperty BCryptFinishHash BCryptCloseAlgorithmProvider

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list _CxxThrowException __current_exception __RTDynamicCast memset __std_exception_destroy __std_exception_copy __std_terminate __std_type_info_compare __std_type_info_hash strchr __RTtypeid __std_type_info_name __C_specific_handler memcmp memcpy memmove __current_exception_context

api-ms-win-crt-stdio-l1-1-0

fflush fputc fsetpos fclose fread _fseeki64 _get_stream_buffer_pointers __stdio_common_vsprintf fopen_s setvbuf fseek fgetpos _wfopen_s __stdio_common_vsnprintf_s ungetc __stdio_common_vsprintf_s fgetc fwrite

api-ms-win-crt-heap-l1-1-0

free calloc _callnewh malloc realloc

api-ms-win-crt-string-l1-1-0

tolower strncpy_s toupper isxdigit isspace isalnum _stricmp strcmp strlen _wcsicmp wcslen

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-runtime-l1-1-0

_errno _beginthreadex terminate _controlfp_s abort _seh_filter_dll _initterm_e _initterm _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-convert-l1-1-0

strtol strtof strtoll strtoul strtoull wcstol strtod

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func ___lc_codepage_func ___lc_collate_cp_func localeconv

api-ms-win-crt-math-l1-1-0

asinf _fdclass _dclass atan2 atan2f ceilf cosf _dsign roundf sinf sqrt sqrtf powf pow fmodf floorf sin exp

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s strftime

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-environment-l1-1-0

_dupenv_s