boiii[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
boiii.exe
Size 5.9MB
Sample261029-1bsfcsce56
SHA256 e6c49cc3ecb145a05f92bd1051ebcafd9b201cf8c522b26308cce18156491a62
MD5 9957b131ecc02460dd99082ac1edbeae
SHA1 22900a9701b15d742d18778a878f435dfc74cba0
SHA512 8ae0c7bac75b95579e44fe5f813ca307fbf3972da1ddc4e7b0f70ead82a8d52e3bf54ab5d8bec21d481176c50d2330fd517082971c52ad35ac9d9f49438b3913
SSDEEP 49152:1mfb3gcRjXPN0JI2D4jUuuJJBXaIb9XCXkjrCDkWmXbxYrKu+B7Ncv9dvYYu8E2f:gzQcRaJnO4BX3XCQGrcQeWEnrs
TLSH
T145568F037F4614A9C04BC4708247C6374F317CDB1A76A6BF85D66A2A3FBA7B44F29A14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
boiii.exe

File Explorer

boiii.exe

.exe 5.9MB

boiii.exe

IMPHASH 795286d59e34fb2b8b8953f024605c53
SHA256 e6c49cc3ecb145a05f92bd1051ebcafd9b201cf8c522b26308cce18156491a62
MD5 9957b131ecc02460dd99082ac1edbeae
SHA1 22900a9701b15d742d18778a878f435dfc74cba0
SHA512 8ae0c7bac75b95579e44fe5f813ca307fbf3972da1ddc4e7b0f70ead82a8d52e3bf54ab5d8bec21d481176c50d2330fd517082971c52ad35ac9d9f49438b3913
SSDEEP 49152:1mfb3gcRjXPN0JI2D4jUuuJJBXaIb9XCXkjrCDkWmXbxYrKu+B7Ncv9dvYYu8E2f:gzQcRaJnO4BX3XCQGrcQeWEnrs
TLSH
T145568F037F4614A9C04BC4708247C6374F317CDB1A76A6BF85D66A2A3FBA7B44F29A14
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3009296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\boiii-free\boiii-free\build\bin\x64\Release\boiii.pdb

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AllocConsole AreFileApisANSI AttachConsole CloseHandle CloseThreadpoolWork CompareStringEx CompareStringW CopyFile2 CreateDirectoryW CreateFile2 CreateFileA CreateFileMappingW CreateFileW CreateHardLinkW CreateMutexA CreateMutexExA CreatePipe CreateProcessA CreateProcessW CreateSymbolicLinkW CreateThread CreateThreadpoolWork CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceA FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeLibraryWhenCallbackReturns GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLargePageMinimum GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemFirmwareTable GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempFileNameA GetTempPathA GetThreadContext GetThreadId GetTickCount GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVolumeInformationA GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx InitializeSListHead IsBadReadPtr IsDBCSLeadByte IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetModuleInformation LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile MoveFileExA MoveFileExW MoveFileW MulDiv MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA OutputDebugStringW PeekNamedPipe Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleTitleA SetCurrentDirectoryA SetEndOfFile SetEnvironmentVariableA SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetProcessAffinityMask SetStdHandle SetThreadContext SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SleepEx SubmitThreadpoolWork SuspendThread SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread Thread32First Thread32Next UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolWorkCallbacks WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrlenW

user32

AdjustWindowRect BeginPaint CallWindowProcA ClientToScreen CloseClipboard CreateCaret CreateWindowExA CreateWindowExW DefWindowProcA DefWindowProcW DestroyWindow DispatchMessageA DispatchMessageW DrawTextA EmptyClipboard EndPaint FillRect GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetDesktopWindow GetFocus GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageA GetMessageExtraInfo GetMonitorInfoA GetScrollInfo GetSystemMetrics GetWindowLongPtrA GetWindowRect GetWindowTextA GetWindowTextLengthA GetWindowTextW InvalidateRect IsClipboardFormatAvailable IsIconic IsWindow IsWindowUnicode IsWindowVisible KillTimer LoadCursorA LoadIconA MessageBoxA MessageBoxW MonitorFromWindow MoveWindow OpenClipboard PeekMessageA PeekMessageW PostMessageA PostMessageW PostQuitMessage PtInRect RegisterClassA RegisterClassExA ReleaseCapture ReleaseDC ScreenToClient SendMessageA SendMessageW SetCapture SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetProcessDPIAware SetTimer SetWindowLongPtrA SetWindowPos SetWindowRgn SetWindowTextA ShowCaret ShowCursor ShowWindow TrackMouseEvent TranslateMessage UnregisterClassA UpdateWindow

advapi32

CryptAcquireContextA CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext EventRegister EventSetInformation EventUnregister EventWriteTransfer GetCurrentHwProfileA GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetUserNameA OpenProcessToken RegCloseKey RegCreateKeyExA RegCreateKeyExW RegGetValueA RegGetValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW

gdi32

BitBlt CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreateFontW CreatePen CreateRoundRectRgn CreateSolidBrush DeleteDC DeleteObject EnumFontFamiliesExW GetDeviceCaps GetObjectA GetStockObject LineTo MoveToEx Rectangle RoundRect SelectObject SetBkColor SetBkMode SetTextColor

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteA ShellExecuteW

ole32

CoCreateInstance CoGetClassObject CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize OleSetContainedObject OleUninitialize

oleaut32

SafeArrayCreate SafeArrayDestroy SafeArrayGetLBound SafeArrayGetUBound SafeArrayLock SafeArrayUnlock SysAllocString SysFreeString VariantClear VariantCopy VariantInit

ntdll

NtQueryObject

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetLastError WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname getpeername getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt socket

iphlpapi

FreeMibTable GetAdaptersInfo GetIfTable2

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmSetWindowAttribute

dbghelp

MiniDumpWriteDump StackWalk64 SymFromAddr SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64 SymInitialize SymSetOptions

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

crypt32

CertAddCertificateContextToStore CertCloseStore CertCreateCertificateChainEngine CertEnumCertificatesInStore CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetNameStringA CertOpenStore CryptDecodeObjectEx CryptQueryObject CryptStringToBinaryA PFXImportCertStore

bcrypt

BCryptGenRandom

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

269KB

Virtual Size

42.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

184KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

667KB

Virtual Size

666KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

boiii.exe

kernel32

user32

advapi32

gdi32

shell32

ole32

oleaut32

ntdll

ws2_32

iphlpapi

d3d11

dwmapi

dbghelp

imm32

d3dcompiler_47

crypt32

bcrypt

generic