[Xylitol]

A little birdy shared with me this bin who seem interesting and come from an affiliate (partnerka.me)
http://www.virusradar.com/en/Win32_Boax ... escription
Original (nullsoft installer sfx shit):
https://www.virustotal.com/en/file/4de4 ... 383588563/ 9/47
Dumped:
https://www.virustotal.com/en/file/c44a ... 383588585/ (vb crap who load a .dat) 4/47
https://www.virustotal.com/en/file/134c ... 383588544/ ('.dat' exe who load a dll) 2/46
https://www.virustotal.com/en/file/d330 ... 383588541/ (dll) 4/47
https://www.virustotal.com/en/file/2fb3 ... 383590259/ (final payload) 6/47
https://www.virustotal.com/en/file/81e5 ... 383593286/ (pcap)

[R136a1]

Analysis
Boaxxe adware: 'A good ad sells the product without drawing attention to itself' – Pt 1
http://www.welivesecurity.com/2014/01/1 ... self-pt-1/

[R136a1]

Boaxxe adware: ‘A good advert sells the product without drawing attention to itself’ Part 2
http://www.welivesecurity.com/2014/01/1 ... lf-part-2/