AffinityLoader_patched[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AffinityLoader_patched.exe
Size 1.9MB
Sample260625-d2vxvahs8j
SHA256 176c93b681c4d80e70eb1c5b190ae637b5ac44103359543e9133ad86c443df5b
MD5 718aaf3ecc7859e46ddfb083a21f41f9
SHA1 bc23e01f5e1c8bb2263e548c0b2ae344778ac5ba
SHA512 bf56204f4b5669db3dbf7fcae18d1cd955cd7dc47d104647d2792dc99f1ba17de554f993c9d03d201fdab3315b4e83a5dd9a729eb3150007cb0ca9418c076a94
SSDEEP 49152:nTcg01tiBBVvAid9WHUd3WnlTdNvR9uZ:s4Fd91g0Z
TLSH
T1E995AE47E2A901ECC567D278C612831BFB7138091B30A7DB26E54BA92F236E05F7E351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AffinityLoader_patched.exe

File Explorer

AffinityLoader_patched.exe

.exe 1.9MB

AffinityLoader_patched.exe

IMPHASH f0f913649fe5f263271cc2e9b6b70553
SHA256 176c93b681c4d80e70eb1c5b190ae637b5ac44103359543e9133ad86c443df5b
MD5 718aaf3ecc7859e46ddfb083a21f41f9
SHA1 bc23e01f5e1c8bb2263e548c0b2ae344778ac5ba
SHA512 bf56204f4b5669db3dbf7fcae18d1cd955cd7dc47d104647d2792dc99f1ba17de554f993c9d03d201fdab3315b4e83a5dd9a729eb3150007cb0ca9418c076a94
SSDEEP 49152:nTcg01tiBBVvAid9WHUd3WnlTdNvR9uZ:s4Fd91g0Z
TLSH
T1E995AE47E2A901ECC567D278C612831BFB7138091B30A7DB26E54BA92F236E05F7E351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

545380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

%Affinity Loader.pdb%

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

SetFilePointer GetTempPathW Thread32First GetVolumeInformationA WaitForSingleObject CreateFileW GetCurrentThreadId SuspendThread ResumeThread OpenProcess SetProcessMitigationPolicy GetCommandLineA CreateToolhelp32Snapshot Sleep GetFinalPathNameByHandleA GetTickCount64 Process32NextW CreateFileA GetCurrentThread GetSystemDirectoryA DeleteFileW Process32FirstW CloseHandle K32GetModuleBaseNameA GetThreadContext VirtualAllocEx CreateFileMappingA LocalFree GetFileSize ExitProcess GetCurrentProcessId CreateProcessW GetModuleHandleW FlushInstructionCache CreateRemoteThread QueryFullProcessImageNameW GetFileType K32EnumProcessModules VirtualFreeEx MapViewOfFile SetThreadContext GetTickCount VirtualQuery OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter GetEnvironmentVariableW GetLastError LoadLibraryW GetSystemTimeAsFileTime FlushFileBuffers HeapSize GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW Thread32Next GetCommandLineW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetConsoleOutputCP LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode SetFilePointerEx GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc GetModuleFileNameW TerminateProcess WriteFile GetCurrentProcess VirtualProtect WriteProcessMemory ReadFile CreateDirectoryW QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetLocaleInfoA GetModuleHandleA SetEndOfFile GlobalUnlock SetErrorMode EncodePointer SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar WriteConsoleW GetEnvironmentStringsW InitializeCriticalSectionEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW InitializeSListHead GetFileSizeEx HeapAlloc HeapReAlloc HeapFree GetProcessHeap UnmapViewOfFile TryAcquireSRWLockExclusive

user32

RegisterClassExW ShowWindow SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor DispatchMessageW LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo GetKeyState MessageBoxA wsprintfA UpdateWindow GetDesktopWindow PostQuitMessage TranslateMessage SetCapture SetWindowPos UnregisterClassW DefWindowProcW GetWindowRect DestroyWindow CreateWindowExW SetWindowRgn PeekMessageW

gdi32

CreateRoundRectRgn

advapi32

SetEntriesInAclA RegCloseKey GetSecurityInfo SetSecurityInfo AllocateAndInitializeSid FreeSid RegOpenKeyExA RegQueryValueExA

shell32

SHGetFolderPathW

ole32

CoCreateInstance CoInitializeEx

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

bcrypt

BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptEncrypt BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptFinishHash BCryptGenerateSymmetricKey BCryptHashData BCryptSetProperty BCryptCreateHash BCryptDestroyHash

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA CryptHashCertificate2 CryptProtectData CertFreeCertificateChain

wininet

InternetQueryOptionW HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpQueryInfoA

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

335KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

344KB

Virtual Size

351KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AffinityLoader_patched.exe

d3d11

d3dcompiler_47

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

dwmapi

bcrypt

crypt32

wininet

version

generic