Affinity Loader_patched_backup2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Affinity Loader_patched_backup2.exe
Size 1.9MB
Sample260625-e9yt5shv4l
SHA256 d0e5982fda38eda5b2cb390043a6e18ad301d54ac12601fba6d4ec22b6db8f5a
MD5 cff936966283e8eb795809ea4124eb73
SHA1 2fe1e6889af4903aca8c3d874dc551b1568785fc
SHA512 4e743f3e05e5ed32b52fbaa76a0493b4a3216f48eff0f0aa1e039502c9ce2fbb5b7e266a850463f2902a3c1fa7893bafee1902beb4f76e6c27cc979aa9b2614c
SSDEEP 49152:nTrg01tiBBVvAid9WHUd3WnlTdNvR9uZ:R4Fd91g0Z
TLSH
T1AA95AE47E2A901ECC567D278C612871BFB7138091B30A7DB26E54BA92F236E05F7E351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Affinity Loader_patched_backup2.exe

File Explorer

Affinity Loader_patched_backup2.exe

.exe 1.9MB

Affinity Loader_patched_backup2.exe

IMPHASH f0f913649fe5f263271cc2e9b6b70553
SHA256 d0e5982fda38eda5b2cb390043a6e18ad301d54ac12601fba6d4ec22b6db8f5a
MD5 cff936966283e8eb795809ea4124eb73
SHA1 2fe1e6889af4903aca8c3d874dc551b1568785fc
SHA512 4e743f3e05e5ed32b52fbaa76a0493b4a3216f48eff0f0aa1e039502c9ce2fbb5b7e266a850463f2902a3c1fa7893bafee1902beb4f76e6c27cc979aa9b2614c
SSDEEP 49152:nTrg01tiBBVvAid9WHUd3WnlTdNvR9uZ:R4Fd91g0Z
TLSH
T1AA95AE47E2A901ECC567D278C612871BFB7138091B30A7DB26E54BA92F236E05F7E351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

545380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

%Affinity Loader.pdb%

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

SetFilePointer GetTempPathW Thread32First GetVolumeInformationA WaitForSingleObject CreateFileW GetCurrentThreadId SuspendThread ResumeThread OpenProcess SetProcessMitigationPolicy GetCommandLineA CreateToolhelp32Snapshot Sleep GetFinalPathNameByHandleA GetTickCount64 Process32NextW CreateFileA GetCurrentThread GetSystemDirectoryA DeleteFileW Process32FirstW CloseHandle K32GetModuleBaseNameA GetThreadContext VirtualAllocEx CreateFileMappingA LocalFree GetFileSize ExitProcess GetCurrentProcessId CreateProcessW GetModuleHandleW FlushInstructionCache CreateRemoteThread QueryFullProcessImageNameW GetFileType K32EnumProcessModules VirtualFreeEx MapViewOfFile SetThreadContext GetTickCount VirtualQuery OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter GetEnvironmentVariableW GetLastError LoadLibraryW GetSystemTimeAsFileTime FlushFileBuffers HeapSize GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW Thread32Next GetCommandLineW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetConsoleOutputCP LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode SetFilePointerEx GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc GetModuleFileNameW TerminateProcess WriteFile GetCurrentProcess VirtualProtect WriteProcessMemory ReadFile CreateDirectoryW QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetLocaleInfoA GetModuleHandleA SetEndOfFile GlobalUnlock SetErrorMode EncodePointer SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar WriteConsoleW GetEnvironmentStringsW InitializeCriticalSectionEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW InitializeSListHead GetFileSizeEx HeapAlloc HeapReAlloc HeapFree GetProcessHeap UnmapViewOfFile TryAcquireSRWLockExclusive

user32

RegisterClassExW ShowWindow SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor DispatchMessageW LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo GetKeyState MessageBoxA wsprintfA UpdateWindow GetDesktopWindow PostQuitMessage TranslateMessage SetCapture SetWindowPos UnregisterClassW DefWindowProcW GetWindowRect DestroyWindow CreateWindowExW SetWindowRgn PeekMessageW

gdi32

CreateRoundRectRgn

advapi32

SetEntriesInAclA RegCloseKey GetSecurityInfo SetSecurityInfo AllocateAndInitializeSid FreeSid RegOpenKeyExA RegQueryValueExA

shell32

SHGetFolderPathW

ole32

CoCreateInstance CoInitializeEx

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

bcrypt

BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptEncrypt BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptFinishHash BCryptGenerateSymmetricKey BCryptHashData BCryptSetProperty BCryptCreateHash BCryptDestroyHash

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA CryptHashCertificate2 CryptProtectData CertFreeCertificateChain

wininet

InternetQueryOptionW HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpQueryInfoA

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

335KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

344KB

Virtual Size

351KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Affinity Loader_patched_backup2.exe

d3d11

d3dcompiler_47

kernel32

user32

gdi32

advapi32

shell32

ole32

imm32

dwmapi

bcrypt

crypt32

wininet

version

generic