AFI_Lite (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AFI_Lite (1).exe
Size 1.3MB
Sample260804-cj2f8stwdx
SHA256 3382d23877735c74a5ba39a53da2e6b23c1b8f8e790df6d41b1a05a5cef3cd48
MD5 5f11c8110ec00f4051a8e20c642b358d
SHA1 49aa69ca69ae26860e51730bdaecafbf6de45920
SHA512 989f3403d45eb243d54a8816478f08190d65417500e8c84b120896ad4b56ea8b76939036d3fb9d8acacf25661909eeefb53b8c0885c469454ca1f80c4160a85d
SSDEEP 24576:K8lnP0gZS4+xUUfqpxL0zZ8dTDTS6ylnZYKsx/F:KGnjZSKppxAWHSBnE/
TLSH
T100558DEDD50809E6D40EE5B5CC71450FDE703D16062484BB6AF43A1A0E8FBE8AF7B616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AFI_Lite (1).exe

File Explorer

AFI_Lite (1).exe

.exe 1.3MB

AFI_Lite (1).exe

IMPHASH 28e6da99ab314e2e25ec1fbd7703a466
SHA256 3382d23877735c74a5ba39a53da2e6b23c1b8f8e790df6d41b1a05a5cef3cd48
MD5 5f11c8110ec00f4051a8e20c642b358d
SHA1 49aa69ca69ae26860e51730bdaecafbf6de45920
SHA512 989f3403d45eb243d54a8816478f08190d65417500e8c84b120896ad4b56ea8b76939036d3fb9d8acacf25661909eeefb53b8c0885c469454ca1f80c4160a85d
SSDEEP 24576:K8lnP0gZS4+xUUfqpxL0zZ8dTDTS6ylnZYKsx/F:KGnjZSKppxAWHSBnE/
TLSH
T100558DEDD50809E6D40EE5B5CC71450FDE703D16062484BB6AF43A1A0E8FBE8AF7B616
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

333

Minor OS version

Major OS version

Entry point

424168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpSetOption WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse

dwmapi

DwmExtendFrameIntoClientArea

ntdll

VerSetConditionMask RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

kernel32

GetCurrentProcess OutputDebugStringA Module32Next GetProcessId Module32First DuplicateHandle GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetTickCount64 GetLastError CloseHandle VirtualProtectEx GetProcAddress ReadProcessMemory GetCurrentProcessId WideCharToMultiByte VirtualQueryEx MultiByteToWideChar WriteProcessMemory GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency AreFileApisANSI GetLocaleInfoEx FormatMessageA LocalFree TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead GetModuleFileNameA GetModuleHandleW QueryPerformanceCounter ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable UnhandledExceptionFilter FreeLibrary SetUnhandledExceptionFilter

user32

GetMessageExtraInfo LoadCursorA GetKeyState DefWindowProcW ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor SetProcessDPIAware GetCapture IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard DispatchMessageA GetWindowRect DestroyWindow SetWindowPos GetClipboardData CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW CreatePopupMenu RegisterClassExW TrackPopupMenu ShowWindow GetAsyncKeyState DestroyMenu TranslateMessage SetClipboardData AppendMenuA GetClientRect PeekMessageA PostQuitMessage UpdateWindow GetCursorPos SendInput GetWindowThreadProcessId FindWindowA

comdlg32

GetOpenFileNameA

advapi32

RegCreateKeyExW AdjustTokenPrivileges RegCloseKey LookupPrivilegeValueA RegSetValueExW RegQueryValueExW OpenProcessToken

shell32

ShellExecuteA

msvcp140

?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??1facet@locale@std@@MEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??_7_Facet_base@std@@6B@ _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?uncaught_exception@std@@YA_NXZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ??_7facet@locale@std@@6B@ _Strcoll ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_exception_copy strchr strstr memcmp memchr memcpy memset __C_specific_handler __current_exception __std_exception_destroy __current_exception_context _CxxThrowException

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf fopen_s __acrt_iob_func fclose fseek _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite __stdio_common_vfprintf fflush _wfopen __stdio_common_vsscanf _set_fmode ftell fputc __p__commode fputs fgetc

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode realloc _callnewh free

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _configure_narrow_argv _initialize_narrow_environment _exit exit _initterm_e _invoke_watson _initterm _get_narrow_winmain_command_line _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit _beginthreadex terminate _seh_filter_exe _errno _cexit

api-ms-win-crt-string-l1-1-0

strncpy_s strncpy strncmp strncat_s tolower strcmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

strtod strtoull strtoll

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

__setusermatherr acosf ceilf cosf fmodf powf sinf sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func