AXOX[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AXOX.exe
Size 6.6MB
Sample260803-vb3cnscd48
SHA256 8798834b1e5fce4665be1cceb7b23511452267ca08e7a25cbe882fd8858a724f
MD5 a565cb8371b1c8f8a3e2f833915d8df1
SHA1 e2757685a57f1e896fd4e4357ded00fc42049104
SHA512 14a9b03709d9c40dd95753b155cb5a5fedeb421ce41ab6b0900959037ac9ba4daf88935362724cb73fb66b77100de49e6da71bb8ba26f643397da21484e298a9
SSDEEP 196608:T8LPSQfi4+6mMhdQ/1/K3cUyzwzmaSSaV1DI:aPbZeMdQ/ocQzmOC8
TLSH
T1A066237A628C7328C40E88745527EC05B2B5A71E16F8D8ADB1D7FEC07BDB815D706B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AXOX.exe

File Explorer

AXOX.exe

.exe 6.6MB

AXOX.exe

IMPHASH 91b7f5dc266b679460dc20a96607733a
SHA256 8798834b1e5fce4665be1cceb7b23511452267ca08e7a25cbe882fd8858a724f
MD5 a565cb8371b1c8f8a3e2f833915d8df1
SHA1 e2757685a57f1e896fd4e4357ded00fc42049104
SHA512 14a9b03709d9c40dd95753b155cb5a5fedeb421ce41ab6b0900959037ac9ba4daf88935362724cb73fb66b77100de49e6da71bb8ba26f643397da21484e298a9
SSDEEP 196608:T8LPSQfi4+6mMhdQ/1/K3cUyzwzmaSSaV1DI:aPbZeMdQ/ocQzmOC8
TLSH
T1A066237A628C7328C40E88745527EC05B2B5A71E16F8D8ADB1D7FEC07BDB815D706B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6586683

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExA

kernel32

Thread32Next GetSystemTimeAsFileTime LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

MessageBoxA GetUserObjectInformationW GetProcessWindowStation GetUserObjectInformationW

gdi32

SelectObject

shell32

ShellExecuteExA

ole32

CreateStreamOnHGlobal

msvcp140

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

winhttp

WinHttpConnect

crypt32

CertEnumCertificatesInStore

normaliz

IdnToAscii

wldap32

ord79

ws2_32

ntohl

wininet

InternetCloseHandle

shlwapi

PathFindFileNameW

gdiplus

GdipSaveImageToStream

ntdll

VerSetConditionMask

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_compare

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_initterm_e

api-ms-win-crt-time-l1-1-0

strftime

api-ms-win-crt-string-l1-1-0

isspace

api-ms-win-crt-convert-l1-1-0

wcstombs_s

api-ms-win-crt-stdio-l1-1-0

fflush

api-ms-win-crt-filesystem-l1-1-0

_unlock_file

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

_dclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

psapi

GetModuleInformation

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

783KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.???0

Size

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.???1

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

236B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AXOX.exe

advapi32

kernel32

user32

gdi32

shell32

ole32

msvcp140

winhttp

crypt32

normaliz

wldap32

ws2_32

wininet

shlwapi

gdiplus

ntdll

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

psapi

wtsapi32

generic