axia-ac[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
axia-ac.exe
Size 1.0MB
Sample260809-xpppvatgla
SHA256 a77d419b0eb62ca5c494e0f9bb4bc042562b4c0f0633e7e94b23e1f6b65da594
MD5 684f879179ab36829c942ca10d251c6e
SHA1 d1ba1523516977f2a0c02f2b5e54ff57335338a8
SHA512 129274865322b8e29b341b9aad5ea4545ec6fa40dc096daf713ca89fe6851545ded86335223ff5badf735782f76c3b788b6f7864c080841bc1de68894a7d4dd9
SSDEEP 24576:DcTXauRQIDdUx7vHprWDCaUtGrcsoyF+jiMYkAtMPLU:DsQkd4gM7nj
TLSH
T141254BC5EA4225C4C831463CA5B79CA7F0A33C7A03249AC7D76D7E386A353F9257A247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
axia-ac.exe

File Explorer

axia-ac.exe

.exe 1.0MB

axia-ac.exe

IMPHASH 89a8623caa689290fa38d7a0c705b28a
SHA256 a77d419b0eb62ca5c494e0f9bb4bc042562b4c0f0633e7e94b23e1f6b65da594
MD5 684f879179ab36829c942ca10d251c6e
SHA1 d1ba1523516977f2a0c02f2b5e54ff57335338a8
SHA512 129274865322b8e29b341b9aad5ea4545ec6fa40dc096daf713ca89fe6851545ded86335223ff5badf735782f76c3b788b6f7864c080841bc1de68894a7d4dd9
SSDEEP 24576:DcTXauRQIDdUx7vHprWDCaUtGrcsoyF+jiMYkAtMPLU:DsQkd4gM7nj
TLSH
T141254BC5EA4225C4C831463CA5B79CA7F0A33C7A03249AC7D76D7E386A353F9257A247
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

645408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CreateFileW GetLogicalProcessorInformationEx IsWow64Process2 BuildCommDCBAndTimeoutsA GetSystemFirmwareTable WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockExclusive

gdi32

GetDeviceCaps

advapi32

OpenProcessToken LookupPrivilegeValueW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ _Thrd_join ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ _Mtx_unlock _Thrd_hardware_concurrency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

setupapi

SetupDiGetClassDevsW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __current_exception __current_exception_context _CxxThrowException strstr memmove wcsstr wcschr __std_exception_copy __std_exception_destroy __C_specific_handler __C_specific_handler_noexcept memcmp memcpy __std_terminate memchr

api-ms-win-crt-heap-l1-1-0

free _callnewh _set_new_mode malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __p__commode _set_fmode __acrt_iob_func __stdio_common_vfprintf

api-ms-win-crt-math-l1-1-0

__setusermatherr floor ceilf ceil llroundl

api-ms-win-crt-runtime-l1-1-0

_exit __p___argc __p___argv _c_exit _initterm_e _initterm _configure_narrow_argv _get_initial_narrow_environment exit _initialize_narrow_environment _set_app_type _seh_filter_exe _register_onexit_function _cexit _initialize_onexit_table terminate _crt_atexit _beginthreadex _register_thread_local_exe_atexit_callback

api-ms-win-crt-string-l1-1-0

wcslen strlen isspace

api-ms-win-crt-locale-l1-1-0

_configthreadlocale