axontweakspatch[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
axontweakspatch.zip
Size 19.0MB
Sample260816-fr128a1vbw
SHA256 bc9553b11643840890dab1e3d4108f2e887f4d63fc86634c269f1fae7fd68d80
MD5 41f533302708841bfdb4f1203f717171
SHA1 b9c69d5619ea2b5bbe0dd2ed2d48530c5e5fb5b8
SHA512 3f1b27cdf2725ec40e7284d84224cc87aad56ef4c2519f6bcca9e712d3494282d976a752ade90236650f989f8a3e9f0a7e0732f99f79eb99e5aac64b24a0df27
SSDEEP 393216:/twMrbCJ2x0MqCuHk9yEcQ2Cg9IwPPJQijiG3QDtZFGecjPON9:iM+u0NrE9zj2j9tBVjijXFdJf
TLSH
T1A417332224436DD8189F35C3D0F6216BB37AC354F3D28AF2592479D9EA2B077FC58692
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/axontweakspatch/axon_tweaks.exe

File Explorer

axontweakspatch.zip

.zip 19.0MB
axontweakspatch/axon_tweaks.exe

.exe 22.4MB
axontweakspatch/crackedbyml8wakawrld.txt

48B
axontweakspatch/launch.bat

.bat 3KB
axontweakspatch/server.js

.js 5KB
axontweakspatch/uninstall.bat

.bat 1KB

axontweakspatch.zip

SHA256 bc9553b11643840890dab1e3d4108f2e887f4d63fc86634c269f1fae7fd68d80
MD5 41f533302708841bfdb4f1203f717171
SHA1 b9c69d5619ea2b5bbe0dd2ed2d48530c5e5fb5b8
SHA512 3f1b27cdf2725ec40e7284d84224cc87aad56ef4c2519f6bcca9e712d3494282d976a752ade90236650f989f8a3e9f0a7e0732f99f79eb99e5aac64b24a0df27
SSDEEP 393216:/twMrbCJ2x0MqCuHk9yEcQ2Cg9IwPPJQijiG3QDtZFGecjPON9:iM+u0NrE9zj2j9tBVjijXFdJf
TLSH
T1A417332224436DD8189F35C3D0F6216BB37AC354F3D28AF2592479D9EA2B077FC58692
MD5 SHA1 SHA512 SSDEEP TLSH

axontweakspatch/axon_tweaks.exe

IMPHASH a956c337a76a28d54f464837fc8984dc
SHA256 d3319564d13ff1404b13dad0aa1573ae2d7b81a862b68a8f5c27c856b3900a22
MD5 48ceddacde08cd1f01dbe2dea22f2b9d
SHA1 9c8ef510aa8756df089f18000985b7fa894bad85
SHA512 7e348ee35561be313f1915ee8fb3484c56a630f8c7420feadb746556c4afa0b7a594b6d7c9834640a3aefe41c1fcbb0c68e6c776573267789b39251c6b4913e7
SSDEEP 393216:83unw399lgl8MYjINTQ8Cuptr+rLFuxwMx0BfFXS4WVdGR:Jw99+l5Yjc08TptrKLMxwx7XvR
TLSH
T1AF371216F341CB59C17216748863DB1297F5B620AF22D7D7BBA66D306F127E04EB2382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

934464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comdlg32

GetOpenFileNameA

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmSetWindowAttribute

advapi32

CheckTokenMembership RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegCreateKeyExW RegCloseKey FreeSid AllocateAndInitializeSid RegSetValueExW

shell32

ShellExecuteW ShellExecuteA

urlmon

URLDownloadToFileA

bcrypt

BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptFinishHash BCryptCreateHash BCryptHashData

kernel32

ReleaseSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead GetStdHandle GetEnvironmentVariableA CreateDirectoryA DeleteFileA GetDiskFreeSpaceExW GetFileAttributesA GetFullPathNameA ReadFile GetTempPathA GetVolumeInformationA CloseHandle SetUnhandledExceptionFilter GetLastError CreatePipe WaitForSingleObject Sleep GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessA CreateProcessW GetSystemTimes GlobalMemoryStatusEx GetSystemInfo GetLocalTime GetTickCount GetTickCount64 GetModuleFileNameA GetModuleFileNameW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW GetComputerNameA OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte AcquireSRWLockExclusive GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime SetHandleInformation

user32

PeekMessageW SetProcessDPIAware LoadCursorA ClientToScreen GetCursorPos SetCursor SetCursorPos SendMessageW GetForegroundWindow DispatchMessageW ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW LoadCursorW ScreenToClient GetClientRect UpdateWindow TranslateMessage IsWindowUnicode GetActiveWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW

gdi32

GetStockObject

ole32

PropVariantClear CoInitializeEx

msvcp140

?_Id_cnt@id@locale@std@@0HA ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_alloc@std@@YAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Xbad_function_call@std@@YAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ _Query_perf_counter _Query_perf_frequency _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

pdh

PdhCollectQueryData PdhAddEnglishCounterA PdhOpenQueryA PdhCloseQuery PdhGetFormattedCounterArrayA

mfplat

MFCreateAttributes MFStartup MFCreateMFByteStreamOnStream MFCreateMediaType

mfreadwrite

MFCreateSourceReaderFromByteStream MFCreateSourceReaderFromURL

shlwapi

ord12

iphlpapi

IcmpCloseHandle IcmpSendEcho IcmpCreateFile

ws2_32

select getsockopt htons inet_pton ioctlsocket connect closesocket WSAGetLastError WSAStartup socket

winhttp

WinHttpOpenRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpCrackUrl WinHttpAddRequestHeaders WinHttpSendRequest

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

vcruntime140

memchr strstr wcsstr __current_exception_context __current_exception __C_specific_handler strchr memset memmove __std_exception_copy __std_exception_destroy _CxxThrowException __std_terminate memcpy memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy wcslen strncmp strlen strcmp _wcsicmp tolower toupper isalnum isspace isdigit

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc realloc

api-ms-win-crt-convert-l1-1-0

strtod _strtoi64 strtol

api-ms-win-crt-math-l1-1-0

fmod sin sinf __setusermatherr sqrtf ceilf acosf powf fmodf roundf cosf floorf floor ldexp

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf fwrite ftell _fseeki64 fseek fsetpos fread fputc __acrt_iob_func __stdio_common_vsprintf __stdio_common_vfprintf fgetpos fgetc fflush ferror feof fclose fopen_s _get_stream_buffer_pointers _set_fmode __p__commode _wfopen __stdio_common_vsscanf

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit _set_app_type _configure_wide_argv _initialize_wide_environment _cexit _register_thread_local_exe_atexit_callback _c_exit _exit exit terminate _beginthreadex _initterm_e _initterm _get_wide_winmain_command_line

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale