aired[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
aired.exe
Size 908KB
Sample260727-knrrlay1ex
SHA256 4794fa2b5a462ba5321dc2276de6413fb8d6f4cd92a290e68f252dbfefb0a03c
MD5 66f82dd815742ef1b1a7a20560bf3609
SHA1 c01c58d6343bad832af99ddba3c2ade99f88d000
SHA512 b43040b78831a4a01dc7cdfc1ec95d11f4dcc1105dad423dab2201186484f5a641c2885cc162981dffff8b8a21e3dc406af47109d7df9282935354ec01a51e84
SSDEEP 24576:sA8ZNg8tNSAp7MoeiGiQKsCN4teCnnv9:/EN8oeiPQKsCa0anv9
TLSH
T1E315CF45F3E841ECD42BE03899966A0BEA3538DC172446D763F448982FB67F067F7A06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aired.exe

File Explorer

aired.exe

.exe 908KB

aired.exe

IMPHASH 15b3d60e1cc687d60cbd64501d4ea5ea
SHA256 4794fa2b5a462ba5321dc2276de6413fb8d6f4cd92a290e68f252dbfefb0a03c
MD5 66f82dd815742ef1b1a7a20560bf3609
SHA1 c01c58d6343bad832af99ddba3c2ade99f88d000
SHA512 b43040b78831a4a01dc7cdfc1ec95d11f4dcc1105dad423dab2201186484f5a641c2885cc162981dffff8b8a21e3dc406af47109d7df9282935354ec01a51e84
SSDEEP 24576:sA8ZNg8tNSAp7MoeiGiQKsCN4teCnnv9:/EN8oeiPQKsCa0anv9
TLSH
T1E315CF45F3E841ECD42BE03899966A0BEA3538DC172446D763F448982FB67F067F7A06
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

580048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\uav\Downloads\aired v6 beta v2.1 WORKING\Roblox-External-main\Roblox-External-main\build\Minus-External.pdb

kernel32

GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleFileNameA FindFirstFileA FindNextFileA FindClose GetVolumeInformationA GetFileAttributesA GetModuleHandleW GetConsoleWindow CreateDirectoryA OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle Module32FirstW Module32NextW OutputDebugStringA InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId SetUnhandledExceptionFilter WakeAllConditionVariable GetTickCount GlobalLock GetLastError AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentThread SetThreadPriority WideCharToMultiByte GlobalFree GlobalAlloc MultiByteToWideChar WriteProcessMemory ExitProcess ReadProcessMemory GetTickCount64 GetFileInformationByHandleEx Sleep

user32

SetWindowDisplayAffinity SetFocus FindWindowW PostMessageW LoadCursorW GetWindowLongPtrA SetWindowLongPtrA DefWindowProcW SetForegroundWindow SetClipboardData GetClipboardData EmptyClipboard DispatchMessageA DestroyWindow SetWindowPos MessageBoxW SetWindowLongPtrW CreateWindowExW GetSystemMetrics FindWindowA GetAsyncKeyState GetClientRect ScreenToClient UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow SetLayeredWindowAttributes TranslateMessage PeekMessageA PostQuitMessage CloseClipboard OpenClipboard SetCursorPos ReleaseCapture IsWindowUnicode SetCursor SetCapture GetForegroundWindow SendInput GetCursorPos GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetKeyState UpdateWindow LoadCursorA

comdlg32

GetOpenFileNameA GetOpenFileNameW

shell32

ShellExecuteW ShellExecuteA SHGetFolderPathA

ole32

CoInitializeEx CoUninitialize CoCreateInstance

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??Bios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_lock _Thrd_id _Thrd_join _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

winmm

mciSendStringA timeEndPeriod timeBeginPeriod

wininet

InternetCloseHandle HttpSendRequestA InternetOpenA InternetConnectA HttpOpenRequestA InternetReadFile InternetOpenUrlA

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptCreateHash BCryptHashData

urlmon

URLDownloadToFileA

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset __C_specific_handler __current_exception __current_exception_context _CxxThrowException memmove memcpy memcmp strchr strstr __std_terminate __std_exception_copy __std_exception_destroy memchr

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

ungetc fwrite fsetpos fgetc __stdio_common_vsscanf fclose fflush fputc _fseeki64 fread ftell __stdio_common_vsprintf_s __acrt_iob_func fseek fgetpos __p__commode __stdio_common_vfprintf _wfopen _set_fmode __stdio_common_vsprintf setvbuf _get_stream_buffer_pointers

api-ms-win-crt-runtime-l1-1-0

_initterm_e _exit abort __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initterm _configure_narrow_argv _get_initial_narrow_environment _set_app_type _initialize_narrow_environment _seh_filter_exe _initialize_onexit_table _register_onexit_function _beginthreadex terminate _cexit _crt_atexit _errno exit

api-ms-win-crt-math-l1-1-0

fmodf cosf sqrtf atan2f acosf _fdclass round roundf sinf logf ceilf sqrt __setusermatherr powf

api-ms-win-crt-convert-l1-1-0

strtol strtof atof

api-ms-win-crt-string-l1-1-0

strcpy_s strncpy_s wcslen strcmp strlen strncmp strncpy

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func