aircard[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
aircard.exe
Size 7.4MB
Sample260930-q3ecpssgph
SHA256 e8887b85b810e64b293fcff6919b1b6cc2eb61203799a17b89fc744aed62e32f
MD5 8a0b8b96c0863277dfb9a1f2fcc2ca29
SHA1 4cdb0e49ceeffe1e0b56a2a1eaf3b7beda733b75
SHA512 a1afde528145547fd292e09400c65e7404fd2e96228de15fa6dbbe8a4fea02289e2b53e7a3e43228c5658f817f3f7f23924ec0d0055b023c5d777806df4467db
SSDEEP 49152:kcokurHr2QC9nwQxtYVzcxcBDeRpRonMAos9w+zF655O336U3JDwcCnohVfcQN5z:kHlC/VUoseUT3HSAN5+BbF6C
TLSH
T19F768D02BB5B99ECD05AC8B0830696735E21B4CB0B36B9FF51C455393F6ABE05F28719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aircard.exe

File Explorer

aircard.exe

.exe 7.4MB

aircard.exe

IMPHASH 7ccec30f46d05b6d74a84f572526872a
SHA256 e8887b85b810e64b293fcff6919b1b6cc2eb61203799a17b89fc744aed62e32f
MD5 8a0b8b96c0863277dfb9a1f2fcc2ca29
SHA1 4cdb0e49ceeffe1e0b56a2a1eaf3b7beda733b75
SHA512 a1afde528145547fd292e09400c65e7404fd2e96228de15fa6dbbe8a4fea02289e2b53e7a3e43228c5658f817f3f7f23924ec0d0055b023c5d777806df4467db
SSDEEP 49152:kcokurHr2QC9nwQxtYVzcxcBDeRpRonMAos9w+zF655O336U3JDwcCnohVfcQN5z:kHlC/VUoseUT3HSAN5+BbF6C
TLSH
T19F768D02BB5B99ECD05AC8B0830696735E21B4CB0B36B9FF51C455393F6ABE05F28719
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4509312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

aircard.pdb

bcrypt

BCryptGenRandom

kernel32

SetHandleInformation GetModuleHandleW GetProcessHeap HeapFree HeapAlloc GlobalFree FormatMessageW SetDllDirectoryW LoadLibraryExA LoadLibraryExW LoadLibraryA GetModuleFileNameW DuplicateHandle GetModuleHandleA GetModuleHandleExW SetThreadErrorMode FreeLibrary GetProcAddress GetLastError Sleep LoadLibraryW CloseHandle SetLastError InitializeSListHead SetUnhandledExceptionFilter GlobalLock GetSystemTimeAsFileTime SetWaitableTimer CreateWaitableTimerExW GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringOrdinal ExitProcess CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle FindClose FindFirstFileExW SetFileInformationByHandle SetFileTime CreateFileW GetFullPathNameW QueryPerformanceCounter QueryPerformanceFrequency WriteFileEx ReadFileEx SleepEx GetEnvironmentVariableW IsThreadAFiber FlsSetValue FlsFree FlsAlloc WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW GetCurrentProcess WaitForSingleObjectEx GetCurrentDirectoryW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemInfo WideCharToMultiByte GlobalSize GetCurrentThreadId MultiByteToWideChar GlobalUnlock GlobalAlloc GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject HeapReAlloc CreateThread SwitchToThread SetFilePointerEx GetLocalTime

ntdll

NtReadFile NtCreateNamedPipeFile NtOpenFile NtWriteFile RtlNtStatusToDosError

oleaut32

GetErrorInfo VariantClear SysAllocStringLen SysStringLen SetErrorInfo SysFreeString SafeArrayCreateVector SafeArrayPutElement

user32

MapVirtualKeyW SendInput SetForegroundWindow LoadCursorW SetCursor GetClassNameW GetClassInfoExW RegisterWindowMessageA ShowWindow GetPropW SetPropW SetWindowLongPtrW CallWindowProcW ClientToScreen DefWindowProcW GetSystemMenu EnableMenuItem RemovePropW RegisterClassExW CreateWindowExW SetWindowLongW RegisterRawInputDevices DestroyCursor GetWindowLongPtrW PeekMessageW GetCursorPos TranslateMessage DispatchMessageW DestroyWindow RedrawWindow PostMessageW ReleaseDC EnumDisplayMonitors GetMonitorInfoW MonitorFromPoint GetDC IsWindowVisible SystemParametersInfoA GetClientRect GetActiveWindow GetSystemMetrics SendMessageW CreateIconFromResourceEx IsIconic SetWindowPos InvalidateRgn CreateIcon DestroyIcon GetForegroundWindow MonitorFromWindow GetWindowTextLengthW GetWindowTextW SetCursorPos SetWindowTextW SetWindowDisplayAffinity FlashWindowEx ChangeDisplaySettingsExW GetWindowPlacement SetWindowPlacement GetWindowRect ReleaseCapture ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx ToUnicodeEx AdjustWindowRectEx GetWindowLongW ShowCursor ClipCursor GetClipCursor TrackMouseEvent SetCapture MonitorFromRect ScreenToClient GetMenu GetKeyboardLayout MapVirtualKeyExW IsProcessDPIAware GetKeyState GetAsyncKeyState GetKeyboardState CloseTouchInputHandle IsClipboardFormatAvailable RegisterClipboardFormatW CloseClipboard SetClipboardData EmptyClipboard GetClipboardData GetTouchInputInfo RegisterTouchWindow OpenClipboard

uiautomationcore

UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaLookupId UiaGetReservedNotSupportedValue UiaReturnRawElementProvider UiaHostProviderFromHwnd

gdi32

DeleteObject GetDeviceCaps CreateRectRgn SwapBuffers SetPixelFormat DescribePixelFormat ChoosePixelFormat

ole32

CoCreateInstance CoInitializeEx OleInitialize RegisterDragDrop RevokeDragDrop CoCreateFreeThreadedMarshaler CoTaskMemFree CoUninitialize

shlwapi

AssocQueryStringW

shell32

DragQueryFileW SHCreateItemFromParsingName DragFinish

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

opengl32

wglGetProcAddress wglCreateContext wglDeleteContext wglShareLists wglGetCurrentContext wglGetCurrentDC wglMakeCurrent

advapi32

RevertToSelf ImpersonateAnonymousToken

ws2_32

setsockopt WSACleanup WSAStartup send recv getsockopt select closesocket connect ioctlsocket WSASocketW WSAGetLastError

imm32

ImmAssociateContextEx ImmSetCompositionWindow ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmSetCandidateWindow

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

vcruntime140

memcmp memset _CxxThrowException memmove __current_exception_context memcpy __current_exception __C_specific_handler __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

exp2f cbrtf acosf floor atan2f truncf cosf fmod cos sin powf _hypotf sinf expf __setusermatherr floorf roundf round ceilf trunc

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type strerror _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback __p___argv _cexit _c_exit __p___argc terminate _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode