aircard[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
aircard.exe
Size 7.7MB
Sample261023-sshcqas17n
SHA256 85bf0ee4c29fc6c506a503ee9b89d648b5069978eb48a54384f5b38e98769bd2
MD5 e9dcb24a7d67df37b4715fcecda7e3d4
SHA1 b72a93f78d39407af64acda76e41ebbff9afc171
SHA512 192a8d48a6ac6087036aba209809545fbfe2ad8b33d4382d5a4815dd6ff8cb329081354ef7e96361db60189a18774947e32a137e8a66a6806ef76df23eb5e588
SSDEEP 49152:kzxlMPeMQtpOn/CKKa58baNITooMZM7VU30o/y8OaPPSffER7u7C7pbogjj3Q186:d/Cnw5PPo2v/hpSqJdfbYZU
TLSH
T1AA867D02BB5799ECD15AC8B083069A735E2174CB0B36B9FF51C455383F6ABE05F2871A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aircard.exe

File Explorer

aircard.exe

.exe 7.7MB

aircard.exe

IMPHASH 79013564fd8a3ec84fb472a5160c4468
SHA256 85bf0ee4c29fc6c506a503ee9b89d648b5069978eb48a54384f5b38e98769bd2
MD5 e9dcb24a7d67df37b4715fcecda7e3d4
SHA1 b72a93f78d39407af64acda76e41ebbff9afc171
SHA512 192a8d48a6ac6087036aba209809545fbfe2ad8b33d4382d5a4815dd6ff8cb329081354ef7e96361db60189a18774947e32a137e8a66a6806ef76df23eb5e588
SSDEEP 49152:kzxlMPeMQtpOn/CKKa58baNITooMZM7VU30o/y8OaPPSffER7u7C7pbogjj3Q186:d/Cnw5PPo2v/hpSqJdfbYZU
TLSH
T1AA867D02BB5799ECD15AC8B083069A735E2174CB0B36B9FF51C455383F6ABE05F2871A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4734992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

aircard.pdb

bcrypt

BCryptGenRandom

kernel32

GetModuleHandleA GetProcessHeap HeapFree HeapAlloc FormatMessageW SetDllDirectoryW CloseHandle Sleep LoadLibraryExW LoadLibraryW SetThreadErrorMode DuplicateHandle GetModuleFileNameW GetModuleHandleExW FreeLibrary LoadLibraryExA GlobalFree GetModuleHandleW LoadLibraryA SetLastError SetHandleInformation GetLastError GetProcAddress InitializeSListHead SetUnhandledExceptionFilter MultiByteToWideChar GetSystemTimeAsFileTime SetWaitableTimer CreateWaitableTimerExW MoveFileExW DeleteFileW GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringOrdinal ExitProcess CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle FindClose FindFirstFileExW SetFileInformationByHandle SetFileTime CreateFileW GetFullPathNameW QueryPerformanceCounter QueryPerformanceFrequency WriteFileEx ReadFileEx SleepEx GetEnvironmentVariableW IsThreadAFiber FlsSetValue FlsFree FlsAlloc WriteConsoleW WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW GetCurrentProcess WaitForSingleObjectEx GetCurrentDirectoryW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemInfo WideCharToMultiByte GlobalSize GetCurrentThreadId GlobalUnlock GlobalLock GlobalAlloc GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler HeapReAlloc SwitchToThread CreateThread SetFilePointerEx GetLocalTime

oleaut32

GetErrorInfo SysAllocStringLen SetErrorInfo SysStringLen SysFreeString SafeArrayCreateVector SafeArrayPutElement VariantClear

user32

GetClassNameW GetClassInfoExW RegisterWindowMessageA ShowWindow GetSystemMenu EnableMenuItem SetWindowLongW DestroyCursor RegisterClassExW CreateWindowExW RegisterRawInputDevices GetWindowLongPtrW PeekMessageW TranslateMessage GetCursorPos ReleaseCapture DispatchMessageW DestroyWindow RedrawWindow PostMessageW GetKeyboardState ReleaseDC GetAsyncKeyState EnumDisplayMonitors SetCursor GetKeyState MonitorFromPoint GetDC IsWindowVisible LoadCursorW SystemParametersInfoA GetClientRect GetActiveWindow GetSystemMetrics SendMessageW CreateIconFromResourceEx IsIconic SetWindowPos InvalidateRgn CreateIcon DestroyIcon GetWindowRect MonitorFromWindow GetWindowTextLengthW GetWindowTextW SetCursorPos SetWindowTextW SetWindowDisplayAffinity FlashWindowEx ChangeDisplaySettingsExW GetWindowPlacement SetWindowPlacement GetForegroundWindow MapVirtualKeyW SendInput RemovePropW DefWindowProcW ClientToScreen CallWindowProcW SetWindowLongPtrW SetPropW GetMonitorInfoW IsProcessDPIAware GetPropW ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx ToUnicodeEx AdjustWindowRectEx GetWindowLongW ShowCursor ClipCursor GetClipCursor TrackMouseEvent SetCapture MonitorFromRect ScreenToClient GetMenu GetKeyboardLayout MapVirtualKeyExW SetForegroundWindow CloseTouchInputHandle OpenClipboard RegisterTouchWindow EmptyClipboard SetClipboardData CloseClipboard RegisterClipboardFormatW IsClipboardFormatAvailable GetTouchInputInfo GetClipboardData

uiautomationcore

UiaGetReservedNotSupportedValue UiaReturnRawElementProvider UiaHostProviderFromHwnd UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaLookupId

gdi32

GetDeviceCaps DeleteObject CreateRectRgn SwapBuffers SetPixelFormat DescribePixelFormat ChoosePixelFormat

ole32

CoCreateFreeThreadedMarshaler OleInitialize RegisterDragDrop CoUninitialize CoInitializeEx CoTaskMemFree RevokeDragDrop CoCreateInstance

ntdll

NtCreateNamedPipeFile NtReadFile NtOpenFile RtlNtStatusToDosError NtWriteFile

shlwapi

AssocQueryStringW

shell32

SHCreateItemFromParsingName DragQueryFileW DragFinish

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

opengl32

wglGetProcAddress wglCreateContext wglGetCurrentDC wglShareLists wglMakeCurrent wglGetCurrentContext wglDeleteContext

advapi32

RevertToSelf ImpersonateAnonymousToken

ws2_32

WSAStartup send getsockopt WSACleanup closesocket select connect ioctlsocket WSASocketW setsockopt WSAGetLastError recv

imm32

ImmSetCompositionWindow ImmGetContext ImmAssociateContextEx ImmReleaseContext ImmGetCompositionStringW ImmSetCandidateWindow

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

vcruntime140

memset __C_specific_handler __current_exception __current_exception_context _CxxThrowException memcpy __CxxFrameHandler3 memmove memcmp

api-ms-win-crt-math-l1-1-0

floorf acosf round expf sinf _hypotf roundf cbrtf truncf exp2f trunc sin floor cosf fmod __setusermatherr ceilf powf atan2f cos

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _initterm _configure_narrow_argv _initterm_e strerror exit _exit _seh_filter_exe __p___argc terminate __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _crt_atexit _register_onexit_function _set_app_type

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode