About “Application.Hacktool.AIR” infection

The Application.Hacktool.AIR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Application.Hacktool.AIR virus can do?

Sample contains Overlay data
Reads data out of its own binary image
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Harvests cookies for information gathering

How to determine Application.Hacktool.AIR?


File Info:
name: CAB29286AAFC6C3DE157.mlw
path: /opt/CAPEv2/storage/binaries/7c76c80c46128280c4f816191ca186f3dbe35d3ae7c1f31a5e28807b7d8f571f
crc32: D80C89AC
md5: cab29286aafc6c3de1579e32e36dbb87
sha1: d4544853eec821478afb6c4d58f28d405124fab2
sha256: 7c76c80c46128280c4f816191ca186f3dbe35d3ae7c1f31a5e28807b7d8f571f
sha512: 1649098e7ca5fe7eedc55acb01871be8408ada8fe75a09b435f8b146a1761c53d93c688141c285a0c6ca8fa963795fd18f4b68590534a1b991e31027d89e3084
ssdeep: 24576:rmoO8itEqfZf3v1/VvXL45xvrZk6OmwN2YZlDGyzbtfcRMWjlpUL2vhSf:qvZfN/VvXLwz+Vmg2kG2fOMWj/5JSf
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B065220277E54472EAF21E35497DAB24F53C79201F38DA6FA7C00C5EAAB15906631FA3
sha3_384: 7ab89faab924c39f244f1e2aaf565e26b262a99d28882fb831c1bb6bf21da5c5c0b0eeac9071b5615fa837773442a485
ep_bytes: e88a040000e98efeffff3b0db8a14300
timestamp: 2017-08-11 13:54:06

Version Info:
0: [No Data]

Application.Hacktool.AIR also known as:

Bkav	W32.AIDetect.malware2
DrWeb	Tool.Wpakill.1
MicroWorld-eScan	Application.Hacktool.AIR
FireEye	Application.Hacktool.AIR
McAfee	Artemis!CAB29286AAFC
Malwarebytes	Bladabindi.Backdoor.Njrat.DDS
VIPRE	Application.Hacktool.AIR
BitDefenderTheta	Gen:NN.ZemsilF.34726.un3@aysTzzj
Symantec	Hacktool
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of MSIL/HackTool.WinActivator.J potentially unsafe
APEX	Malicious
ClamAV	Win.Malware.Generic-7337895-0
Kaspersky	HackTool.Win32.KMSAuto.cb
BitDefender	Application.Hacktool.AIR
NANO-Antivirus	Trojan.Win32.ProcPatcher.jtcvwi
Avast	Win64:MiscX-gen [PUP]
Sophos	Generic PUA NE (PUA)
TrendMicro	PUA.MSIL.WinActivator.A
McAfee-GW-Edition	BehavesLike.Win32.AdwareLinkury.tc
Trapmine	malicious.high.ml.score
Emsisoft	Riskware.WinAct (A)
GData	MSIL.Riskware.Hacktool.B
Google	Detected
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Generic.ASSuf.2732B
Arcabit	Application.Hacktool.AIR
Microsoft	Program:Win32/Wacapew.C!ml
VBA32	Adware.Patcher
ALYac	Application.Hacktool.AIR
Rising	Trojan.Generic/MSIL@AI.100 (RDM.MSIL:r4LHtsRHqIIhdX2KOtIS0w)
Ikarus	HackTool.Win32.Wpakill
AVG	Win64:MiscX-gen [PUP]
Cybereason	malicious.6aafc6

How to remove Application.Hacktool.AIR?

Application.Hacktool.AIR removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X