ammyyadmin | 0754d69f78cca7402bd5164adbdc6760_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0754d69f78cca7402bd5164adbdc6760_JaffaCakes118
Size

3.3MB
MD5

0754d69f78cca7402bd5164adbdc6760
SHA1

5a07e1480132ab37c04094dce11b282d3c5ff180
SHA256

27e9254ee7fb8ad0a65e299e42b60d81166f3b956c817d0148b0b9ee2b2d3c89
SHA512

889adbf806b5be0777c27cf018ac7b047f37d769d9ce79e8145a8235affe33608a53ce1304dfda3e11f8ed8b006c2f74ff9fb490a1814cd2aa1d94c582557f06
SSDEEP

98304:0pre+d4Vn3S4J2W0Upe4QwkN0/Pe2PWJAMT:2e+d4tiE2WRpJNKoP9GAw

Score

10^/10

ammyyadmin

Malware Config

Signatures

AmmyyAdmin payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/AA_v3.exe	family_ammyyadmin

Ammyyadmin family
ammyyadmin

Files

0754d69f78cca7402bd5164adbdc6760_JaffaCakes118
.zip
AA_v3.exe
.exe windows:4 windows x86 arch:x86

64720560b6fe716899d329e150e5fb91

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:2f:7d:af:59:8d:88:b5:ac:fb:72:a8:1b:50:40:e8
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

20-06-2017 00:00

Not After

20-06-2019 23:59

Subject

CN=Ammyy LLC,O=Ammyy LLC,POSTALCODE=115230,STREET=Varshavskoe shosse\, 32,L=Moscow,ST=Russian Federation,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:14:bb:cc:d5:9f:5c:55:57:51:e5:a3:90:4f:64:fd:7c:84:8c:c7
Signer

Actual PE Digest

30:14:bb:cc:d5:9f:5c:55:57:51:e5:a3:90:4f:64:fd:7c:84:8c:c7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAGetLastError
send
recv
select
WSAStartup
getpeername
getservbyport
ntohs
gethostbyaddr
gethostbyname
getservbyname
htonl
inet_ntoa
inet_addr
WSAIoctl
connect
accept
htons
bind
listen
socket
__WSAFDIsSet
shutdown
setsockopt
ioctlsocket
WSACleanup
closesocket

gdi32

GetDIBits
CreateCompatibleBitmap
RealizePalette
SelectPalette
CreatePalette
GetSystemPaletteEntries
GdiFlush
CombineRgn
GetRegionData
SetStretchBltMode
CreateDIBitmap
DeleteDC
SelectObject
CreateCompatibleDC
BitBlt
SetBkMode
CreateFontIndirectA
DPtoLP
GetDeviceCaps
CreateFontA
StretchBlt
CreateRectRgn
ExtTextOutA
GetBitmapBits
GetObjectA
CreateDIBSection
SetBitmapBits
CreateRectRgnIndirect
SelectClipRgn
TextOutW
CreatePatternBrush
SetTextAlign
SetBrushOrgEx
ExtTextOutW
SetTextColor
SetBkColor
GetTextExtentPoint32W
CreateSolidBrush
DeleteObject
GetStockObject

user32

FindWindowA
OpenDesktopA
VkKeyScanExA
SendMessageTimeoutA
LoadIconA
IntersectRect
IsWindowVisible
GetIconInfo
GetCursorInfo
EqualRect
OpenInputDesktop
CloseDesktop
GetUserObjectInformationA
LoadKeyboardLayoutA
EmptyClipboard
SetClipboardData
RegisterClassExA
GetDesktopWindow
PeekMessageA
MsgWaitForMultipleObjects
mouse_event
MapVirtualKeyA
LockWorkStation
SetThreadDesktop
keybd_event
SetDlgItemTextA
SetDlgItemInt
GetKeyboardState
ToAsciiEx
DestroyAcceleratorTable
TranslateAcceleratorA
CreateAcceleratorTableA
SetWindowTextA
ReleaseCapture
SetCapture
GetAsyncKeyState
GetThreadDesktop
SystemParametersInfoW
SwitchToThisWindow
SendMessageA
FindWindowW
MessageBoxA
ShowWindow
wsprintfA
RegisterClassExW
DestroyCursor
MessageBeep
wsprintfW
SetCursorPos
GetClipboardOwner
OpenClipboard
GetClipboardData
CloseClipboard
ShowWindowAsync
SetScrollInfo
GetWindow
WindowFromPoint
ReleaseDC
GetDC
DestroyIcon
DrawIconEx
LoadImageA
EnableWindow
SetDlgItemTextW
DestroyWindow
SetWindowPos
SetClassLongW
InsertMenuItemW
ChangeClipboardChain
MapWindowPoints
InsertMenuItemA
EnumWindows
GetClassNameA
GetWindowTextA
KillTimer
GetWindowLongW
PostMessageA
DrawTextW
SetRect
ShowScrollBar
IsIconic
ScrollWindowEx
AdjustWindowRectEx
GetMenuState
GetWindowPlacement
SetWindowPlacement
GetSysColorBrush
AppendMenuW
SetClipboardViewer
SetWindowsHookExA
UnhookWindowsHookEx
DrawTextA
EndDialog
CreateDialogParamW
DialogBoxParamA
CallWindowProcW
CallWindowProcA
DefWindowProcA
IsWindowUnicode
GetSystemMenu
RedrawWindow
InvalidateRect
ScreenToClient
DrawStateA
DrawEdge
GetClientRect
CreateWindowExA
IsWindow
GetParent
GetWindowLongA
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetActiveWindow
SetCursor
SetTimer
PostThreadMessageA
MoveWindow
BeginPaint
EndPaint
GetDlgItemInt
SendDlgItemMessageA
MapDialogRect
SetWindowLongA
ClientToScreen
LoadCursorA
RegisterClassW
CreateWindowExW
SetWindowLongW
UpdateWindow
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
SetWindowTextW
SetMenu
LoadMenuA
GetMenuItemInfoA
SetMenuItemInfoA
GetSubMenu
SetMenuItemInfoW
GetMenuItemID
EnableMenuItem
GetMenuItemCount
CheckMenuItem
GetKeyState
SetForegroundWindow
SetFocus
GetFocus
PostQuitMessage
DefWindowProcW
CreatePopupMenu
GetCursorPos
TrackPopupMenu
GetSysColor
GetSystemMetrics
GetMenuItemInfoW
DrawMenuBar
AppendMenuA
DestroyMenu
GetDlgItem
MessageBoxW
SendMessageW
GetWindowRect
SystemParametersInfoA

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteA
SHGetMalloc
ShellExecuteExW
SHGetFolderPathA
SHGetFolderPathW
SHGetFileInfoW
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconA

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

msvcrt

_strnicmp
_strupr
_strlwr
_controlfp
_iob
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_wcsicmp
wcschr
__CxxFrameHandler
strlen
isspace
memchr
_errno
strtol
isdigit
strstr
memcpy
??2@YAPAXI@Z
_purecall
free
memset
malloc
sprintf
printf
fwrite
srand
time
_CxxThrowException
rand
atol
_stricmp
isprint
tolower
strncpy
wcslen
atoi
abs
wcscpy
strcmp
strcpy
memcmp
iswspace
wcsncmp
_wtoi
_ultow
_stat
strchr
_ftol
swprintf
strcat
strtoul
calloc
_rotl
_rotr
fopen
fread
fclose
fseek
ftell
fflush
wcsncpy
wcsrchr
vsprintf
vswprintf
memmove
strrchr
strncmp
mbstowcs
wcscmp
wcsstr
iswdigit
_beginthreadex
_endthreadex
atof
_i64tow
wcscat
realloc
exit
fprintf
sscanf
getenv
floor
fputc
_CIpow
_CIacos
??1type_info@@UAE@XZ
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
_acmdln

secur32

FreeCredentialsHandle
InitializeSecurityContextA
FreeContextBuffer
AcquireCredentialsHandleA
CompleteAuthToken
QuerySecurityPackageInfoA

setupapi

SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiClassGuidsFromNameA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList

iphlpapi

GetAdaptersInfo

advapi32

RegOpenKeyExA
FreeSid
SetFileSecurityW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertSidToStringSidA
GetTokenInformation
OpenProcessToken
RegCloseKey
RegQueryValueExA
ImpersonateLoggedOnUser
RevertToSelf
GetUserNameA
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExA
SetServiceStatus
SetTokenInformation
DuplicateTokenEx
CreateProcessAsUserW
QueryServiceStatus
CloseServiceHandle
OpenServiceA
OpenSCManagerA
CreateServiceW
DeleteService
ControlService
StartServiceA
StartServiceW
RegCreateKeyExA
RegQueryValueExW
RegSetValueExW
RegSetValueExA
RegDeleteKeyA
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
SetEntriesInAclA
AllocateAndInitializeSid

shlwapi

PathGetDriveNumberA

comdlg32

GetOpenFileNameW
GetSaveFileNameW

userenv

LoadUserProfileA
UnloadUserProfile

comctl32

CreateToolbarEx
ImageList_Create
ImageList_Draw
ImageList_Destroy
ord17
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_Add
ImageList_Duplicate
_TrackMouseEvent
CreatePropertySheetPageW
PropertySheetW

wininet

HttpSendRequestA
HttpQueryInfoA
InternetConnectA
InternetSetOptionA
InternetCloseHandle
InternetReadFile
InternetOpenA
HttpOpenRequestA

dsound

ord7
ord6
ord2
ord1

kernel32

SizeofResource
LoadResource
LockResource
GetLocalTime
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetFileTime
GetFileTime
OpenMutexA
CreateMutexA
ResetEvent
FindResourceExA
OpenEventA
CreateEventA
ExitProcess
SetUnhandledExceptionFilter
GetSystemDirectoryA
CompareFileTime
GetSystemTimeAsFileTime
GetSystemDirectoryW
lstrcatW
LoadLibraryW
QueryPerformanceFrequency
ReadFile
QueryPerformanceCounter
GetExitCodeProcess
BeginUpdateResourceW
EndUpdateResourceW
UpdateResourceA
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
LoadLibraryA
FreeLibrary
GetFileSize
SetFilePointer
WriteFile
WaitForSingleObject
CreateThread
GetFileAttributesW
GetStartupInfoW
CreateProcessW
lstrcmpiW
lstrcmpW
MulDiv
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
GetComputerNameA
LocalAlloc
GetExitCodeThread
SystemTimeToFileTime
MoveFileW
DeleteFileW
GetTempPathW
CreateFileW
FindFirstFileW
FindClose
CreateFileA
DeviceIoControl
GetUserDefaultUILanguage
GetModuleHandleA
GetProcAddress
GetLocaleInfoA
CreateDirectoryW
SetCurrentDirectoryW
SetProcessShutdownParameters
GetVersionExA
GetCurrentProcess
GetLastError
CloseHandle
LocalFree
GetCurrentThreadId
GetCurrentProcessId
Sleep
GetTickCount
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrlenW
TerminateProcess
GlobalUnlock
GlobalLock
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
GlobalAlloc
GetDriveTypeW
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
GetLogicalDrives
ProcessIdToSessionId
SleepEx
CreateDirectoryA
DeleteFileA
GlobalFree
IsBadReadPtr
lstrcmpA
LocalFileTimeToFileTime
WaitNamedPipeW
lstrcpyA
GetCurrentDirectoryA
FindResourceA
DuplicateHandle
CreateSemaphoreA
SetThreadPriority
TlsSetValue
GetCurrentThread
TlsAlloc
ResumeThread
TlsGetValue
InterlockedExchange
GetStartupInfoA
SetEvent
SetLastError

Sections

.text
Size: 528KB - Virtual size: 524KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AeroAdmin.exe
.exe windows:5 windows x86 arch:x86

cb9d62a05f5070b7d4e4e901f2587f78

Code Sign

66:07:44:a7:fe:ef:16:ac:4d:68:f9:bb:dd:e7:3e:16
Certificate

Issuer

CN=Aeroadmin LLC,1.2.840.113549.1.9.1=#0c15737570706f7274406165726f61646d696e2e636f6d

Not Before

16-10-2013 10:44

Not After

31-12-2039 23:59

Subject

CN=Aeroadmin LLC,1.2.840.113549.1.9.1=#0c15737570706f7274406165726f61646d696e2e636f6d

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

29:b8:39:22:4b:2f:8a:63:8d:c6:9d:7d:86:56:ce:7f:fe:45:ae:f0
Signer

Actual PE Digest

29:b8:39:22:4b:2f:8a:63:8d:c6:9d:7d:86:56:ce:7f:fe:45:ae:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

H:\hg\Sandbox\Product\AeroAdmin\AeroAdmin.pdb

Imports

user32

GetFocus
EndPaint
BeginPaint
RegisterClassW
SetCaretPos
DrawTextW
MessageBeep
ShowCaret
HideCaret
SetScrollRange
ShowScrollBar
SetScrollPos
ToAscii
GetKeyboardState
DrawFrameControl
DrawTextExW
DrawEdge
IsDlgButtonChecked
GetWindowTextW
CloseClipboard
GetClipboardData
OpenClipboard
UnhookWindowsHookEx
SetWindowsHookExW
BroadcastSystemMessageW
CallNextHookEx
SetClassLongW
GetClientRect
wsprintfW
SetCursor
SetFocus
SetMenu
GetAsyncKeyState
GetDlgItem
DrawMenuBar
InsertMenuItemW
CreateMenu
GetParent
MapWindowPoints
GetMenu
MoveWindow
GetMenuBarInfo
SystemParametersInfoW
ScreenToClient
UpdateWindow
EnableWindow
AdjustWindowRect
LoadCursorW
LoadIconW
GetWindowRect
SetWindowPos
SetWindowLongW
FillRect
GetDCEx
GetWindowDC
GetSystemMetrics
InvalidateRect
ReleaseDC
DestroyIcon
DrawIconEx
GetDC
PostQuitMessage
ShowWindow
SetForegroundWindow
DefWindowProcW
GetCursorPos
CreatePopupMenu
InsertMenuW
TrackPopupMenu
DestroyMenu
OpenInputDesktop
GetScrollPos
GetScrollRange
GetUserObjectInformationW
GetProcessWindowStation
OpenDesktopW
SetThreadDesktop
CreateCaret
DestroyCaret
CloseDesktop
CreateIconIndirect
GetIconInfo
GetCursorInfo
DestroyCursor
GetWindowPlacement
LoadStringA
EmptyClipboard
SetClipboardData
MessageBoxW
PostMessageW
SetWindowTextW
DispatchMessageW
TranslateMessage
PeekMessageW
LoadImageW
CreateWindowExW
GetDesktopWindow
SetLastErrorEx
MapVirtualKeyW
FindWindowW
SendMessageW
RegisterClassExW
SendInput
LockWorkStation
DestroyWindow

gdi32

CreatePatternBrush
CreateDIBitmap
CreateCompatibleDC
GetStockObject
DeleteDC
SetBrushOrgEx
CreateFontIndirectW
GetTextExtentPoint32W
SetTextColor
SetBkColor
GetTextMetricsW
ExtTextOutW
SetBkMode
CreateFontW
CreateSolidBrush
GetDIBits
GetObjectW
GetBitmapBits
CreateBitmap
DeleteObject
CreateDIBSection
BitBlt
TextOutW
Rectangle
CreatePen
GetROP2
SetROP2
SelectObject
CreateCompatibleBitmap

comctl32

ord17
InitCommonControlsEx

shell32

Shell_NotifyIconW
ShellExecuteW
SHGetFileInfoW
CommandLineToArgvW
ShellExecuteExW
ord47
SHGetFolderPathW

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
CheckTokenMembership
AllocateAndInitializeSid
StartServiceCtrlDispatcherW
StartServiceW
DeleteService
OpenServiceW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
RegisterServiceCtrlHandlerW
SetServiceStatus
CreateProcessAsUserW
AdjustTokenPrivileges
SetTokenInformation
DuplicateTokenEx
LookupPrivilegeValueW
OpenProcessToken
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize

kernel32

RemoveDirectoryW
lstrlenA
FormatMessageW
CreateEventA
GetSystemTimeAsFileTime
HeapAlloc
GetProcessHeap
HeapFree
SetEvent
GetLastError
SetLastError
FormatMessageA
SwitchToThread
GetProcessTimes
GetCurrentProcessId
FindFirstFileA
FindNextFileA
FindClose
DuplicateHandle
GetCurrentProcess
CreateMutexA
WaitForSingleObject
ReleaseMutex
UnmapViewOfFile
CreateSemaphoreA
ReleaseSemaphore
CreateFileMappingA
MapViewOfFileEx
CreateFileA
DeleteFileA
GetSystemInfo
GetFileSizeEx
CreateDirectoryA
RemoveDirectoryA
SetEndOfFile
GetModuleHandleA
GetFileAttributesA
GetModuleFileNameW
GetModuleHandleW
GetTickCount
CreateFileW
WriteFile
CloseHandle
DeleteFileW
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateDirectoryW
AttachConsole
FindResourceW
LockResource
LoadResource
GetCommandLineW
Sleep
LocalFree
GetVersionExW
LoadLibraryW
GetProcAddress
GetUserDefaultUILanguage
ProcessIdToSessionId
OpenProcess
OutputDebugStringW
IsBadCodePtr
ReadProcessMemory
IsBadReadPtr
IsBadWritePtr
GlobalFree
GlobalAlloc
LCMapStringA
GetStringTypeExA
SetPriorityClass
DeviceIoControl
GetWindowsDirectoryW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
CompareStringW
HeapReAlloc
IsValidLocale
FindFirstFileW
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
FlushFileBuffers
SetFilePointer
GetConsoleMode
GetConsoleCP
GetFileType
GetStdHandle
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
HeapSize
GetLocaleInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
HeapCreate
SetConsoleCtrlHandler
CreateThread
ExitThread
RaiseException
LCMapStringW
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetCPInfo
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CompareFileTime
GlobalUnlock
GlobalLock
GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus
SleepEx
CreateEventW
QueueUserAPC
TerminateThread
InitializeCriticalSectionAndSpinCount
InterlockedExchangeAdd
IsDebuggerPresent
LoadLibraryA
GetSystemDirectoryA
ReadFile
GetFileSize
GetCurrentThread
QueryPerformanceFrequency
QueryPerformanceCounter
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjects
SystemTimeToFileTime
ResumeThread
TlsSetValue
ResetEvent
OpenEventA
GetCurrentThreadId
TlsGetValue
TlsFree
TlsAlloc
DecodePointer
EncodePointer
LeaveCriticalSection
SetEnvironmentVariableW
GetFileAttributesExW
SetFileTime
GetDiskFreeSpaceExW
FindNextFileW
EnumSystemLocalesA
CreateMutexW
OpenThread
SetThreadAffinityMask
GetLogicalDriveStringsW
GetVolumeInformationW
MoveFileW
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
VirtualQuery
GetTimeZoneInformation
FreeLibrary
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW

oleaut32

VariantClear

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

msimg32

AlphaBlend

dbghelp

SymInitialize
SymFunctionTableAccess
StackWalk
SymGetSymFromAddr
SymGetLineFromAddr
SymSetOptions
SymGetOptions
SymCleanup
SymGetModuleBase

winmm

timeBeginPeriod
timeEndPeriod

ws2_32

getsockname
ioctlsocket
recvfrom
WSAStartup
WSACleanup
closesocket
shutdown
WSARecv
WSASend
WSASocketW
setsockopt
select
getaddrinfo
freeaddrinfo
connect
getsockopt
recv
sendto
accept
listen
getnameinfo
WSASendTo
ntohl
WSARecvFrom
inet_ntoa
htonl
getservbyname
htons
WSAGetLastError
gethostbyname
inet_addr
bind
WSASetLastError
getservbyport
socket
gethostbyaddr
gethostname
send
ntohs

iphlpapi

GetBestInterface
GetAdaptersAddresses

netapi32

NetApiBufferFree
NetWkstaTransportEnum

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 384KB - Virtual size: 383KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 363KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AnyDesk.exe
.exe windows:5 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

02-08-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:ea:a4:08:03:a9:22:6f:30:37:43:ee:53:7d:5c:d6:2d
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-08-2015 15:32

Not After

24-10-2018 08:08

Subject

CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=BW,C=DE,1.2.840.113549.1.9.1=#0c1263657274407068696c616e64726f2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

02-08-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:ea:a4:08:03:a9:22:6f:30:37:43:ee:53:7d:5c:d6:2d
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-08-2015 15:32

Not After

24-10-2018 08:08

Subject

CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=BW,C=DE,1.2.840.113549.1.9.1=#0c1263657274407068696c616e64726f2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02-01-2017 00:00

Not After

01-04-2028 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9a:a7:89:4f:6f:97:75:80:e2:d2:00:9e:37:ef:9b:67:fa:e6:a5:37:7c:ad:9a:3f:f9:2b:ba:84:03:f5:06:a1
Signer

Actual PE Digest

9a:a7:89:4f:6f:97:75:80:e2:d2:00:9e:37:ef:9b:67:fa:e6:a5:37:7c:ad:9a:3f:f9:2b:ba:84:03:f5:06:a1

Digest Algorithm

sha256

PE Digest Matches

true

57:a8:2d:4c:9e:2a:7a:f0:7d:16:81:f4:f2:dc:bd:fe:bf:5d:ef:27
Signer

Actual PE Digest

57:a8:2d:4c:9e:2a:7a:f0:7d:16:81:f4:f2:dc:bd:fe:bf:5d:ef:27

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: - Virtual size: 6.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 750B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64720560b6fe716899d329e150e5fb91

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

e7:2f:7d:af:59:8d:88:b5:ac:fb:72:a8:1b:50:40:e8Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

30:14:bb:cc:d5:9f:5c:55:57:51:e5:a3:90:4f:64:fd:7c:84:8c:c7Signer

Headers

File Characteristics

Imports

ws2_32

gdi32

user32

shell32

msvcp60

msvcrt

secur32

setupapi

iphlpapi

advapi32

shlwapi

comdlg32

userenv

comctl32

wininet

dsound

kernel32

Sections

.text Size: 528KB - Virtual size: 524KB

.rdata Size: 100KB - Virtual size: 98KB

.data Size: 80KB - Virtual size: 107KB

.rsrc Size: 44KB - Virtual size: 40KB

cb9d62a05f5070b7d4e4e901f2587f78

Code Sign

66:07:44:a7:fe:ef:16:ac:4d:68:f9:bb:dd:e7:3e:16Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

29:b8:39:22:4b:2f:8a:63:8d:c6:9d:7d:86:56:ce:7f:fe:45:ae:f0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

gdi32

comctl32

shell32

advapi32

ole32

kernel32

oleaut32

wtsapi32

userenv

msimg32

dbghelp

winmm

ws2_32

iphlpapi

netapi32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 384KB - Virtual size: 383KB

.data Size: 363KB - Virtual size: 3.6MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

e7:2f:7d:af:59:8d:88:b5:ac:fb:72:a8:1b:50:40:e8
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

30:14:bb:cc:d5:9f:5c:55:57:51:e5:a3:90:4f:64:fd:7c:84:8c:c7
Signer

.text
Size: 528KB - Virtual size: 524KB

.rdata
Size: 100KB - Virtual size: 98KB

.data
Size: 80KB - Virtual size: 107KB

.rsrc
Size: 44KB - Virtual size: 40KB

66:07:44:a7:fe:ef:16:ac:4d:68:f9:bb:dd:e7:3e:16
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

29:b8:39:22:4b:2f:8a:63:8d:c6:9d:7d:86:56:ce:7f:fe:45:ae:f0
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 384KB - Virtual size: 383KB

.data
Size: 363KB - Virtual size: 3.6MB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 147KB - Virtual size: 147KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:21:ea:a4:08:03:a9:22:6f:30:37:43:ee:53:7d:5c:d6:2d
Certificate

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

11:21:ea:a4:08:03:a9:22:6f:30:37:43:ee:53:7d:5c:d6:2d
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

9a:a7:89:4f:6f:97:75:80:e2:d2:00:9e:37:ef:9b:67:fa:e6:a5:37:7c:ad:9a:3f:f9:2b:ba:84:03:f5:06:a1
Signer

57:a8:2d:4c:9e:2a:7a:f0:7d:16:81:f4:f2:dc:bd:fe:bf:5d:ef:27
Signer

.text
Size: 10KB - Virtual size: 10KB

.itext
Size: - Virtual size: 6.5MB

.rdata
Size: 1024B - Virtual size: 750B

.data
Size: 1.9MB - Virtual size: 1.9MB

.rsrc
Size: 28KB - Virtual size: 28KB

.reloc
Size: 1024B - Virtual size: 768B