AnyDesk[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AnyDesk.exe
Size 1.7MB
Sample260717-sg9mtsd13p
SHA256 36fb9ea6aa41f5de3e257b9f66fe297009219503f1dac4f6501ed53778777013
MD5 0d7687ecab52b2a6947ab0c876f16387
SHA1 9bc1a5d9fd214725c1bd12dd6849b0cc3f1ba4ee
SHA512 5f805c078a70e705c5638cf3c0bcc7cb076f9b228fb416a4a3ac810ea48596e8597fb889083f83046621888a01dbf45bd40e3a6e868577cac73e4320bd29063b
SSDEEP 49152:zaH2/UNZB6i7zqTpkQ+DnnFvOniEKXDZP5:862q1k9vOixXVP5
TLSH
T11B857C46E39701A8C5668DF88552532BDA3E7CCD032096DB36ECFA291F73AD05AF6311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AnyDesk.exe

File Explorer

AnyDesk.exe

.exe 1.7MB

AnyDesk.exe

IMPHASH 1c353b8604f9dcc7da624a70cdd0f46f
SHA256 36fb9ea6aa41f5de3e257b9f66fe297009219503f1dac4f6501ed53778777013
MD5 0d7687ecab52b2a6947ab0c876f16387
SHA1 9bc1a5d9fd214725c1bd12dd6849b0cc3f1ba4ee
SHA512 5f805c078a70e705c5638cf3c0bcc7cb076f9b228fb416a4a3ac810ea48596e8597fb889083f83046621888a01dbf45bd40e3a6e868577cac73e4320bd29063b
SSDEEP 49152:zaH2/UNZB6i7zqTpkQ+DnnFvOniEKXDZP5:862q1k9vOixXVP5
TLSH
T11B857C46E39701A8C5668DF88552532BDA3E7CCD032096DB36ECFA291F73AD05AF6311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

793564

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

WriteFile CreateMutexW CreateFileW GetLastError CloseHandle GetModuleHandleW DeviceIoControl QueryDosDeviceW Sleep VirtualFree VirtualAlloc GetCurrentThreadId GetCurrentProcessId GetTempPathW CreateFileA QueryPerformanceFrequency HeapAlloc CreateDirectoryW HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA LoadLibraryA AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead ReadFile QueryPerformanceCounter FreeLibrary GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc GetProcAddress MultiByteToWideChar ReleaseSRWLockExclusive GetFileSizeEx

user32

GetClipboardData SetClipboardData EmptyClipboard GetWindowLongW DefWindowProcW PostMessageW GetWindowRect CloseClipboard DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW WaitMessage RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW MoveWindow SetLayeredWindowAttributes TranslateMessage LoadIconW PostQuitMessage UpdateWindow SetForegroundWindow GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetClientRect GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode

advapi32

RegOpenKeyExW RegDeleteTreeW RegCreateKeyW RegOpenKeyW RegCloseKey RegQueryValueExW RegSetKeyValueW RegSetValueExW

shell32

SHGetFolderPathW Shell_NotifyIconW

ole32

CoCreateInstance CoInitializeEx

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?always_noconv@codecvt_base@std@@QEBA_NXZ ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Random_device@std@@YAIXZ _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpOpen WinHttpCrackUrl WinHttpConnect WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest

ntdll

NtLoadDriver NtQuerySystemInformation NtUnloadDriver RtlVirtualUnwind RtlInitUnicodeString RtlCaptureContext RtlLookupFunctionEntry RtlAdjustPrivilege

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memchr memset _CxxThrowException memmove __intrinsic_setjmp memcpy longjmp strrchr __current_exception __current_exception_context wcsstr strstr __C_specific_handler __std_terminate __std_exception_destroy __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _get_stream_buffer_pointers _fseeki64 fsetpos ungetc __stdio_common_vsprintf __p__commode __stdio_common_vfprintf setvbuf fgetpos fseek fgetc _wfopen fclose fputc fflush __stdio_common_vsprintf_s __acrt_iob_func _set_fmode ftell fread fwrite

api-ms-win-crt-runtime-l1-1-0

terminate _c_exit _exit _invoke_watson _initterm_e _beginthreadex _initterm exit _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _wassert _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback

api-ms-win-crt-utility-l1-1-0

srand rand qsort

api-ms-win-crt-string-l1-1-0

strcmp strncpy wcscpy_s strncmp _stricmp strcpy_s

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file _wremove

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr sqrt acosf ceilf cosf fmodf sqrtf sinf powf pow

api-ms-win-crt-locale-l1-1-0

_configthreadlocale