CALManydesk.zip
- SHA256 c4ae0440a4f7b6c610b19f79ef03605593e9fe37bb4bb16cb4689f57ef6dcc25
Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
AnyDesk.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target CALManydesk.zip
- Size 3.0MB
- Sample260804-shya7acf85
- SHA256 c4ae0440a4f7b6c610b19f79ef03605593e9fe37bb4bb16cb4689f57ef6dcc25
- MD5 442c092d41c38fdc0674fed992e26918
- SHA1 d385c0d0d60a288ac96f87b95e3f831071b75e55
- SHA512 2f2751b1152973ef2e18038738c1a8270752e5ac5ede4378ff1bb91fc731cd7df3e33cb8003b9a63145208d0cf9611d0766a2fef924550ab370eb97f39065b40
- SSDEEP 49152:Wf0Hz1mZMVrllvN4pFHV0yroiI9gEK4sCo7oTiQOJnMlOeZbf9Ej1DzMDiJp5Rwu:M0T1cMVrjk30aoiEo3Co1QAMlJZbfKEq
- TLSH T15DE533FC21A45335447A75518EEB83AF472C830D42EB1377639BDDEEE881788A35A1D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
File Explorer
-
CALManydesk.zip.zip 3.0MB
-
AnyDesk.exe.exe 3.0MB
-
PROGRAMI ÇALIŞTIRMADAN ÖNCE!!! BENİ OKU!!!!.txt449B
AnyDesk.exe
- SHA256 b9ad79eaf7a4133f95f24c3b9d976c72f34264dc5c99030f0e57992cb5621f78
- MD5 eb80f7bddb699784baa9fbf2941eaf4a
- SHA1 df6abbfd20e731689f3c7d2a55f45ac83fbbc40b
- SHA512 3a1162e9fef849cb7143dc1898d4cfcfd87eb80ced0edb321dfa096686b25ae8a9a7f3ae8f37a09724d94f96d64e08940fc23c0b931ddd8a1e70e2792cb3fe47
- SSDEEP 98304:6aJXyQTrRGlSMoIuORmKBQielvZlpkiSti:3olMcR9BTY3WS
- TLSH T118E533EC22509231C47B6A714EFB836F1628934902FB0777A397D8EFD981745B36A1D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
01:d9:ce:e9:2a:fc:61:2b:3e:24:c2:93:38:22:88:fe:03:90:48:49:a5:ad:1a:e9:bb:80:9b:39:14:d0:eb:6e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,C=DE
Chains
Dec 17, 2019
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,C=DE
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
e8:65:ec:4e:6b:d9:58:6c:88:8b:41:88:0f:0d:23:e8:77:3e:8d:a1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,C=DE
Chains
Dec 17, 2019
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,C=DE
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,C=DE
Serial Number
03:e9:eb:4d:ff:67:d4:f9:a5:54:a4:22:d5:ed:86:f3
Issuer
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 24, 2018 - Jan 5, 2022
Subject
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 22, 2013 - Oct 22, 2028
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
1
Major OS version
5
Entry point
7401
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
Virtual Size
9.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1024B
Virtual Size
766B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
768B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=171, productName=VS2010 build 30319, version=30319,
count=3, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 build 30319, version=30319,
PROGRAMI ÇALIŞTIRMADAN ÖNCE!!! BENİ OKU!!!!.txt
- SHA256 6e7b28e4e9d6416ce224806bbd9756641315a3a03baeb416a58dbee904498db8
- MD5 23e631a47a20231a7a97eaee790f1615
- SHA1 763a95b08bad0db840367f44f8cf1deef6127009
- SHA512 4872681fc2ebc34f72eeb902847735627430b3933e836dc6b682e35371b3cf0ada404ffcdd01aa14b102cdef75ed2a0bfc48985f5a2d0c9b62632bd2746dcf64
- TLSH T1F8F02752848B3C1D2FAB42CA60520469D21B8A30A925A1C6B09D298AB524AB6132A01C
- MD5 SHA1 SHA512 TLSH