AnyDesk[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AnyDesk.exe
Size 3.3MB
Sample260814-b34v2astcs
SHA256 42099b42afefbeb2cd85efbe6e7c77e3e24ce3d16de6d95b7b4e31a36978194e
MD5 e1d3b593d98343de87e2c82fa7dc0582
SHA1 9653a93ca47c258531aab6947283304ec8d4508e
SHA512 bc3905d72300720800b3afeae6370d344746fe83d5b7689c21f4c55ee349f0512c19f587cc6de59046b8d3f09331553f02b8e06e4641d92312eda5943b39a384
SSDEEP 49152:Y2xs/uwJPZ5Rugq1NTxoPCdIA1sITLl3oKJ6mEO2lfZmmPYEoRP/malS0D4vBZGK:ZLXxof1YEOOalS0sTsQ
TLSH
T161F5E1B972582398D06AC9748563BD07F2723419077585EF37E6FA903F9A1D0AE36F02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AnyDesk.exe

File Explorer

AnyDesk.exe

.exe 3.3MB

AnyDesk.exe

IMPHASH 149e600348cf876b22329070bab73e3c
SHA256 42099b42afefbeb2cd85efbe6e7c77e3e24ce3d16de6d95b7b4e31a36978194e
MD5 e1d3b593d98343de87e2c82fa7dc0582
SHA1 9653a93ca47c258531aab6947283304ec8d4508e
SHA512 bc3905d72300720800b3afeae6370d344746fe83d5b7689c21f4c55ee349f0512c19f587cc6de59046b8d3f09331553f02b8e06e4641d92312eda5943b39a384
SSDEEP 49152:Y2xs/uwJPZ5Rugq1NTxoPCdIA1sITLl3oKJ6mEO2lfZmmPYEoRP/malS0D4vBZGK:ZLXxof1YEOOalS0sTsQ
TLSH
T161F5E1B972582398D06AC9748563BD07F2723419077585EF37E6FA903F9A1D0AE36F02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

635808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9

advapi32

SetEntriesInAclW CreateProcessAsUserW DuplicateTokenEx RegQueryValueExW RevertToSelf GetTokenInformation PrivilegeCheck SetTokenInformation RegEnumValueW QueryServiceStatusEx OpenServiceW RegDeleteValueW RegOpenKeyExW InitializeSecurityDescriptor FreeSid OpenProcessToken RegSetKeySecurity RegEnumKeyExW SetThreadToken AllocateAndInitializeSid OpenSCManagerW CloseServiceHandle RegQueryInfoKeyW RegCloseKey RegGetKeySecurity AdjustTokenPrivileges SetSecurityDescriptorDacl LookupPrivilegeValueW

d3dx9_43

D3DXCreateTextureFromFileInMemory

kernel32

GetLocaleInfoEx FormatMessageA CreateDirectoryW CreateFile2 AreFileApisANSI FindNextFileW FindFirstFileExW FindFirstFileW GetFileInformationByHandleEx WriteProcessMemory GetCurrentProcess WriteFile TerminateProcess GetModuleFileNameW CreatePipe SetFilePointer SetEndOfFile GetTempPathW WaitForSingleObject LocalAlloc CreateFileW GetFileAttributesW OpenProcess SetFileAttributesW MultiByteToWideChar Sleep GetLastError Process32NextW SetFileInformationByHandle DeleteFileW Process32FirstW CloseHandle GetSystemInfo GetProcAddress LocalFree MoveFileExW GetFileSize ReadProcessMemory CreateProcessW GetModuleHandleW WideCharToMultiByte GetTempFileNameW GetTickCount MoveFileW VirtualQueryEx GetCurrentProcessId GetCurrentThreadId LoadLibraryA CompareFileTime K32GetMappedFileNameA Thread32Next Thread32First SuspendThread ResumeThread GetModuleHandleA GetTickCount64 GetThreadTimes OpenThread K32GetModuleBaseNameA K32GetModuleInformation K32EnumProcessModules SetConsoleTextAttribute SetConsoleTitleA GetStdHandle ExitProcess AllocConsole SetConsoleTitleW GlobalAlloc GlobalFree GlobalLock GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter GetStartupInfoW GetCommandLineW InitializeSListHead ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter FindClose GetFileAttributesExW CreateToolhelp32Snapshot GetSystemTimeAsFileTime

user32

GetWindowRect MapWindowPoints SetWindowDisplayAffinity MoveWindow DefWindowProcW GetWindowLongW SetForegroundWindow GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos PeekMessageW TranslateMessage SetWindowLongW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetAsyncKeyState DispatchMessageW

shell32

SHGetFolderPathA SHGetFolderPathW

ole32

CoInitializeEx

msvcp140

_Mtx_unlock _Mtx_lock ?_Xbad_function_call@std@@YAXXZ _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Random_device@std@@YAIXZ ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency __crtLCMapStringA ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??_7_Facet_base@std@@6B@ _Strxfrm ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??_7facet@locale@std@@6B@ _Strcoll ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Facet_base@std@@UEAA@XZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

shlwapi

PathStripPathW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memmove memchr memcpy __std_exception_destroy __std_exception_copy __std_type_info_compare strchr __RTtypeid strstr memcmp

api-ms-win-crt-stdio-l1-1-0

fclose fflush __stdio_common_vsprintf_s _fseeki64 fputc __stdio_common_vsscanf _wfopen __stdio_common_vsprintf fseek _set_fmode __stdio_common_vswprintf_s ftell fread fsetpos __p__commode freopen_s ungetc setvbuf fgetpos __stdio_common_vfprintf fwrite __acrt_iob_func fgetc _get_stream_buffer_pointers

api-ms-win-crt-heap-l1-1-0

malloc realloc _callnewh _set_new_mode free

api-ms-win-crt-string-l1-1-0

strcpy_s strnlen _stricmp wcscpy_s tolower _wcsicmp towlower strcmp strlen strncmp strncpy wcslen

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-runtime-l1-1-0

_wsystem _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function terminate abort _beginthreadex exit _initialize_onexit_table _errno

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

strtoll strtod strtoull atof

api-ms-win-crt-math-l1-1-0

acosf fmodf __setusermatherr ceilf roundf sqrt atan2f _dsign sqrtf logf cosf powf sinf

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func ___lc_locale_name_func ___lc_collate_cp_func