General

  • Target
    gP20jUla_stage2.exe
  • Size 7.9MB
  • Sample260905-esed6swfph
  • SHA256 d83236fad1405ff369f16ad12b684a30177fe81c47c1f824f9fea6b74d64cc4a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • gP20jUla_stage2.exe
    .exe 7.9MB

gP20jUla_stage2.exe

  • SHA256 d83236fad1405ff369f16ad12b684a30177fe81c47c1f824f9fea6b74d64cc4a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5a:94:6e:60:87:07:72:97:87:f2:87:be:95:89:c6:43:a2:c2:01:a9:cf:22:e1:ef:c4:e9:f1:59:a7:eb:71:c5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=AnyDesk Software GmbH,O=AnyDesk Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
Digest
f3:7b:47:d8:a6:9d:f3:c5:ab:5c:5e:c7:12:bc:dc:4a:72:10:ea:18
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=AnyDesk Software GmbH,O=AnyDesk Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
Minor OS version
1
Major OS version
5
Entry point
13151
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\worker\workspace\AD_windows32\release\win_9.7.6\7766\anydesk\release\app-32\win_loader\Static\AnyDesk.pdb