AA_v3.exe
First submission 2024-10-16 17:54:03
Last sumbission 2024-10-18 04:57:03
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 782.12 KB (800888 bytes) |
| Compile time: | 2020-03-15 13:46:43 |
| MD5: | 390ddaff20160396e7490b239b4cad9b |
| SHA1: | 44c10c691fc2639b3436abe8dc25542ff5a73067 |
| SHA256: | 357230056c30b4d7a7d697114d3d90ddc9a13dcb174a9a6d1f74c950e5bcd570 |
| Import Hash : | 6659a18bc9d4bed93b5b952214262347 |
| Sections 4 | .text .rdata .data .rsrc |
| Directories 3 | import resource security |
File features detected
XOR
OSINT Enrichments
| Virus Total: | 54/76 VT report date: 2024-10-14 05:19:15 |
| Malware Type 3 | hacktool trojan pua |
| Threat Type 3 | ammyy ammyyadmin deamv |
URLs, FQDN and IP indicators 2
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://artemka.spb.ru/AA_v3.exe  |
artemka.spb.ru |
2024-10-18 04:57:09 |
| hXXp://178.130.39.138/AA_v3.exe |
178.130.39.138 |
2024-10-16 17:54:03 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x8718a | 557056 | b266113d457022382c4e0aa4f47bd9ad4772505e | 93ad55f505e0a74dcd68b7d5dbf86218 | |
| .rdata | 0x89000 | 0x1979e | 106496 | f288571a7b4e6e327e79f57eabad9c25099e3ccd | 11cb44a391a5a990c4c881cfa5a3cb2a | |
| .data | 0xa3000 | 0x1ad90 | 81920 | a50e1a6ba29c6f58179b01485be61f599a370142 | 0d66141168e17f4a47a82f764805b966 | |
| .rsrc | 0xbe000 | 0xa648 | 45056 | cb89a66921a23f46f609a150fd37a592e25087c1 | 2ff37c4dfb41e162965966c2dd39eeb5 |
PE Resources 11
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| BINARY | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xc48c0 | 1 | |
| RT_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xc6068 | 308 | |
| RT_BITMAP | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xc5638 | 1194 | |
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xc37e8 | 4264 | |
| RT_MENU | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xbea00 | 250 | |
| RT_DIALOG | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xc0860 | 156 | |
| RT_GROUP_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xc61a0 | 20 | |
| RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xc4890 | 48 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xc5ae8 | 736 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xc0910 | 1474 | |
| None | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xc0900 | 11 |
Meta infos 13
| LegalCopyright: | |
| InternalName: | Ammyy Admin |
| FileVersion: | 3.9 |
| FileDescription: | Ammyy Admin |
| SpecialBuild: | |
| CompanyName: | Ammyy LLC |
| LegalTrademarks: | |
| Comments: | |
| ProductName: | Ammyy Admin |
| ProductVersion: | 3.9 |
| PrivateBuild: | |
| Translation: | 0x0409 0x04b0 |
| OriginalFilename: |
Packers detected 3
| Microsoft Visual C++ v6.0 |
| Microsoft Visual C++ 5.0 |
| Microsoft Visual C++ |
Anti debug functions 7
| FindWindowA |
| FindWindowW |
| GetLastError |
| GetWindowThreadProcessId |
| Process32First |
| Process32Next |
| TerminateProcess |
Anti debug functions 1
| VMCheck.dll |
File signature
| MD5 | SHA1 | Block size | Virtual Address |
|---|---|---|---|
| a0b57baec9c3ff3000cfd714e456c32a | cabe482153b0ebb735b9e3c8692ea3bee67f6b18 | 6264 | 794624 |
Strings analysis - File found
| Binary |
| Ammyy_Contact_Book.bin |
| *.bin |
| contacts3.bin |
| _tmp\AMMYY_Admin.bin |
| settings3.bin |
| settings.bin |
| contacts.bin |
| sessions.bin |
| Log |
| eAMMYY_service.log |
| ammyy.log |
| ammyy_id.log |
| Temporary |
| %sAmmyy_%X.tmp |
| Object |
| hhctrl.ocx |
| Data |
| %u-%u-%u-%u.dat |
| Library |
| W\winsta.dll |
| Shcore.dll |
| ewmsgapi.dll |
| ADVAPI32.dll |
| SHLWAPI.dll |
| dwmapi.dll |
| WTSAPI32.dll |
| MSVCRT.dll |
| SHELL32.dll |
| WS2_32.dll |
| COMCTL32.dll |
| secur32.dll |
| WININET.dll |
| USER32.dll |
| USERENV.dll |
| SETUPAPI.dll |
| GDI32.dll |
| KERNEL32.dll |
| DSOUND.dll |
| COMDLG32.dll |
| IPHLPAPI.DLL |
Strings analysis - Possible IPs found 2
| 1.0.0.1 |
| 127.0.0.1 |
Strings analysis - Possible URLs found 17
| http://www.ammyy.com/?lang= |
| http://ts-crl.ws.symantec.com/tss-ca-g2.crl0( |
| http://ts-ocsp.ws.symantec.com07 |
| http://ocsp.sectigo.com0 |
| http://crl.thawte.com/ThawteTimestampingCA.crl0 |
| http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0% |
| http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v |
| http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0# |
| https://sectigo.com/CPS0C |
| http://ocsp.thawte.com0 |
| http://www.ammyy.com/ |
| http://ocsp.usertrust.com0 |
| http://www.ammyy.com |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings |
| http://rl.ammyy.com |
| http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s |
| http://ts-aia.ws.symantec.com/tss-ca-g2.cer0< |