Ammyy.exe
First submission 2024-10-18 06:36:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 748.0 KB (765952 bytes) |
| Compile time: | 2015-05-29 12:36:12 |
| MD5: | 3b4ed97de29af222837095a7c411b8a1 |
| SHA1: | ea003f86db4cf74e4348e7e43e4732597e04db96 |
| SHA256: | 74656a65e96590a2734384bf89cb9ff677dcedff5f6e937d350b9f46ec52cd0a |
| Import Hash : | 3a8eb283f62eca7206b65c62b7d51bd5 |
| Sections 4 | .text .rdata .data .rsrc |
| Directories 2 | import resource |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 53/77 VT report date: 2024-10-16 18:38:25 |
| Malware Type 3 | hacktool pua trojan |
| Threat Type 2 | ammyy filereppup |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://soportegira.net/descargas/Ammyy.exe  |
soportegira.net |
2024-10-18 06:36:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x81faa | 532480 | 3e59ddbedd9b533d6a8d9862cb310d5b92a384ed | 18f21f4bf8c8043c6d676796d512243f | |
| .rdata | 0x83000 | 0x185b6 | 102400 | 6d9fd015d79ca29588f3b35415d92580a882ff06 | 6bbf88e0cd6467daec2d2b231584f8da | |
| .data | 0x9c000 | 0x1ad40 | 81920 | 0127f7a2808405b476254124c8b2df88d0d205b0 | eddb86cbb4b45a1e2c497057bcaf21a4 | |
| .rsrc | 0xb7000 | 0xa22c | 45056 | 5a3bdc5ddaddc751b7425b039ac61cb4c54d6f9a | 1eafa77e8ebdab649e26a7927ebea94a |
PE Resources 11
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| BINARY | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xb79c8 | 38 | |
| RT_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xb7c58 | 308 | |
| RT_BITMAP | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xbad78 | 1194 | |
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xbe874 | 1128 | |
| RT_MENU | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xbecdc | 250 | |
| RT_DIALOG | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xc0944 | 784 | |
| RT_GROUP_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xc0c7c | 20 | |
| RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xc0c90 | 48 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xc0cc0 | 736 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xc0fa0 | 637 | |
| None | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xc1220 | 11 |
Meta infos 13
| LegalCopyright: | |
| InternalName: | Ammyy Admin |
| FileVersion: | 3.5 |
| FileDescription: | Ammyy Admin |
| SpecialBuild: | |
| CompanyName: | Ammyy LLC |
| LegalTrademarks: | |
| Comments: | |
| ProductName: | Ammyy Admin |
| ProductVersion: | 3.5 |
| PrivateBuild: | |
| Translation: | 0x0409 0x04b0 |
| OriginalFilename: |
Packers detected 3
| Microsoft Visual C++ v6.0 |
| Microsoft Visual C++ 5.0 |
| Microsoft Visual C++ |
Anti debug functions 7
| FindWindowA |
| FindWindowW |
| GetLastError |
| GetWindowThreadProcessId |
| Process32First |
| Process32Next |
| TerminateProcess |
Anti debug functions 1
| VMCheck.dll |
Strings analysis - File found
| Binary |
| Ammyy_Contact_Book.bin |
| *.bin |
| contacts3.bin |
| _tmp\AMMYY_Admin.bin |
| settings3.bin |
| settings.bin |
| contacts.bin |
| sessions.bin |
| Log |
| eAMMYY_service.log |
| ammyy.log |
| ammyy_id.log |
| Temporary |
| %sAmmyy_%X.tmp |
| Object |
| hhctrl.ocx |
| Library |
| W\winsta.dll |
| ewmsgapi.dll |
| ADVAPI32.dll |
| SHLWAPI.dll |
| dwmapi.dll |
| WTSAPI32.dll |
| MSVCRT.dll |
| USER32.dll |
| SHELL32.dll |
| WS2_32.dll |
| COMCTL32.dll |
| secur32.dll |
| WININET.dll |
| USERENV.dll |
| SETUPAPI.dll |
| GDI32.dll |
| KERNEL32.dll |
| DSOUND.dll |
| COMDLG32.dll |
| IPHLPAPI.DLL |
| msvcp60.dll |
Strings analysis - Possible IPs found 2
| 1.0.0.1 |
| 127.0.0.1 |
Strings analysis - Possible URLs found 4
| http://www.ammyy.com/?lang= |
| http://www.ammyy.com/ |
| http://rl.ammyy.com |
| http://www.ammyy.com |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| assistenza.exe | 2024-10-18 06:38:02 | 11bc606269a161555431bacf37f7c1e4 |