AA_v3.exe

First submission 2024-10-16 17:48:02

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 776.0 KB (794624 bytes)
Compile time: 2019-01-22 20:46:05
MD5: 4d4c220362f24e0ba72797572e447795
SHA1: 9f902124218892aa5d61594fe7a9d524a7e7cc08
SHA256: bc483e6acdf276b57bb87317962c0091bb1421e61fa3306490b5858eabc61320
Import Hash : 53059d798e2a15316406229bd2ddc5b6
Sections 4 .text .rdata .data .rsrc
Directories 2 import resource

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://www.netsolution.it/Download/AA_v3.exe VirusTotal Report www.netsolution.it VirusTotal Report 2024-10-16 17:48:02

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x847fa 544768 04f3c4a535f241a38430a57b03998668ad5be933 1a95113eef70f961dac916f7d90ec1e3
.rdata 0x86000 0x192da 106496 9c896bf4431147b8e81e445f092c0c6ab4b66bf4 0d50d5ed9ea4c1221069c971b71a77a7
.data 0xa0000 0x1abd8 81920 fbe2bf04002dd658f816fed6478f8c410676e707 b32ac2d965c11b650ff12c3423c9cf4b
.rsrc 0xbb000 0xda00 57344 f0e882c671d10c8c9d6517840ab140a59361e326 9052f2e3b2734bcdb28aa7a5297fb10f

PE Resources 11

Name Language Sublanguage Offset Size Data
BINARY LANG_NEUTRAL SUBLANG_NEUTRAL 0xbb9f8 44
RT_CURSOR LANG_ENGLISH SUBLANG_ENGLISH_US 0xbbc8c 308
RT_BITMAP LANG_NEUTRAL SUBLANG_NEUTRAL 0xbedac 1194
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0xc3da8 9640
RT_MENU LANG_NEUTRAL SUBLANG_NEUTRAL 0xc6350 250
RT_DIALOG LANG_NEUTRAL SUBLANG_NEUTRAL 0xc838c 156
RT_GROUP_CURSOR LANG_ENGLISH SUBLANG_ENGLISH_US 0xc8450 20
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0xc8464 48
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0xc8494 736
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0xc8774 637
None LANG_NEUTRAL SUBLANG_NEUTRAL 0xc89f4 11

Meta infos 13

LegalCopyright:
InternalName: Ammyy Admin
FileVersion: 3.8
FileDescription: Ammyy Admin
SpecialBuild:
CompanyName: Ammyy LLC
LegalTrademarks:
Comments:
ProductName: Ammyy Admin
ProductVersion: 3.8
PrivateBuild:
Translation: 0x0409 0x04b0
OriginalFilename:

Packers detected 3

Microsoft Visual C++ v6.0
Microsoft Visual C++ 5.0
Microsoft Visual C++

Anti debug functions 7

FindWindowA
FindWindowW
GetLastError
GetWindowThreadProcessId
Process32First
Process32Next
TerminateProcess

Anti debug functions 1

VMCheck.dll

Strings analysis - File found

Binary
Ammyy_Contact_Book.bin
*.bin
settings.bin
contacts3.bin
_tmp\AMMYY_Admin.bin
settings3.bin
contacts.bin
sessions.bin
Log
eAMMYY_service.log
ammyy.log
ammyy_id.log
Temporary
%sAmmyy_%X.tmp
Object
hhctrl.ocx
Data
%u-%u-%u-%u.dat
Library
W\winsta.dll
ewmsgapi.dll
ADVAPI32.dll
SHLWAPI.dll
dwmapi.dll
WTSAPI32.dll
MSVCRT.dll
USER32.dll
SHELL32.dll
WS2_32.dll
COMCTL32.dll
secur32.dll
WININET.dll
USERENV.dll
SETUPAPI.dll
GDI32.dll
KERNEL32.dll
DSOUND.dll
COMDLG32.dll
IPHLPAPI.DLL

Strings analysis - Possible IPs found 2

1.0.0.1
127.0.0.1

Strings analysis - Possible URLs found 4

http://www.ammyy.com/?lang=
http://www.ammyy.com/
http://rl.ammyy.com
http://www.ammyy.com

Import functions