AnyDesk.exe

First submission 2023-09-17 15:07:03

File details

File type: PE32+ executable (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 2941.0 KB (3011584 bytes)
Compile time: 2023-04-15 17:22:57
MD5: eafba56f876c04229c33c88a0bd964fa
SHA1: d34f886a895f190c8a2d1bf4e46cbf104358126c
SHA256: 76c77a70b8ff02ec28049a28fdb538a5d663f548b48e9a449371edd4c414a15e
Import Hash : 310b1cc8abef97edfcabf0ed406947cf
Sections 7 .text .rdata .data .pdata _RDATA .rsrc .reloc
Directories 7 import export resource debug tls relocation security
Virus Total: 6/71 VT report date: 2023-08-07 06:31:38

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://44.203.122.41/AnyDesk.exe VirusTotal Report 44.203.122.41 VirusTotal Report 2023-09-17 15:07:03

PE Sections 0 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x178a20 1543168 5ff403567d853a9482c7a4dc960a6994ee7d3f30 1552765ed83a35ffe9113b561238b851
.rdata 0x17a000 0x8c2da 574464 67f126f9cbea35eb45c232b1028161bb5e593d08 e934c99034e15765d1db578e6405c7e2
.data 0x207000 0x9d550 8704 915d09edea8b1dfef551aedd70aa208c9bd7732a 2e9734a232d357816e658e855884e1d8
.pdata 0x2a5000 0xbb98 48128 1e4e7af465d43c8c5f9b476a8428a6a05d7bb909 f67b091706caa69e143de9698f72b127
_RDATA 0x2b1000 0xf4 512 ed03abd2710b72ad6c85ef9832d4c1980da0cc5f e19dca33925cdcac4bd0b6cfb1cf0978
.rsrc 0x2b2000 0xcabb4 830464 85726ddad5ea844f26755728aca71d7c7ddaa2ec dba109fac95078e74960a1269bdd5cd6
.reloc 0x37d000 0x1240 5120 7a8b61a8d2ee46b99172cc331d43bc2c2d441616 979092f6149455888b9f0f12f09be6aa

PE Resources 12

Name Language Sublanguage Offset Size Data
AFX_DIALOG_LAYOUT LANG_ENGLISH SUBLANG_ENGLISH_US 0x2b3200 2
JAVAARCHIVE LANG_DUTCH SUBLANG_DUTCH_BELGIAN 0x2c52f4 73919
RT_CURSOR LANG_ENGLISH SUBLANG_ENGLISH_US 0x2de51c 3244
RT_BITMAP LANG_ENGLISH SUBLANG_NEUTRAL 0x2e2f04 924
RT_ICON LANG_DUTCH SUBLANG_DUTCH_BELGIAN 0x3765f8 1128
RT_MENU LANG_ENGLISH SUBLANG_ENGLISH_US 0x376cf8 104
RT_DIALOG LANG_ENGLISH SUBLANG_ENGLISH_US 0x37a2d8 650
RT_STRING LANG_ENGLISH SUBLANG_ENGLISH_US 0x37bb18 1788
RT_GROUP_CURSOR LANG_ENGLISH SUBLANG_ENGLISH_US 0x37c358 20
RT_GROUP_ICON LANG_DUTCH SUBLANG_DUTCH_BELGIAN 0x37c43c 132
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x37c4c0 876
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x37c82c 903

Meta infos 12

LegalCopyright: Copyright \xa9 2021 UltraVNC
InternalName: WinVNC
FileVersion: 1.4.2.0
CompanyName: UltraVNC
PrivateBuild: 1.4.2.0
LegalTrademarks: VNC
Comments: UltraVNC - Remote Control for all
ProductName: UltraVNC
ProductVersion: 1.4.2.0
FileDescription: VNC server
Translation: 0x0000 0x04b0
OriginalFilename: WinVNC.exe

Packers detected 1

Microsoft Visual C++ 8.0 (DLL)

Anti debug functions 15

FindWindowA
FindWindowExA
GetLastError
GetWindowThreadProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
OutputDebugStringA
OutputDebugStringW
Process32First
Process32FirstW
Process32Next
Process32NextW
RaiseException
TerminateProcess
UnhandledExceptionFilter

File signature

MD5 SHA1 Block size Virtual Address
b9eb909a2c5a47cdd61e536cd220e3d3 52737bfb24fa5e6e6beaf9a55aba81b6e3a88b3b 10184 3001344

Strings analysis - File found

Log
WinVNC.log
Archive Java
/VncViewer.jar
Data
c:\video1.dat
c:\video0.dat
Library
WVNCNYou selected ms-logon, but the authad.dll
mscoree.dll
ntdll.dll
\winsta.dll
WARNINGLYou selected ms-logon, but the auth.dll
SHLWAPI.dll
sas.dll
\ddengine64.dll
ADVAPI32.dll
VERSION.dll
\ldapauthnt4.dll
USER32.dll
SHELL32.dll
dwmapi.dll
WS2_32.dll
\ldapauth9x.dll
\authSSP.dll
\authadmin.dll
mv2.dll
\schook_legacy64.dll
CFGMGR32.dll
Shcore.dll
IMM32.dll
NETAPI32.dll
ole32.dll
KERNEL32.dll
IPHLPAPI.DLL
\workgrpdomnt4.dll
USERENV.dll
Newdev.dll
radmin32.dll
\logging.dll
vnclang_server.dll
GDI32.dll
riched32.dll
WINSTA.dll
ACTIVEDS.dll
You selected ms-logon, but authSSP.dll
\HAL.DLL
\vnchooks.dll
WTSAPI32.dll
\ldapauth.dll

Strings analysis - Possible IPs found 1

2.1.5.1

Strings analysis - Possible URLs found 5

http://java.sun.com/update/1.4.2/jinstall-1_4-windows-i586.cab#Version=1,4,0,0
https://www.uvnc.com
http://www.uvnc.com
http://java.sun.com/products/plugin/index.html#download
http://forum.uvnc.com

Import functions

PE Exports 51 suspicious

Function Address
adler32 0x1400d3270
adler32_combine 0x1400d3360
adler32_z 0x1400d3030
compress 0x1400d3490
compress2 0x1400d3370
compressBound 0x1400d34b0
crc32 0x1400cc320
crc32_combine 0x1400cc6b0
crc32_final 0x1400cc820
crc32_init 0x1400cc7b0
crc32_update 0x1400cc7f0
crc32_z 0x1400cc260
deflate 0x1400cfe30
deflateBound 0x1400cfc50
deflateCopy 0x1400d0ab0
deflateEnd 0x1400d09a0
deflateGetDictionary 0x1400cf4e0
deflateInit2_ 0x1400ceec0
deflateInit_ 0x1400cee80
deflateParams 0x1400cfa00
deflatePending 0x1400cf870
deflatePrime 0x1400cf8f0
deflateReset 0x1400cf720
deflateResetKeep 0x1400cf5b0
deflateSetDictionary 0x1400cf210
deflateSetHeader 0x1400cf810
deflateTune 0x1400cfbd0
get_crc_table 0x1400cc250
inflate 0x1400ccdc0
inflateCodesUsed 0x1400cedb0
inflateCopy 0x1400ceab0
inflateEnd 0x1400ce5d0
inflateGetDictionary 0x1400ce650
inflateGetHeader 0x1400ce7e0
inflateInit2_ 0x1400ccb20
inflateInit_ 0x1400ccc20
inflateMark 0x1400ced30
inflatePrime 0x1400ccc30
inflateReset 0x1400cc9c0
inflateReset2 0x1400cca10
inflateResetKeep 0x1400cc910
inflateSetDictionary 0x1400ce700
inflateSync 0x1400ce8a0
inflateSyncPoint 0x1400cea60
inflateUndermine 0x1400cec90
inflateValidate 0x1400cece0
uncompress 0x1400d3010
uncompress2 0x1400d2e70
zError 0x1400d3b90
zlibCompileFlags 0x1400d3b80
zlibVersion 0x1400d3b70