soporte%5Csoporteperfect.exe
First submission 2024-10-16 17:53:02
Last sumbission 2024-10-18 06:37:06
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 746.27 KB (764184 bytes) |
| Compile time: | 2014-07-03 00:56:03 |
| MD5: | f8cd52b70a11a1fb3f29c6f89ff971ec |
| SHA1: | 6a0c46818a6a10c2c5a98a0cce65fbaf95caa344 |
| SHA256: | 6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20 |
| Import Hash : | 59bc1054f3fb6d52d677cef7c12118a3 |
| Sections 4 | .text .rdata .data .rsrc |
| Directories 3 | import resource security |
File features detected
XOR
OSINT Enrichments
| Virus Total: | 46/77 VT report date: 2024-10-07 04:08:11 |
| Malware Type 3 | hacktool trojan pua |
| Threat Type 3 | ammyy ammyyadmin flawedammyy |
URLs, FQDN and IP indicators 2
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://perfectperu.com/soporte%5Csoporteperfect.exe  |
perfectperu.com |
2024-10-18 06:37:12 |
| hXXp://ruterk.com/archive/prog/AA_v3.exe?amp |
ruterk.com |
2024-10-16 17:53:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x81ee2 | 532480 | 787263bf0d082043e11b8ad071e22ccaa3cbfd49 | 639aab0044ce02fd6911f8bac392ae21 | |
| .rdata | 0x83000 | 0x178fc | 98304 | 5dc4a3189665aa06156add1092dda90a15b1ab1d | ac6056676066c53d4ecc13dab6559d05 | |
| .data | 0x9b000 | 0x1a7a0 | 77824 | 6d8c0f280c31da020f4ed8a5c0943fbcf40c9a69 | 53892c33ead40d36fa5b0d2d0610c304 | |
| .rsrc | 0xb6000 | 0xa5e0 | 45056 | 49ad749bc3f1bf87cf1753deee179e42ebc13fa9 | 8613de162d33f736c2f72c2e22502a39 |
PE Resources 11
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| BINARY | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xbc3e8 | 1 | |
| RT_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xbe000 | 308 | |
| RT_BITMAP | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xbd160 | 1194 | |
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xbb310 | 4264 | |
| RT_MENU | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xb6a00 | 250 | |
| RT_DIALOG | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xb82f0 | 784 | |
| RT_GROUP_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xbe138 | 20 | |
| RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xbc3b8 | 48 | |
| RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0xbd610 | 736 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xb8780 | 637 | |
| None | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0xb8770 | 11 |
Meta infos 13
| LegalCopyright: | |
| InternalName: | Ammyy Admin |
| FileVersion: | 3.5 |
| FileDescription: | Ammyy Admin |
| SpecialBuild: | |
| CompanyName: | Ammyy LLC |
| LegalTrademarks: | |
| Comments: | |
| ProductName: | Ammyy Admin |
| ProductVersion: | 3.5 |
| PrivateBuild: | |
| Translation: | 0x0409 0x04b0 |
| OriginalFilename: |
Packers detected 3
| Microsoft Visual C++ v6.0 |
| Microsoft Visual C++ 5.0 |
| Microsoft Visual C++ |
Anti debug functions 7
| FindWindowA |
| FindWindowW |
| GetLastError |
| GetWindowThreadProcessId |
| Process32First |
| Process32Next |
| TerminateProcess |
Anti debug functions 1
| VMCheck.dll |
File signature
| MD5 | SHA1 | Block size | Virtual Address |
|---|---|---|---|
| e3457b975080247605bb3b1fad3b98e1 | d65b3672d2e8f9bd1f93dec40958d67d0891ede1 | 6424 | 757760 |
Strings analysis - File found
| Binary |
| Ammyy_Contact_Book.bin |
| *.bin |
| contacts3.bin |
| _tmp\AMMYY_Admin.bin |
| settings3.bin |
| settings.bin |
| contacts.bin |
| sessions.bin |
| Log |
| eAMMYY_service.log |
| ammyy.log |
| ammyy_id.log |
| Temporary |
| %sAmmyy_%X.tmp |
| Object |
| hhctrl.ocx |
| Library |
| W\winsta.dll |
| ewmsgapi.dll |
| ADVAPI32.dll |
| SHLWAPI.dll |
| dwmapi.dll |
| MSVCRT.dll |
| USER32.dll |
| SHELL32.dll |
| WS2_32.dll |
| WTSAPI32.dll |
| COMCTL32.dll |
| secur32.dll |
| WININET.dll |
| USERENV.dll |
| SETUPAPI.dll |
| GDI32.dll |
| KERNEL32.dll |
| DSOUND.dll |
| COMDLG32.dll |
| IPHLPAPI.DLL |
| msvcp60.dll |
Strings analysis - Possible IPs found 2
| 1.0.0.1 |
| 127.0.0.1 |
Strings analysis - Possible URLs found 18
| https://www.verisign.com/cps0 |
| http://www.ammyy.com/?lang= |
| http://ts-crl.ws.symantec.com/tss-ca-g2.crl0( |
| http://ts-ocsp.ws.symantec.com07 |
| http://crl.thawte.com/ThawteTimestampingCA.crl0 |
| http://ocsp.verisign.com0 |
| http://logo.verisign.com/vslogo.gif04 |
| https://www.verisign.com/rpa |
| http://www.ammyy.com |
| http://crl.verisign.com/pca3-g5.crl04 |
| https://www.verisign.com/rpa0 |
| http://ocsp.thawte.com0 |
| http://www.ammyy.com/ |
| http://csc3-2010-aia.verisign.com/CSC3-2010.cer0 |
| http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D |
| http://rl.ammyy.com |
| http://ocsp.verisign.com0; |
| http://ts-aia.ws.symantec.com/tss-ca-g2.cer0< |