Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

anydesk_resolver.exe

Gen1 Generic Malware Malicious Library Malicious Packer .NET DLL PE64 PE File OS Processor Check DLL

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 15, 2021, 10:35 a.m.	Sept. 15, 2021, 10:37 a.m.

Size	5.1MB
Type	PE32+ executable (console) x86-64, for MS Windows
MD5	`df701faf88644d68ec3e380f72f432be`
SHA256	`aecbf25226c2b78bec1f90d17e25c38b5ea2d72a5abd99d09a80f3708b14cb09`
CRC32	`82686AA2`
ssdeep	`98304:pleMM4CnotnbtFSur2WtdSKqgXuaLBwDhk/U94OO2QaVGetbFObISsG4zTwNJNs:pleWVBAdqd2gXuQBuiYORx1ESsFz8NHs`
Yara	IsPE64 - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library

anydesk_resolver.exe "C:\Users\test22\AppData\Local\Temp\anydesk_resolver.exe"
2444
- anydesk_resolver.exe "C:\Users\test22\AppData\Local\Temp\anydesk_resolver.exe"
  2240

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\_MEI24442\python27.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI24442\msvcr90.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI24442\msvcm90.dll
file	C:\Users\test22\AppData\Local\Temp\_MEI24442\msvcp90.dll

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

APEX	Malicious
McAfee-GW-Edition	BehavesLike.Win64.HToolLazagne.tc

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000ec00', u'virtual_address': u'0x00046000', u'entropy': 7.297139614323312, u'name': u'.rsrc', u'virtual_size': u'0x0000ea38'}

entropy

7.29713961432

description

A section with a high entropy has been found

entropy

0.221804511278

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 15, 2021, 10:28 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Expresses interest in specific running processes (1 event)

process

audiodg.exe

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 15, 2021, 10:28 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0