Architecture |
IMAGE_FILE_MACHINE_I386
|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date |
2021-Mar-08 18:13:01
|
Detected languages |
English - United States
|
Debug artifacts |
C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb
|
CompanyName |
philandro Software GmbH
|
FileDescription |
AnyDesk
|
FileVersion |
6.2.3.0
|
ProductName |
AnyDesk
|
ProductVersion |
6.2
|
LegalCopyright |
(C) 2021 philandro Software GmbH
|
Suspicious |
Strings found in the binary may indicate undesirable behavior: |
Looks for Qemu presence:
|
Suspicious |
The PE is possibly packed. |
Unusual section name found: .itext
The PE only has 0 import(s).
|
Info |
The PE is digitally signed. |
Signer: philandro Software GmbH
Issuer: DigiCert SHA2 Assured ID Code Signing CA
|
Safe |
VirusTotal score: 0/69 (Scanned on 2021-05-03 21:37:20) |
All the AVs think this file is safe.
|
MD5 |
64d3b02073aa813c69cf0ca52182fa37
|
SHA1 |
f9aefd3d984cdb4866c110f08407f1989eff7fb6
|
SHA256 |
1c702e234542e2bb53e45211cc3ae4426a5088de9510dae58a9ff8b7a65e294f
|
SHA3 |
de82468b0bc544ab7be3cc2fda9b2d3a2e7974eab59fa5b7aac4554892649fdb
|
SSDeep |
49152:/4zJlO9Tddc2cC6ohU+5Ja0EbMYp0PHJ3zgROYbhnUvOVhYoST8RQXoYz+lJI:8+dYaHUeJabdipTchUvEhZSiKpKI
|
Imports Hash |
d41d8cd98f00b204e9800998ecf8427e
|
e_magic |
MZ
|
e_cblp |
0x90
|
e_cp |
0x3
|
e_crlc |
0
|
e_cparhdr |
0x4
|
e_minalloc |
0
|
e_maxalloc |
0xffff
|
e_ss |
0
|
e_sp |
0xb8
|
e_csum |
0
|
e_ip |
0
|
e_cs |
0
|
e_ovno |
0
|
e_oemid |
0
|
e_oeminfo |
0
|
e_lfanew |
0xd0
|
Signature |
PE
|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections |
6
|
TimeDateStamp |
2021-Mar-08 18:13:01
|
PointerToSymbolTable |
0
|
NumberOfSymbols |
0
|
SizeOfOptionalHeader |
0xe0
|
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Magic |
PE32
|
LinkerVersion |
10.0
|
SizeOfCode |
0x2a00
|
SizeOfInitializedData |
0x38c000
|
SizeOfUninitializedData |
0xa42200
|
AddressOfEntryPoint |
0x00001CE9 (Section: .text)
|
BaseOfCode |
0x1000
|
BaseOfData |
0x4000
|
ImageBase |
0x400000
|
SectionAlignment |
0x1000
|
FileAlignment |
0x200
|
OperatingSystemVersion |
5.1
|
ImageVersion |
0.0
|
SubsystemVersion |
5.1
|
Win32VersionValue |
0
|
SizeOfImage |
0xdd6000
|
SizeOfHeaders |
0x400
|
Checksum |
0x397821
|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve |
0x100000
|
SizeofStackCommit |
0x1000
|
SizeofHeapReserve |
0x100000
|
SizeofHeapCommit |
0x1000
|
LoaderFlags |
0
|
NumberOfRvaAndSizes |
16
|
MD5 |
a0ceebb5fd42f8b86df86518cce19f16
|
SHA1 |
6ee3ef377e65ae5c50f83a4cabfda820e478e957
|
SHA256 |
8322ccbd6a595f0f76e491f85c2bf9a280c9a72adce903b70d89a47e3ac18113
|
SHA3 |
72305d24206867e2c92c4dff7581185e93da14c26a0f69efbfbb7f1c0d7d8628
|
VirtualSize |
0x2835
|
VirtualAddress |
0x1000
|
SizeOfRawData |
0x2a00
|
PointerToRawData |
0x400
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
|
Entropy |
6.51207
|
MD5 |
d41d8cd98f00b204e9800998ecf8427e
|
SHA1 |
da39a3ee5e6b4b0d3255bfef95601890afd80709
|
SHA256 |
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
SHA3 |
a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
|
VirtualSize |
0xa42200
|
VirtualAddress |
0x4000
|
SizeOfRawData |
0
|
PointerToRawData |
0
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
MD5 |
b9354c5ed4a14ca38768bfe0135130eb
|
SHA1 |
8b7d9ae867f97810ffcce0bc12b8da2f1b2099a5
|
SHA256 |
3fcc76a52a09ae832745c618189081ccf1fe311177311c5a9d1b18c6a9c4a512
|
SHA3 |
fe1cf068be08070a2796525edd42a380d72fbfd0abede51171a7b1e60f1329a0
|
VirtualSize |
0x2fa
|
VirtualAddress |
0xa47000
|
SizeOfRawData |
0x400
|
PointerToRawData |
0x2e00
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
Entropy |
5.62601
|
MD5 |
3caeb2a361fe91c222608caceb2f4cce
|
SHA1 |
d53fa69af8a73ca48ed4197eb88936efc22698cd
|
SHA256 |
8cc8642d41f312a3cadbf7bae7af8ea70ad60b1a380c8875b7f42070d1a46890
|
SHA3 |
55fe944588996f1dac5e5cba921b5b3b74a0ae67f515f5e92177ddde1a1d34b7
|
VirtualSize |
0x38827c
|
VirtualAddress |
0xa48000
|
SizeOfRawData |
0x388000
|
PointerToRawData |
0x3200
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
|
Entropy |
7.99995
|
MD5 |
701643fcdb723eaa3a269037fdd6b8f3
|
SHA1 |
323a00ee6dca50c76d872c8050640da97aa40978
|
SHA256 |
4612454117fc4b846f2700aa9092c4257d8d708eaf1c70cef6867262c548bdbb
|
SHA3 |
422c8aead9fe08607fc2c97d99bb335d44e048d6215474540fab12f6d261aba1
|
VirtualSize |
0x3290
|
VirtualAddress |
0xdd1000
|
SizeOfRawData |
0x3400
|
PointerToRawData |
0x38b200
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
|
Entropy |
6.68372
|
MD5 |
95aa79c39ba19e7065545a9504efb057
|
SHA1 |
0b146f6223287e78734c21d004fd6e2764080bdb
|
SHA256 |
d909b4b19ef8c89005170ccce336cef3c4390d831c9dd2480dd95cceeeba9382
|
SHA3 |
8a336fa1a4212c3f4a719a03b8b4136c86a4d57a1cf343ec42422a5f6b60c59b
|
VirtualSize |
0x300
|
VirtualAddress |
0xdd5000
|
SizeOfRawData |
0x400
|
PointerToRawData |
0x38e600
|
PointerToRelocations |
0
|
PointerToLineNumbers |
0
|
NumberOfLineNumbers |
0
|
NumberOfRelocations |
0
|
Characteristics |
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
|
Entropy |
1.18127
|
Type |
RT_ICON
|
Language |
English - United States
|
Codepage |
UNKNOWN
|
Size |
0x1b8e
|
TimeDateStamp |
1980-Jan-01 00:00:00
|
Entropy |
7.83901
|
Detected Filetype |
PNG graphic file
|
MD5 |
c88936dd1a7d59c4403d6babb04dd87e
|
SHA1 |
cc33904defad90d05ccec92b7fff7d5902941795
|
SHA256 |
ea057e896209478d8290a1b526cae84f2509678d866d08382614707f3b710d47
|
SHA3 |
28528f7316cb893a622c6611bbd967fcc40de2bf615e7332dee0fbd31997398e
|
Type |
RT_ICON
|
Language |
English - United States
|
Codepage |
UNKNOWN
|
Size |
0x668
|
TimeDateStamp |
1980-Jan-01 00:00:00
|
Entropy |
2.29968
|
MD5 |
092bef43014ecb8adbaf06131ce5e40b
|
SHA1 |
1b15bd67961afbecb0cbbd1183c2d0dc9ed9e7cf
|
SHA256 |
f50850ec3e997252b5533691868d04c15e923efe4f694c0ea8126f612e60404c
|
SHA3 |
cab0b87867861997a7a03b362811b9052b40dea25bcd54a88c60956b6f6e9968
|
Type |
RT_ICON
|
Language |
English - United States
|
Codepage |
UNKNOWN
|
Size |
0x2e8
|
TimeDateStamp |
1980-Jan-01 00:00:00
|
Entropy |
3.6735
|
MD5 |
3a69266d6258e81e65a29138c95fe2a8
|
SHA1 |
606560abf36b292f238d7ad4aa6c09ec8a21f8a3
|
SHA256 |
bc1cb94bcc63c8541ff535da88ed153ff3346db3fb93fc27fe87d414b2038dc4
|
SHA3 |
4204359c479df05357b6bf705b0d2961c1a4317d43977784fcf2835e25209f54
|
Type |
RT_ICON
|
Language |
English - United States
|
Codepage |
UNKNOWN
|
Size |
0x1e8
|
TimeDateStamp |
1980-Jan-01 00:00:00
|
Entropy |
2.73746
|
MD5 |
75705b8eedfc400d14f7ae9c8f40935b
|
SHA1 |
ebecc73c1403107ce631cc21a6c4262a4c0ee1aa
|
SHA256 |
c433628ee32bb8698e81f2ebb23d615e4bcf34ba954055410c64c3638c95503c
|
SHA3 |
3b0525e50fdad680ebf6318fef60a34ffd36ae26a82fa7bb4675d27b0227a0e2
|
Type |
RT_ICON
|
Language |
English - United States
|
Codepage |
UNKNOWN
|
Size |
0x128
|
TimeDateStamp |
1980-Jan-01 00:00:00
|
Entropy |
3.69265
|
MD5 |
76b057741da4577549a4b9ef8f585bb3
|
SHA1 |
4d4f6f821507639f8214bae9aa2be1f480b7e844
|
SHA256 |
b008246dad106e522b98810ce6bc1212c8f12e78a6f77506283782438ea5b65d
|
SHA3 |
acce4c5df16010fce31dd43cfe4645d11a9aadc7ccd5da162bdbd154c1ac9b78
|
Type |
RT_GROUP_ICON
|
Language |
English - United States
|
Codepage |
UNKNOWN
|
Size |
0x4c
|
TimeDateStamp |
1980-Jan-01 00:00:00
|
Entropy |
2.78538
|
Detected Filetype |
Icon file
|
MD5 |
53975c41e7520296015f9db3f16a6c74
|
SHA1 |
03aad254664361f296e2c982968d4afb537a573e
|
SHA256 |
4041084c14f8f142bf7919feedf1437c9bdb5c3040db4a2bd2b0cf387f006fcf
|
SHA3 |
79879cd09c0a4a1d24967b53fe230d9ae0fc1613299a75561402de6ad65509c7
|
Type |
RT_VERSION
|
Language |
English - United States
|
Codepage |
UNKNOWN
|
Size |
0x258
|
TimeDateStamp |
1980-Jan-01 00:00:00
|
Entropy |
3.37473
|
MD5 |
b34a737049361b470aa18a9f3a0b051d
|
SHA1 |
591a1310eca44be4f3d1f50cd074095c252dc30f
|
SHA256 |
a9363009a16353034253510d14cd242a441168ab3799569b32d5d8e2c9605f68
|
SHA3 |
f1a79c077d95d0f5ece14af525910e9420ecc7b82d2355ea155e1ccf985c3a09
|
Type |
RT_MANIFEST
|
Language |
English - United States
|
Codepage |
UNKNOWN
|
Size |
0x607
|
TimeDateStamp |
1980-Jan-01 00:00:00
|
Entropy |
5.39342
|
MD5 |
b0e3070dd9b8b8fcfc94357620c55977
|
SHA1 |
df3fb3c63a2af18f2cd1ad1b5393fe23a9d02d99
|
SHA256 |
7f4d763eebe47170014c00a7cf443b401591973e056211f89df1e984e49c0463
|
SHA3 |
e6540a65c47dfe6637be941660618ea9496ad01237be454c42e23b191461af65
|
Signature |
0xfeef04bd
|
StructVersion |
0x10000
|
FileVersion |
6.2.3.0
|
ProductVersion |
0.0.0.0
|
FileFlags |
(EMPTY)
|
FileOs |
(EMPTY)
|
FileType |
VFT_APP
|
Language |
English - United States
|
CompanyName |
philandro Software GmbH
|
FileDescription |
AnyDesk
|
FileVersion (#2) |
6.2.3.0
|
ProductName |
AnyDesk
|
ProductVersion (#2) |
6.2
|
LegalCopyright |
(C) 2021 philandro Software GmbH
|
Resource LangID |
English - United States
|
Characteristics |
0
|
TimeDateStamp |
2021-Mar-08 18:13:01
|
Version |
0.0
|
SizeofData |
94
|
AddressOfRawData |
0xa4729c
|
PointerToRawData |
0x309c
|
Referenced File |
C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb
|
XOR Key |
0x3b897dad
|
Unmarked objects |
0
|
C++ objects (VS2010 build 30319) |
8
|
C objects (VS2010 build 30319) |
3
|
Resource objects (VS2010 SP1 build 40219) |
1
|
Linker (VS2010 build 30319) |
1
|
[*] Warning: Section .itext has a size of 0!