IvantiVPN[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

IvantiVPN.exe
Size

450KB
MD5

2003cead856cedc165699540d7c66ebf
SHA1

447488abb7a98dbebd2f192b881b1c1e415316c2
SHA256

759de1270f4968dcc9fabbaadb9406d22d647a72b983386c5b07bfcc980b5f18
SHA512

942a80ba6b6f56d61facd4d495ae668c638c035389f1402a0db6cc74535507adcdce2d21a5f2b3b6e8d6dc2f16808d61ce01eec25b204e5a565fb4b36b85bfcf
SSDEEP

12288:bn683NHTXRKbyV2DtY5f6jSBSE9EIpLJmXv+gMO:bnP1yUyjsX9EIpLJmXv7R

Score

1^/10

Malware Config

Signatures

Files

IvantiVPN.exe
.exe windows x64

Code Sign

64:89:b0:99:ae:fd:4c:51:b2:43:44:d4:61:89:cb:36
Certificate

Issuer

CN=Pulse Secure\, LLC,O=Pulse Secure\, LLC,L=San Jose,ST=California,C=US

Not Before

07/03/2023, 19:07

Not After

31/12/2039, 23:59

Subject

CN=Pulse Secure\, LLC,O=Pulse Secure\, LLC,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

5f:2f:59:0d:0d:1c:23:cf:21:19:28:a2:e3:a9:44:e8:84:7f:9e:34:50:74:2e:a5:c2:a6:c2:73:ce:fe:43:c1
Signer

Actual PE Digest

5f:2f:59:0d:0d:1c:23:cf:21:19:28:a2:e3:a9:44:e8:84:7f:9e:34:50:74:2e:a5:c2:a6:c2:73:ce:fe:43:c1

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Pulse Secure\, LLC,O=Pulse Secure\, LLC,L=San Jose,ST=California,C=US

09/03/2023, 18:53
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 446KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ