Windscribe[.]Free[.]VPN[.]2[.]3[.]16[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Windscribe.Free.VPN.2.3.16.exe
Size

18.6MB
MD5

ee9196f98a323c8e3463268d2695499d
SHA1

d1036831bbd82d09cd8df7030a1a163ead280360
SHA256

c5ba93177d2ee27e6cafb5609c215d6d78a599a5aa9d1d35a57385ce8100efd9
SHA512

9de67938e8b6d7a14761d6386c4033fc2932246130eaec30afa270565089ea52ccc9fd0154c4b71e95e0ccbf8f8110af556e4dc970bd142e4d79007b73a77df8
SSDEEP

393216:Wj4PlHMx+nqQMM+z6x+mWdUhqaGb7mMYvxbxJCh39z5sm0:Wj4Nk+qQ6asaeS9pWfsm0

Score

1^/10

Malware Config

Signatures

Files

Windscribe.Free.VPN.2.3.16.exe
.exe windows x86

3f72e056c4b1a72c9de52181c37c9356

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:5e:e4:3b:ee:a5:0e:d5:f0:ec:76:5b:f6:5b:13:50
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/02/2021, 00:00

Not After

05/03/2024, 23:59

Subject

CN=Windscribe Limited,O=Windscribe Limited,L=Richmond Hill,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4b:8a:57:0e:ba:9d:79:4c:af:53:6a:d7:31:8b:24:3e:d3:c2:ef:3d
Signer

Actual PE Digest

4b:8a:57:0e:ba:9d:79:4c:af:53:6a:d7:31:8b:24:3e:d3:c2:ef:3d

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Windscribe Limited,O=Windscribe Limited,L=Richmond Hill,ST=Ontario,C=CA

05/01/2022, 17:59
Valid: true

Chain 1

CN=Windscribe Limited,O=Windscribe Limited,L=Richmond Hill,ST=Ontario,C=CA

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenW
lstrcmpiW
lstrcmpW
GetFileAttributesW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
WaitForSingleObject
OpenProcess
FindFirstFileW
FindNextFileW
FindClose
GetLocalTime
SetConsoleCtrlHandler
GetCommandLineW
GetSystemDirectoryW
OutputDebugStringW
CopyFileW
GetFullPathNameW
CreateProcessW
GetExitCodeProcess
CreateDirectoryW
SetLastError
WriteConsoleW
SetEndOfFile
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetSystemWow64DirectoryW
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
FlushFileBuffers
HeapReAlloc
GetFileSizeEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetStdHandle
ExitProcess
GetModuleHandleExW
ExitThread
ReadFile
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameW
GetTickCount
Sleep
MoveFileExW
CloseHandle
DeleteFileW
CreateFileW
GetTempPathW
WriteFile
FreeLibrary
LoadLibraryW
GetProcAddress
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetLastError
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
FreeResource
SizeofResource
GetOEMCP
AreFileApisANSI
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
GetModuleHandleW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetStringTypeW
MultiByteToWideChar
GetExitCodeThread
GetCurrentThread
SwitchToThread
GetCurrentProcess
WaitForSingleObjectEx
DuplicateHandle
GetCurrentThreadId
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection

user32

GetWindowInfo
ShowWindow
GetSystemMetrics
SetWindowRgn
MonitorFromWindow
MessageBoxW
EqualRect
SetCursor
KillTimer
LoadIconW
SendMessageW
ClientToScreen
GetWindowRect
SetCapture
SetWindowPos
DestroyWindow
GetWindowLongW
GetWindowTextW
RedrawWindow
SetWindowTextW
RegisterWindowMessageW
FindWindowW
GetMonitorInfoW
DefWindowProcW
AdjustWindowRect
ScreenToClient
SetWindowLongW
IsZoomed
PostQuitMessage
UpdateWindow
ReleaseCapture
InvalidateRect
PtInRect
SetTimer
GetClientRect
ReleaseDC
BeginPaint
EndPaint
GetMessageW
PostMessageW
LoadCursorW
DispatchMessageW
TranslateMessage
GetDC
RegisterClassExW
TrackMouseEvent
CreateWindowExW

gdi32

SetTextColor
SetBkMode
CreateRectRgnIndirect
AddFontMemResourceEx
DeleteObject
CreateFontIndirectW
CreateCompatibleDC
GetDeviceCaps
DeleteDC
GetStockObject

advapi32

CloseServiceHandle
OpenSCManagerW
ControlService
OpenServiceW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW

shell32

SHGetKnownFolderPath
CommandLineToArgvW
SHChangeNotify
SHCreateDirectoryExW
SHGetPathFromIDListW
SHBrowseForFolderW
SHAppBarMessage
ShellExecuteW
SHGetMalloc
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitialize
CreateStreamOnHGlobal
CoInitializeEx

oleaut32

VariantInit
SysAllocString
VariantClear
SysFreeString

gdiplus

GdipAlloc
GdipCloneImage
GdipSetImageAttributesColorMatrix
GdipGetImageHeight
GdipDeleteStringFormat
GdipDrawImage
GdipCloneBrush
GdipDrawString
GdiplusShutdown
GdipCreateFromHDC
GdipFillRectangle
GdipDisposeImage
GdipFillPath
GdipCreateSolidFill
GdipSetStringFormatLineAlign
GdipCreatePath
GdipDeletePath
GdipDeleteBrush
GdipAddPathArcI
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipGetImageWidth
GdipCreateBitmapFromScan0
GdipDrawImageI
GdipDisposeImageAttributes
GdipSetSmoothingMode
GdipAddPathLineI
GdipFree
GdipClosePathFigure
GdiplusStartup
GdipMeasureString
GdipDrawImageRectI
GdipLoadImageFromStream
GdipFillRectangleI
GdipDrawArcI
GdipDeletePen
GdipCreatePen1
GdipDeleteFontFamily
GdipCreateFont
GdipGetFontCollectionFamilyList
GdipDeleteFont
GdipNewPrivateFontCollection
GdipCloneFontFamily
GdipDeletePrivateFontCollection
GdipPrivateAddMemoryFont
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipDrawImageRectRectI
GdipCreateImageAttributes

shlwapi

PathAppendW
PathIsSystemFolderW

uxtheme

IsThemeActive

dwmapi

DwmSetWindowAttribute
DwmExtendFrameIntoClientArea
DwmIsCompositionEnabled

wininet

InternetOpenUrlW
InternetOpenW
InternetCloseHandle
InternetReadFile
HttpQueryInfoA

setupapi

InstallHinfSectionW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiSetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

Sections

.text
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18.0MB - Virtual size: 18.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f72e056c4b1a72c9de52181c37c9356

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0f:5e:e4:3b:ee:a5:0e:d5:f0:ec:76:5b:f6:5b:13:50Certificate

Extended Key Usages

Key Usages

4b:8a:57:0e:ba:9d:79:4c:af:53:6a:d7:31:8b:24:3e:d3:c2:ef:3dSigner

Signature Validations

Verification

05/01/2022, 17:59 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

uxtheme

dwmapi

wininet

setupapi

Sections

.text Size: 516KB - Virtual size: 516KB

.rdata Size: 136KB - Virtual size: 136KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 18.0MB - Virtual size: 18.0MB

.reloc Size: 26KB - Virtual size: 26KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0f:5e:e4:3b:ee:a5:0e:d5:f0:ec:76:5b:f6:5b:13:50
Certificate

4b:8a:57:0e:ba:9d:79:4c:af:53:6a:d7:31:8b:24:3e:d3:c2:ef:3d
Signer

05/01/2022, 17:59
Valid: true

.text
Size: 516KB - Virtual size: 516KB

.rdata
Size: 136KB - Virtual size: 136KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 18.0MB - Virtual size: 18.0MB

.reloc
Size: 26KB - Virtual size: 26KB