ProtonVPN[.]exe

Resubmissions

06/06/2023, 01:41

230606-b4bkwabe58 1

06/06/2023, 00:59

230606-bb275abd38 1

Sharing

Copy URL Twitter E-mail

General

Target

ProtonVPN.exe
Size

334KB
MD5

23fb2331936c400e03d7b231a650978d
SHA1

a4dc59b9078cf37489a957978a9b931c2bcbce74
SHA256

57be07658672479874c0e2f1f8a9ab2680ea29e3de2d73b45cded325ab59138e
SHA512

8921023d3c4bcde314b8f51a78bffdf3d6f8e876a3202e25afd678763174273372c46087a46482eac16e0094783722798c37a3d93f2180ca442a9dda7584b538
SSDEEP

6144:gJMfgKykq1jR0Q31Rv5Q1nI2VoXQ+18gUgIzBo2mYi17BL1EbPXk1jn:bgKwn0jI2

Score

1^/10

Malware Config

Signatures

Files

ProtonVPN.exe
.exe windows x64

f21d96628d5e23f491d5d2674bfe0cc2

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:f4:b4:91:12:3a:c4:cd:bd:68:04:2d
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

29/10/2020, 09:57

Not After

30/10/2023, 09:57

Subject

SERIALNUMBER=CHE-354.686.492,CN=Proton Technologies AG,O=Proton Technologies AG,STREET=Route de la Galaise 32,L=Plan-les-Ouates,ST=Geneva,C=CH,1.2.840.113549.1.9.1=#0c0f61646d696e4070726f746f6e2e6d65,1.3.6.1.4.1.311.60.2.1.2=#130647656e657661,1.3.6.1.4.1.311.60.2.1.3=#13024348,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f5:87:30:2c:cf:cf:0d:5f:e9:95:c4:f3:ac:2c:e1:e7:1e:96:ca:18:a3:0b:34:5a:b6:26:78:19:bc:b0:1a:bc
Signer

Actual PE Digest

f5:87:30:2c:cf:cf:0d:5f:e9:95:c4:f3:ac:2c:e1:e7:1e:96:ca:18:a3:0b:34:5a:b6:26:78:19:bc:b0:1a:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

nethost

get_hostfxr_path

kernel32

GetSystemTimeAsFileTime
GetStartupInfoW
GetCommandLineW
GetModuleFileNameW
LoadLibraryW
SetCurrentDirectoryW
GetProcAddress
lstrcpyW
IsDebuggerPresent
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetModuleHandleW
GetCurrentThreadId

shell32

CommandLineToArgvW

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
__current_exception
memmove
__current_exception_context
__std_exception_destroy
__C_specific_handler
memset
memcpy
__std_exception_copy

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
_set_new_mode
calloc

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_initterm
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_seh_filter_exe
_get_narrow_winmain_command_line
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_c_exit
_cexit
_initterm_e
_exit
exit
_set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 306KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

f21d96628d5e23f491d5d2674bfe0cc2

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

23:f4:b4:91:12:3a:c4:cd:bd:68:04:2dCertificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

f5:87:30:2c:cf:cf:0d:5f:e9:95:c4:f3:ac:2c:e1:e7:1e:96:ca:18:a3:0b:34:5a:b6:26:78:19:bc:b0:1a:bcSigner

Headers

DLL Characteristics

File Characteristics

Imports

nethost

kernel32

shell32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 696B

.rsrc Size: 306KB - Virtual size: 306KB

.reloc Size: 512B - Virtual size: 88B

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

23:f4:b4:91:12:3a:c4:cd:bd:68:04:2d
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

f5:87:30:2c:cf:cf:0d:5f:e9:95:c4:f3:ac:2c:e1:e7:1e:96:ca:18:a3:0b:34:5a:b6:26:78:19:bc:b0:1a:bc
Signer

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 696B

.rsrc
Size: 306KB - Virtual size: 306KB

.reloc
Size: 512B - Virtual size: 88B