7ad6911c93d84efb6c1cd2f1d69c999770fedf71df17f1e02afcc2cacb1186de

Sharing

Copy URL Twitter E-mail

General

Target

7ad6911c93d84efb6c1cd2f1d69c999770fedf71df17f1e02afcc2cacb1186de
Size

2.4MB
MD5

bd84106b7ed36e2720289320b2dfd2d3
SHA1

a8433324abf02f3d21f48feac13953d5a480eefe
SHA256

7ad6911c93d84efb6c1cd2f1d69c999770fedf71df17f1e02afcc2cacb1186de
SHA512

6aa2d9c88ac616b35791b1955590ec67fdcd7b94546538b1ed4e6681cee35e1068bdf04878cd4bb02d0d864e59d62809cc394163da85cb805a5ba1243537abf7
SSDEEP

24576:3aN3C5Jey3zU/M4ewDsXERAdA25qgaf1PP:+6JB3zU/Mm4XERAG25q9F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ad6911c93d84efb6c1cd2f1d69c999770fedf71df17f1e02afcc2cacb1186de

Files

7ad6911c93d84efb6c1cd2f1d69c999770fedf71df17f1e02afcc2cacb1186de
.exe windows:6 windows x64 arch:x64

e80c3765092ea9679b759991394e738c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

sslvpnlib

?IsCredentialError@CSslvpnBase@@QEAAHXZ
??0CFortiTraySslvpn@@QEAA@XZ
?LaunchUpdateStatusThread@CFortiTraySslvpn@@QEAAXXZ
?DisplayLicenseErrorMessage@CFortiTraySslvpn@@QEAAXXZ
?Init@CFortiTrayHTMLDialog@@SAXPEB_W00HHKH@Z
?signalResult@CFortiTrayHTMLDialog@@SAXK@Z
?getCertificate@CFortiTrayHTMLDialog@@SAPEA_WXZ
?pendingUserResponse@CFortiTrayHTMLDialog@@SAHXZ
?pendingTunnelConnectionName@CFortiTrayHTMLDialog@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?m_bSaveCredentials@CFortiTrayHTMLDialog@@0HA
?setCertificate@CFortiTrayHTMLDialog@@SAXPEB_W@Z
?SetVPNCookie@CSslvpnBase@@QEAAXPEB_W@Z
?setPassword@CFortiTrayHTMLDialog@@SAXPEB_W@Z
?setToken@CFortiTrayHTMLDialog@@SAXPEB_W@Z
?setVPNCookie@CFortiTrayHTMLDialog@@SAXPEB_W@Z
?SortRedunantConnection@CSslvpnBase@@QEAAHPEB_W@Z
?GetSessionTimeout@CSslvpnBase@@QEAAKXZ
??1CSslvpnAgent@@UEAA@XZ
??1COptionOp@@QEAA@XZ
?UpdateConnectingStatus@CSslvpnBase@@UEAAXK@Z
?GetRSANewPin@CSslvpnBase@@UEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV23@0@Z
?GetNewPin@CSslvpnBase@@UEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV23@0HPEAH@Z
?GetProxyAuthenticationInformation@CSslvpnBase@@UEAAHAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0AEBV23@AEAHV23@@Z
?SetConnectionWithoutReauth@CSslvpnBase@@QEAAXH@Z
?IsConnectionWithoutReauth@CSslvpnBase@@QEAAHXZ
?SetLicenseFailedStatus@CSslvpnBase@@QEAAXXZ
?ForceDisconnect@CSslvpnBase@@QEAAXXZ
?DisconnectFortiSslvpn@CSslvpnBase@@QEAAHAEAH@Z
??1CSslvpnInfoXml@@UEAA@XZ
?GetTokenCode@CSslvpnBase@@UEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV23@0@Z
?ReloadApplicationLogLevel@CSslvpnBase@@SAXXZ
?SetDisconnectEvent@CSslvpnBase@@QEAAXXZ
?GetTraffic@CSslvpnBase@@QEAAXAEA_K0@Z
?BaseInit@CSslvpnBase@@QEAAXXZ
?AfterConnected@CSslvpnBase@@QEAAXXZ
?UpdateSslvpnStatus@CSslvpnBase@@QEAAHXZ
?UpdateFortiSslvpnStatus@CSslvpnBase@@QEAAHXZ
?setUsername@CFortiTrayHTMLDialog@@SAXPEB_W@Z
??1CFortiTraySslvpn@@UEAA@XZ
?IsShadowMode@CFortiTraySslvpn@@UEAAHAEAK@Z
?GetRSANewPin@CFortiTraySslvpn@@EEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV23@0@Z
?GetNewPin@CFortiTraySslvpn@@EEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV23@0HPEAH@Z
?GetTokenCode@CFortiTraySslvpn@@EEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEAV23@0@Z
?GetProxyAuthenticationInformation@CFortiTraySslvpn@@EEAAHAEAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0AEBV23@AEAHV23@@Z
?UpdateConnectingStatus@CFortiTraySslvpn@@EEAAXK@Z
?CancelGetTokenCode@CFortiTraySslvpn@@EEAAXXZ
?csTrace@@YAXPEA_WZZ
?Init@CFortiTrayHTMLDialog@@SAXPEB_WKHH0@Z
?showDialog@CFortiTrayHTMLDialog@@SAKKPEAXPEA_W@Z
?getUsername@CFortiTrayHTMLDialog@@SAPEA_WXZ
?getPassword@CFortiTrayHTMLDialog@@SAPEA_WXZ
?getToken@CFortiTrayHTMLDialog@@SAPEA_WXZ
?clearPassword@CFortiTrayHTMLDialog@@SAXXZ
?g_bLogEnable@@3HA
?m_bRememberPwd@CFortiTrayHTMLDialog@@0HA
?InitFortiSslvpn@CSslvpnBase@@QEAAHAEAH@Z
?OnConnect@CSslvpnBase@@QEAAHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0000HH@Z
?OnReconnectWithoutAuthentication@CSslvpnBase@@QEAAHXZ

utilsdll

MsgPipe_Close
MsgPipe_SendRecv_UE
log_debug_fmt
cfg_get_av_scan_list
cfg_get_av_info
get_tray_wnd
signal_scheduler
MultiSubmit_Init
MultiSubmit_Close
MultiSubmit_SendOne
SelectTSSessionByPid
os_is_windows_Vista
cfg_get_rs_settings
os_support_WSC
GetTextOutWidth
reg_get_user_overridable_DWORD
reg_get_user_overridable_string
reg_get_user_overridable_multistring
sch_get_entry
sch_find_running_task
IsComponentInstalled
IsComponentEnabled
ParseCN
IsSslvpnVnicInsteadOfRas
SvPipeGetIoctlTunnelStatusInfo
cfg_forticlientmanager_cmp_pwd
post_wndmsg_to_gui
log_initialize
sch_run_task
log_deinitialize
log_setlevel
log_duplicate_handle
log_deduplicate
reg_enable_virtualization
is64Bit
GenerateUIDW
cfg_get_install_dir
GetExeFileVersionInfo
TryImpersonateLoggedOnUser
reg_setstring_enc_cu
reg_getmultistring
reg_setDWORD
reg_createkey
bin2hex
decrypt_buffer
encrypt_buffer
ps_find_process
GetTokenOfSession
cfg_is_registered_to_fgt
hex2bin
ps_get_process_infoW
ps_get_process_list
reg_valueexists
reg_keyexists_x86
log_debug
reg_keyexists
IsComponentHidden
cfg_get_sandbox_settings
cfg_get_cloudscan_settings
cfg_get_update_last_update_time
cfg_get_update_settings
cfg_get_logging_info
cfg_is_update_running
fs_is_removable_media
reg_removevalue
reg_getstring_raw
reg_setstring
reg_valueexistsbykey
get_desired_status
GetFullAccessSecuAttr
CreateGlobalEvent
getopt_long
bBypassFShield
bIsFortimon2Exist
DontBlockLowPriMsg
service_stop
GetUserNameByPid
cfg_is_onnet
cfg_is_managed_by_ems
WebFilter_isEnabled
WebFilter_LoadProfileLoggingSettings
IsFireFoxInstalled
ImportFGTCAToMozillaStore
PostMessageGui
Log
optarg
MsgPipe_PostMessage
MsgPipe_SendRecv
vpn_get_tunnel_status
vpn_get_tunnel_info
cfg_get_update_status
cfg_is_software_update_enabled
cfg_get_software_update_version
cfg_get_software_uddate_ignore_version
cfg_set_software_update_ignore_version
cfg_get_software_update_notify_mode
cfg_is_small_installer_present
cfg_set_general_info
cfg_get_general_info
cfg_get_av_sig_version
cfg_get_av_engine_version
get_gui_wnd
cfg_get_config
cfg_get_forticlient_guid
cfg_get_forticlientmanager_info
cfg_set_forticlientmanager_info
send_wndmsg_to_gui
cfg_is_vpn_running
cfg_is_fmon_running
cfg_is_avtask_running
cfg_is_gui_running
cfg_is_vblt_running
cfg_is_light_installer_running
DBLog_MarkTypeOfAlertRead
sch_list_get_first
sch_list_get_next
sch_modify_entry
sch_load_list
sch_free_list
sch_stop_task
sch_stop_task_type
service_is_running
getCurrentUserInfo
loadUserInfo
cfg_is_onnet_when_offline
ps_kill_process_by_name
ps_kill_process_by_exact_path
ps_is_process_running
SortRedundantServer
GetRedundantServer
GetSSLVPNRedundantServer
EnumLoggedonTSSessions
ShowTrayIconNotification
WebFilter_LoadSettings_General
WebFilter_SaveSettings_General
WebFilter_Init
WebFilter_Close
sec_verify_pwd
sec_if_pwd_exist
os_is_windows_7
ConvertIconToBitmap
CheckGuiPipe
IsComponentLicensed
cfg_get_license_bitmap
WebFilter_IsEnabled
Fortigen_BypassProcess
GetAppFileInfoW
IsCriticalProcess
MsgPipe_LockPipe
MsgPipe_UnlockPipe
MsgPipe_PostMessage_UE
log_EMS_Alert
cfg_get_fmon_info
cfg_free_sandbox_settings
os_is_windows_2000
ps_get_process_id
DeleteFGTCAFromMozillaStore
ConvertPipeMsgToJSON
os_is_windows_XP
os_is_windows_2003
SetGlobalRebootRequestFlag
reg_setstring_enc
reg_walk2
cfg_does_software_update_require_admin_privileges
os_is_windows_10
MsgPipe_RecvMessage
GetAppFileInfo
ps_get_system_process_list
log_Traffic
MsgPipe_Open
fs_revert_Wow64FsRedirection
fs_disable_Wow64FsRedirection
reg_free
reg_getvaluenamebyindex
reg_getvaluecount
reg_getsubkeynamebyindex
reg_getsubkeycount
reg_getstring
reg_getDWORD
reg_closekey
reg_openkey
isWow64
log_Alert

comctl32

_TrackMouseEvent

crypt32

CertGetNameStringW
CertOpenSystemStoreW
CertEnumCertificatesInStore
CryptProtectData
CryptUnprotectData
CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumPhysicalStore
CertVerifyTimeValidity
CryptAcquireCertificatePrivateKey
CertNameToStrW

msi

ord205
ord173
ord111
ord113
ord45
ord70

psapi

GetModuleFileNameExW

rasapi32

RasEnumConnectionsW
RasGetProjectionInfoW
RasGetEntryPropertiesW

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

fortitrayresc

LoadFCString
LoadFCIcon

msvcp140

?_Getdays@_Locinfo@std@@QEBAPEBDXZ
?_Getmonths@_Locinfo@std@@QEBAPEBDXZ
?rdstate@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?uncaught_exception@std@@YA_NXZ
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Wcsxfrm
_Wcscoll
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Mbrtowc
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ

kernel32

InitializeCriticalSectionEx
DeleteCriticalSection
GetModuleHandleW
WideCharToMultiByte
HeapSize
CreateThread
ProcessIdToSessionId
GetProcAddress
WaitForMultipleObjects
LoadLibraryW
GetCommandLineW
InitializeCriticalSection
GetModuleFileNameW
CompareFileTime
FindNextFileW
Sleep
GetSystemTimeAsFileTime
GetDriveTypeW
GetTempFileNameW
SetLastError
CreateMutexW
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
FreeLibrary
GetModuleHandleExW
HeapFree
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
GetLocaleInfoW
GetTimeFormatW
GetTimeFormatA
GetDateFormatW
SystemTimeToFileTime
FileTimeToSystemTime
WriteFile
FindFirstFileW
FindClose
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalFree
OpenProcess
CloseHandle
ReadFile
GetLongPathNameW
CreateFileW
SetNamedPipeHandleState
GetOverlappedResult
WaitForSingleObject
GetProcessHeap
CreateActCtxW
HeapReAlloc
GetEnvironmentVariableW
GetVolumeInformationW
ReleaseMutex
OpenEventW
TerminateThread
GetTickCount
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GlobalDeleteAtom
GlobalAddAtomW
GlobalFindAtomW
GetWindowsDirectoryW
WinExec
lstrcpyW
lstrcatW
GetCurrentThreadId
GetLocalTime
DuplicateHandle
FlushFileBuffers
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
WaitForMultipleObjectsEx
VerSetConditionMask
VerifyVersionInfoW
IsBadReadPtr
IsBadWritePtr
GetCurrentThread
GetACP
SetThreadLocale
GetUserDefaultUILanguage
GetVersion
GetSystemDirectoryW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
OutputDebugStringA
OutputDebugStringW
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
OpenMutexW
CreateEventW
EnterCriticalSection
LeaveCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
lstrcpynW
SetConsoleCtrlHandler
lstrlenW
DeleteFileW
GetTempPathW
SetEvent
ResetEvent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
GetCurrentProcessId
FileTimeToLocalFileTime
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW

advapi32

RegOpenKeyExW
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
RegCloseKey
RegOpenCurrentUser
RegCreateKeyW
RegDeleteValueW
RegOpenKeyW
RegQueryValueExW
RegSetValueExW
SetNamedSecurityInfoW
RegCreateKeyExW
RegEnumKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyA
RegQueryValueExA
ChangeServiceConfigW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
RegQueryValueW
AllocateAndInitializeSid
CheckTokenMembership
DuplicateToken
EqualSid
FreeSid
GetTokenInformation
IsValidSid
GetUserNameW
RegDeleteKeyW
OpenThreadToken
AccessCheck
AdjustTokenPrivileges
ImpersonateSelf
MapGenericMask
LookupPrivilegeValueW
SetEntriesInAclW
GetNamedSecurityInfoW

ole32

StringFromGUID2
CoInitialize
CoCreateInstance
CoCreateGuid
CoTaskMemFree
CoUninitialize

shell32

SHGetKnownFolderPath
Shell_NotifyIconW
ord4
ord2
SHGetSpecialFolderLocation
SHGetPathFromIDListW

oleaut32

SetErrorInfo
GetErrorInfo
SysAllocStringByteLen
SysStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantCopy
VariantClear
VariantInit
SysAllocString
SysFreeString
CreateErrorInfo

gdi32

BitBlt
DeleteDC
CreateCompatibleDC
GetTextExtentPoint32W
GetStockObject
CreateFontIndirectW
CreatePolygonRgn
GetObjectW
SetRectRgn
FillRgn
CreateRectRgnIndirect
CreatePatternBrush
CreateSolidBrush
DeleteObject
GetDIBits
SelectObject
CombineRgn
CreateRectRgn

oleacc

GetRoleTextW
AccessibleObjectFromEvent

Exports

Exports

??0CFortiTraySslvpn@@QEAA@AEBV0@@Z
??0CSslvpnAgent@@QEAA@AEBV0@@Z
??0CSslvpnBase@@QEAA@AEBV0@@Z
??0CSslvpnInfoXml@@QEAA@AEBV0@@Z
??4CFortiTraySslvpn@@QEAAAEAV0@AEBV0@@Z
??4COptionOp@@QEAAAEAV0@AEBV0@@Z
??4CSslvpnAgent@@QEAAAEAV0@AEBV0@@Z
??4CSslvpnBase@@QEAAAEAV0@AEBV0@@Z
??4CSslvpnInfoXml@@QEAAAEAV0@AEBV0@@Z
??_7CFortiTraySslvpn@@6B@
??_7CSslvpnAgent@@6B@
??_7CSslvpnBase@@6B@
??_7CSslvpnInfoXml@@6B@
?CancelGetTokenCode@CSslvpnBase@@UEAAXXZ
?GetHostCheckInterval@CSslvpnBase@@QEAAHXZ
?GetSessionTimeout@CSslvpnInfoXml@@QEAAKXZ
?IsEnabled@CSslvpnInfoXml@@QEBA_NXZ
?IsProxyAuthDlgCancelClicked@CFortiTraySslvpn@@UEAAHXZ
?IsProxyAuthDlgCancelClicked@CSslvpnBase@@UEAAHXZ
?IsShadowMode@CSslvpnBase@@UEAAHAEAK@Z
?IsTunnelConnectWithoutReauthentication@CSslvpnInfoXml@@QEBA_NXZ
?SetHWND@CSslvpnBase@@QEAAXPEAUHWND__@@@Z
?SetProxyAuthDlgCancelClicked@CFortiTraySslvpn@@UEAAXH@Z
?SetProxyAuthDlgCancelClicked@CSslvpnBase@@UEAAXH@Z
?SetTunnelConnectWithoutReauthentication@CSslvpnInfoXml@@QEAAXH@Z
OPENSSL_Applink

Sections

.text
Size: 743KB - Virtual size: 742KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 375KB - Virtual size: 374KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e80c3765092ea9679b759991394e738c

Headers

DLL Characteristics

File Characteristics

Imports

sslvpnlib

utilsdll

comctl32

crypt32

msi

psapi

rasapi32

iphlpapi

fortitrayresc

msvcp140

kernel32

advapi32

ole32

shell32

oleaut32

gdi32

oleacc

Exports

Exports

Sections

.text Size: 743KB - Virtual size: 742KB

.rdata Size: 375KB - Virtual size: 374KB

.data Size: 15KB - Virtual size: 36KB

.pdata Size: 38KB - Virtual size: 37KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 1.3MB - Virtual size: 1.3MB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 743KB - Virtual size: 742KB

.rdata
Size: 375KB - Virtual size: 374KB

.data
Size: 15KB - Virtual size: 36KB

.pdata
Size: 38KB - Virtual size: 37KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 12KB - Virtual size: 11KB