79d775433be505a57ae175f5e6f427af_JaffaCakes118

resource
79d775433be505a57ae175f5e6f427af_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/devcon.exe
unpack001/$PROGRAMFILES/Ferr/SEDA/TAP-Windows/driver/tap0901.sys
unpack001/Setup.exe
unpack001/Setupres.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 b7683441e42f706642877d1a92c5307d223b1e6195d463f1ad9332e7e6ac5a91
MD5 79d775433be505a57ae175f5e6f427af
SHA1 32b9ac8255c3076841e658eabe581586ecdd8c8b
SHA512 2c74529531c163ba9f768bf9aae97464aa5ddf2935c4085eb80d372a4e15d853bdfa46fc616b7b9b2e30730f4a484dfe3ba8b64188a3921faca589ffd379e7f7
SSDEEP 98304:GAUlwbKKobLmzt3iOah1NBR595arTOLQZsxpzYazTd9e:GjCzViOSNL590r6Lys/zYuO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

900KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/UserInfo.dll

IMPHASH 45d25ca52c312b2254c60dbcb30342d1
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/addtap.bat

SHA256 effe5c5c2cf6547a54f987fef6f052a234770b4fcfae277cf6089daa896bcd5f
MD5 ebb2c28da7de8436995509782ac63c4c
SHA1 7d693538baa80ce6938f0400bdc16f9b035baee9
SHA512 021098b1d9f4b987b85be073bc1a6a7ee3336c88d54770d64fc77b74ca74ec459f89fbd65a6fba3efa4f6da7cc852784e9ea391189831f565d64e65a437fc7f5
MD5 SHA1 SHA512

$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/deltapall.bat

SHA256 1be66390df9e302b38553432731a244e65f745d31e6424c88091326fb3ea92d7
MD5 70850be8dc81d8f8c36da0e754df0a46
SHA1 fe7766e67239e26f6cee866cb9a93341e33f0e4d
SHA512 f15a3ce91ceb663a0369054e06647471591ba54ed40e0f6dd549069a0c4e30aefd590c9a18a90d80d35af4fcd45e49d89a259606cf7ee23fa976c61f88a0066b
MD5 SHA1 SHA512

$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/devcon.exe

IMPHASH ce4a5cfcfb0452b87e013f07f4d59f9c
SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
MD5 3904d0698962e09da946046020cbcb17
SHA1 edae098e7e8452ca6c125cf6362dda3f4d78f0ae
SHA512 c24ab680981d8d6db042b52b7b5c5e92078df83650cad798874fc09ce8c8a25462e1b69340083f4bcad20d67068668abcfa8097e549cfa5ad4f1ee6a235d6eea
SSDEEP 1536:MP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7W:MePOYe4bu1epDh8RW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

29456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

devcon.pdb

advapi32

OpenProcessToken RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges InitiateSystemShutdownExW RegCloseKey CloseServiceHandle OpenSCManagerW OpenServiceW RegDeleteValueW RegSetValueExW

kernel32

GetCurrentProcess FormatMessageW lstrlenW GetLastError CloseHandle LocalFree GetDateFormatW FreeLibrary LoadLibraryW FileTimeToSystemTime GetProcAddress GetFullPathNameW FindFirstFileW GetFileAttributesW FindClose FindNextFileW GetWindowsDirectoryW Sleep TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetModuleHandleW SetUnhandledExceptionFilter UnhandledExceptionFilter

msvcrt

wcschr _wcsicmp towlower _wcsnicmp fputs __iob_func wcsrchr fputws ?terminate@@YAXXZ memset __set_app_type _fmode _commode __setusermatherr _amsg_exit _initterm exit _cexit _exit _XcptFilter __C_specific_handler __wgetmainargs wprintf ??2@YAPEAX_K@Z towupper ??3@YAXPEAX@Z iswalpha

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

ole32

CLSIDFromString

setupapi

SetupScanFileQueueW SetupDiGetClassDevsExW SetupDiGetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiClassNameFromGuidExW CM_Reenumerate_DevNode_Ex SetupCopyOEMInfW SetupDiSetDeviceRegistryPropertyW SetupDiGetINFClassW CM_Disconnect_Machine SetupDiBuildClassInfoListExW SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList CM_Connect_MachineW CM_Locate_DevNode_ExW CM_Get_DevNode_Status_Ex SetupDiBuildDriverInfoList SetupDiGetDeviceInstallParamsW SetupDiOpenDevRegKey SetupDiSetSelectedDriverW SetupGetStringFieldW CM_Get_Res_Des_Data_Size_Ex SetupDiEnumDriverInfoW CM_Free_Log_Conf_Handle CM_Get_Device_ID_ExW CM_Get_Next_Res_Des_Ex SetupCloseFileQueue SetupDiGetDriverInstallParamsW CM_Get_Res_Des_Data_Ex SetupDiOpenClassRegKeyExW SetupCloseInfFile SetupOpenFileQueue SetupDiCallClassInstaller SetupDiDestroyDriverInfoList SetupOpenInfFileW CM_Free_Res_Des_Handle CM_Get_First_Log_Conf_Ex SetupDiSetDeviceInstallParamsW SetupFindFirstLineW SetupDiGetDriverInfoDetailW SetupDiGetClassDescriptionExW SetupDiClassGuidsFromNameExW SetupDiOpenDeviceInfoW SetupDiGetDeviceInfoListDetailW SetupDiCreateDeviceInfoListExW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

user32

CharNextW CharPrevW LoadStringW

$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/tapinstall.exe

IMPHASH a7780e6241d40a319bbde667eb84065f
SHA256 5c6aae8c345e5eda7185cabafcf9270ef3d73f198290842654d8916f8321b150
MD5 bc2eb9be84d65e600bb4baebfc0d6c74
SHA1 dffa04b9399b8742e1536c5942b43df58a42980a
SHA512 ae382b3aac40e17f5daa4d952d85656d29791f857a97de91197c85049e31cef924723875c6616f598696445bea967788c89cfdb7cd35ed772bce3d6a1fd71e7b
SSDEEP 768:AeFpBuMKzLkfKI4hHZv4zS5bhkt4JlX82BSOe9oKSJ2SLD0BEZWk3zoMrrKgp:TBuMN4VFESvkt4nXF4O7WcBvT
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

0c:ce:75:e4:1e:f1:f4:e0:9a:ad:b4:44:41:33:59:14:90:c0:fc:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Chains

Apr 21, 2016

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:1c:b2:8a:00:00:00:00:00:26

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Serial Number

04:d5:4d:c0:a2:01:6b:26:3e:ee:b2:55:d3:21:05:6e

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 13, 2013 - Sep 2, 2016

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

1

Major OS version

6

Entry point

26371

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\users\samuli\opt\tap-windows6-mattock\tapinstall\7600\objfre_wlh_x86\i386\tapinstall.pdb

advapi32

InitiateSystemShutdownExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegQueryValueExW RegCloseKey RegDeleteValueW RegSetValueExW CloseServiceHandle OpenServiceW OpenSCManagerW

kernel32

WaitForSingleObject SetThreadPriority GetCurrentThread CreateThread CreateEventW FreeLibrary lstrlenW LockResource LoadResource FindResourceW LoadLibraryW lstrcpyW SetEvent CloseHandle LocalFree FormatMessageW GetCurrentProcess GetLastError GetDateFormatW FileTimeToSystemTime GetProcAddress GetFileAttributesW GetFullPathNameW FindClose FindNextFileW FindFirstFileW GetWindowsDirectoryW UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetModuleHandleA SetUnhandledExceptionFilter InterlockedCompareExchange Sleep InterlockedExchange

msvcrt

fputws fputs __iob_func ??3@YAXPAX@Z printf memset _controlfp ?terminate@@YAXXZ __set_app_type __p__fmode __p__commode __setusermatherr _amsg_exit _initterm exit _XcptFilter _exit _cexit __wgetmainargs wprintf wcsrchr _wcsicmp _wcsnicmp iswalpha towupper towlower wcschr ??2@YAPAXI@Z

ntdll

RtlUnwind

ole32

CLSIDFromString

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo CM_Get_Device_ID_ExW SetupDiGetDeviceInfoListDetailW SetupDiOpenDeviceInfoW SetupDiGetClassDevsExW SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiBuildClassInfoListExW SetupDiClassNameFromGuidExW SetupCopyOEMInfW SetupDiSetDeviceRegistryPropertyW CM_Connect_MachineW CM_Locate_DevNode_ExW CM_Reenumerate_DevNode_Ex CM_Disconnect_Machine SetupDiSetClassInstallParamsW SetupOpenInfFileW SetupFindFirstLineW SetupGetStringFieldW SetupDiGetClassDescriptionExW SetupCloseInfFile SetupDiOpenClassRegKeyExW SetupDiGetDriverInstallParamsW SetupDiSetSelectedDriverW SetupOpenFileQueue SetupDiCallClassInstaller SetupScanFileQueueW SetupCloseFileQueue SetupDiGetDeviceInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiBuildDriverInfoList SetupDiEnumDriverInfoW SetupDiOpenDevRegKey SetupDiGetDriverInfoDetailW SetupDiDestroyDriverInfoList CM_Get_First_Log_Conf_Ex CM_Free_Log_Conf_Handle CM_Get_Next_Res_Des_Ex CM_Free_Res_Des_Handle CM_Get_Res_Des_Data_Size_Ex CM_Get_Res_Des_Data_Ex CM_Get_DevNode_Status_Ex SetupDiClassGuidsFromNameExW SetupDiCreateDeviceInfoListExW SetupDiGetDeviceRegistryPropertyW

user32

CharPrevW CharNextW LoadStringW FindWindowW SendMessageW

$PROGRAMFILES/Ferr/SEDA/TAP-Windows/driver/OemVista.inf

SHA256 a461b764e248d3e59a1a730ff94af7e61121f5a02004e02b3b866ac8fd1689be
MD5 41884571579f88540326252b81d0a9f8
SHA1 cfd0ba5db827d21e4fa71663c045b5676d303d6e
SHA512 3eeeffc02998c73a11d4a0988fe3823b52ce560f8cb40c76ab810d5ea78dd42811cf30ae35bf11d55f17b3804154ddb483acff2f11261bfc382b5e18eb42688b
SSDEEP 192:wr8tW9yCTi3l4vlZ2bjR+iAUC7bdYiio3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGEWXo3DcNSj6jvKFkinuEQTXvzaZ
MD5 SHA1 SHA512 SSDEEP

$PROGRAMFILES/Ferr/SEDA/TAP-Windows/driver/OemWin2k.inf

SHA256 a6e72b88e42d2b478615c5a16bbedb3fd02b0dd3def3a79840fc6a5df8312707
MD5 b6aada0cbed06889053a05b66f146979
SHA1 823025f02b355b37df7d7657b0f2b4d3584891a5
SHA512 9f8a6b0ad5ae4ea4c14043d663fd5aca2f1884ece0975b13c0533eb93103eb89120c1884121d71c8f9d09f5d210926fdba3b29fc6cf87f601bbc0f359c31d4ad
SSDEEP 192:nr8tW9yCTi394vlQdqKbjR+iAUC7bd9io3DcNSj6jvKFkinuEQTXvzLd4Z:aWlGZdUWo3DcNSj6jvKFkinuEQTXvzaZ
MD5 SHA1 SHA512 SSDEEP

$PROGRAMFILES/Ferr/SEDA/TAP-Windows/driver/tap0901.cat

SHA256 878c1b205887b61906f6f4f8da5783d2bb8756d0a39359288d09f65f983b27c2
MD5 ad8a5cbec4f83ae4f850c793713ee770
SHA1 bee00a5037d4f1232837d27bca21658efcff1750
SHA512 5e88ce1ba2c1dc17e04d26d9afaa97987e61d1c57c97bb1e8a07561b33f763052d0e4bddd184e11ac19e514c7041f9750a6dc576f27161a136765fd1240e5327
SSDEEP 384:HP01ych1MrYATK6jjZ2ZE6qeZsHLwuaB+XFhMb:8fMrrKgdqq7Zz1hi
MD5 SHA1 SHA512 SSDEEP

$PROGRAMFILES/Ferr/SEDA/TAP-Windows/driver/tap0901.sys

IMPHASH e8e98f9c6dd2ed86b62e0eee9ae50433
SHA256 3b1ff5252012d6e8a7dd6e4621ec43812510dca1a25a9a2e07288800f445dd41
MD5 f49967c396969b71c3a72537db03a68b
SHA1 f59d3a5d2afd85fbb9fb36f1411c767be2bf96cf
SHA512 cda4269b5a13e573469b3e3a75432117079c65279e06322519af704a80862e43bceb4cc9d6352dd19db00bb10d10f64b02eee6c5dc29f56fa5f99c89823a62e3
SSDEEP 384:NumNz7O8/AvUAvm/wMWJ4pdsfH1aJhjJvjiissrisprwEYBu:QmNxAYB9zKal75pwZBu
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

33082

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\users\samuli\opt\tap-windows6-mattock\src\i386\tap0901.pdb

Name

.text

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

764B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

INIT

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

674B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PROGRAMFILES/Ferr/SEDA/countries.tsv

SHA256 688b375a46f632ae69c644f527347c74f8a1cd1a38ef91fc21ebdc6197e5c654
MD5 275c4a24b43df6fe79a39faa0aca2e37
SHA1 5a4f20b9f3d13552460859f39f9048742a87afdf
SHA512 206a336a58c2d2d32d58a4344ed8816df922d266b19d123bc45d2029ca06c3b86f2ada59b87b471280a291a43c1411c0cb311831b4277c415889aae9415fc9d3
SSDEEP 192:Z3FyuXs0p8vSzVLdjNP9TNPeLokkxriw2/fvp6S2A20MR:Z8uc0SazNVTxeL8Niw2/XcS2A2ZR
MD5 SHA1 SHA512 SSDEEP

$PROGRAMFILES/Ferr/SEDA/vpnpro.PTB.lng

SHA256 2611fe17661ee661d4008c7baed248b46a4d7e04dbb664bf07e71aefa63868f9
MD5 de2d9aeda9ce3e970696654720c25f92
SHA1 ef63a998efc4ef0ff203055894fb0386549be6e6
SHA512 3e7de463ddee45fd2d2fe2604df6ad603262a7878e052cbf8c5296978ba0ae0ae860b0e67e45b60ce7bd57685f01adcf2b8660c653b812e3111e9dbb6e451ad6
SSDEEP 96:RWMA5HJNaWUgbvZe3Micg/XfD5mDQiuWGZwvt76Af9kMOjBfnN/E0VeCt4:RA3aQcMy5gQiVGZwvtEMOFfnNZUCG
MD5 SHA1 SHA512 SSDEEP

$PROGRAMFILES/Ferr/SEDA/vpnpro.RUS.lng

SHA256 0aecd23e6525d9767d7416d093108639967c589ea913b6ba882466dac4208f84
MD5 de76b2fef55bdc5015271f17978ce4f0
SHA1 9aa340d6b79d914ab2c72ed0835555b0baa67005
SHA512 6e0791f5c6507a39670bdc578118f863d6e2dc74991fb49d3dbbbcb2dadefb68c501a0e4ca24e965228c6c0cddb0e3d28739d9b72a307f652186935d75d35642
SSDEEP 96:9+PgGTE6ewCFSnPXm5yrHgY5imBzaC9yJ8bgx5cl/q6x7k0VwqPJnTC3J:/+HpCFSu8rHgYEczaCcJaaclC69Dw4TY
MD5 SHA1 SHA512 SSDEEP

Setup.exe

IMPHASH baa93d47220682c04d92f7797d9224ce
SHA256 883ecab1d18c6e8153b56541df2df4980a27f5faa93ba2b42ff1dd14a8f4c161
MD5 b5861c96767caed4fce1473ac338d1bf
SHA1 c9575e657706a01a28aa63943f39018377a5dfe1
SHA512 388bb192a27442c80f0ece67ef5e43ec6e148e24aa4634a524d3e7ec3cbd78b11bd4a200d76610168efd52711af8e3d6b2773088f09630843d9cfd6a02ab2240
SSDEEP 49152:IYgNe1kDmRGkWDDWaBZmnr+KHhhg9EKDYhKk:IHahRGh7ZmxHhNKDYhKk
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5562368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

377KB

Virtual Size

676KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

wsiocppd

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

yufrdxlh

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Setupres.exe

IMPHASH baa93d47220682c04d92f7797d9224ce
SHA256 34d2e90229c1c3c41b931bb65ea015f023744543d915dcfeffe2328e32c27e8e
MD5 c9638374b6732d9756d9a6ae50061747
SHA1 7952f8225a6cf692ce226bfaf8112260e4ac2b71
SHA512 428d4977300ba3f95905f655a93aaad89145e8c09a96491ad8142be18a6802294e735f9b3fe04845c5c80a3997275203d3a5861fc7e4cc185fb8eae19b2a0ffa
SSDEEP 49152:aVoRLzxlaVuzaroTCjia+Hii9UNbqL2JTVWAcuoli:aWR/aczaroeE9785WZzg
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5423104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

Size

368KB

Virtual Size

820KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ehrisjll

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

zkereifi

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

ipras.vbs

SHA256 a1b0cb16fb2ecd66fccf156024404801ad694056e8a596326c1b27b57d8eabe8
MD5 b802ff9244875f69db2fae0f78e92b10
SHA1 49385a89cd575894a29fbda969b99cc1f5cf8076
SHA512 609856415a7ae2b3e260f945f1c8a8d2a28884c202d37181bea948708918f24b42ae03f17dba1520fddc91b2f7a182b0b8f885f33ea6f81bb3ee4c72e4e9350e
MD5 SHA1 SHA512

ssleay32.dll

IMPHASH 9a578a896c8620e7ce2aaaca37343103
SHA256 24235653e41540567bca708e0d5ef02034f88940eeedcd480167a00dd1250656
MD5 50a26f0247c1321fd19c0981337fbde8
SHA1 9cdd51843bd7694da571e0a6cd7350aa494f9ac3
SHA512 440cf92524e21e9dc1d92f45a8fbd566f0eeec597e0f52a235847879bdd4806ac219b592aaec9976620082b2d8d5690d432e1a45b0df035b18404453530855d9
SSDEEP 6144:AlvshwnbLc7xRpLIOmvsD4gZAEMM06I5sF51L103WiV8JV+OPG/JVNr5qNRyZtrA:Al0LuEMM06IGF5UmiqJpPOp/cVmXEfcc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

68:d6:ea:91:bf:23:f4:94:af:9d:e6:a7:5c:04:1d:15:c1:2b:a0:df:33:16:dc:8d:21:37:77:7a:02:72:9b:67

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Chains

May 10, 2016

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US

Serial Number

06:05:82:3f:3e:8f:0a:d9:c0:12:64:6c:9e:83:4f:38

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Sep 2, 2016

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Minor OS version

0

Major OS version

4

Entry point

5152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

libeay32

ASN1_INTEGER_get ASN1_INTEGER_set ASN1_const_check_infinite_end ASN1_get_object ASN1_object_size ASN1_put_object BIO_callback_ctrl BIO_clear_flags BIO_copy_next_retry BIO_ctrl BIO_dump_indent BIO_f_buffer BIO_find_type BIO_free BIO_free_all BIO_get_retry_reason BIO_int_ctrl BIO_method_type BIO_new BIO_pop BIO_printf BIO_push BIO_puts BIO_read BIO_s_connect BIO_s_file BIO_s_mem BIO_s_socket BIO_set_flags BIO_snprintf BIO_test_flags BIO_write BN_CTX_free BN_CTX_new BN_bin2bn BN_bn2bin BN_clear_free BN_copy BN_dup BN_free BN_num_bits BN_ucmp BUF_MEM_free BUF_MEM_grow BUF_MEM_grow_clean BUF_MEM_new BUF_memdup BUF_strdup BUF_strndup COMP_CTX_free COMP_CTX_new COMP_compress_block COMP_expand_block COMP_zlib CRYPTO_add_lock CRYPTO_dup_ex_data CRYPTO_free CRYPTO_free_ex_data CRYPTO_get_ex_data CRYPTO_get_ex_new_index CRYPTO_lock CRYPTO_malloc CRYPTO_mem_ctrl CRYPTO_memcmp CRYPTO_new_ex_data CRYPTO_set_ex_data DH_compute_key DH_free DH_generate_key DH_new DH_size DHparams_dup DSA_sign DSA_verify ECDH_compute_key ECDSA_sign ECDSA_verify EC_GROUP_free EC_GROUP_get_curve_name EC_GROUP_get_degree EC_GROUP_new_by_curve_name EC_KEY_dup EC_KEY_free EC_KEY_generate_key EC_KEY_get0_group EC_KEY_get0_private_key EC_KEY_get0_public_key EC_KEY_new EC_KEY_set_group EC_KEY_set_private_key EC_KEY_set_public_key EC_KEY_up_ref EC_METHOD_get_field_type EC_POINT_copy EC_POINT_free EC_POINT_new EC_POINT_oct2point EC_POINT_point2oct ENGINE_finish ENGINE_get_ssl_client_cert_function ENGINE_init ENGINE_load_ssl_client_cert ERR_add_error_data ERR_clear_error ERR_func_error_string ERR_load_crypto_strings ERR_load_strings ERR_peek_error ERR_peek_last_error ERR_put_error EVP_CIPHER_CTX_cipher EVP_CIPHER_CTX_cleanup EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_flags EVP_CIPHER_CTX_free EVP_CIPHER_CTX_init EVP_CIPHER_CTX_iv_length EVP_CIPHER_CTX_new EVP_CIPHER_block_size EVP_CIPHER_flags EVP_CIPHER_iv_length EVP_CIPHER_key_length EVP_Cipher EVP_CipherInit_ex EVP_DecryptFinal EVP_DecryptInit_ex EVP_DecryptUpdate EVP_Digest EVP_DigestFinal EVP_DigestFinal_ex EVP_DigestInit EVP_DigestInit_ex EVP_DigestSignFinal EVP_DigestSignInit EVP_DigestUpdate EVP_EncryptFinal EVP_EncryptInit_ex EVP_EncryptUpdate EVP_MD_CTX_cleanup EVP_MD_CTX_copy EVP_MD_CTX_copy_ex EVP_MD_CTX_create EVP_MD_CTX_destroy EVP_MD_CTX_init EVP_MD_CTX_md EVP_MD_CTX_set_flags EVP_MD_size EVP_MD_type EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_free EVP_PKEY_CTX_new EVP_PKEY_asn1_find_str EVP_PKEY_asn1_get0_info EVP_PKEY_assign EVP_PKEY_bits EVP_PKEY_copy_parameters EVP_PKEY_decrypt EVP_PKEY_decrypt_init EVP_PKEY_derive_set_peer EVP_PKEY_encrypt EVP_PKEY_encrypt_init EVP_PKEY_free EVP_PKEY_missing_parameters EVP_PKEY_new EVP_PKEY_new_mac_key EVP_PKEY_sign EVP_PKEY_sign_init EVP_PKEY_size EVP_PKEY_verify EVP_PKEY_verify_init EVP_SignFinal EVP_VerifyFinal EVP_add_cipher EVP_add_digest EVP_aes_128_cbc EVP_aes_128_cbc_hmac_sha1 EVP_aes_128_gcm EVP_aes_192_cbc EVP_aes_256_cbc EVP_aes_256_cbc_hmac_sha1 EVP_aes_256_gcm EVP_camellia_128_cbc EVP_camellia_256_cbc EVP_des_cbc EVP_des_ede3_cbc EVP_dss1 EVP_ecdsa EVP_enc_null EVP_get_cipherbyname EVP_get_digestbyname EVP_idea_cbc EVP_md5 EVP_rc2_40_cbc EVP_rc2_cbc EVP_rc4 EVP_seed_cbc EVP_sha1 EVP_sha224 EVP_sha256 EVP_sha384 EVP_sha512 HMAC_CTX_cleanup HMAC_CTX_init HMAC_Final HMAC_Init_ex HMAC_Update MD5_Init MD5_Transform OBJ_NAME_add OBJ_bsearch_ OBJ_find_sigid_algs OBJ_nid2sn OBJ_obj2nid OCSP_RESPID_free OPENSSL_DIR_end OPENSSL_DIR_read OPENSSL_cleanse OpenSSLDie PEM_ASN1_read PEM_ASN1_read_bio PEM_ASN1_write PEM_ASN1_write_bio PEM_read_bio_PrivateKey PEM_read_bio_RSAPrivateKey PEM_read_bio_X509 PEM_read_bio_X509_AUX RAND_add RAND_bytes RAND_pseudo_bytes RSAPrivateKey_dup RSA_flags RSA_free RSA_new RSA_private_decrypt RSA_public_encrypt RSA_sign RSA_size RSA_up_ref RSA_verify SHA1_Init SHA1_Transform SHA224_Init SHA256_Init SHA256_Transform SHA384_Init SHA512_Init SHA512_Transform SRP_Calc_A SRP_Calc_B SRP_Calc_client_key SRP_Calc_server_key SRP_Calc_u SRP_Calc_x SRP_Verify_A_mod_N SRP_Verify_B_mod_N SRP_check_known_gN_param SRP_create_verifier_BN SRP_get_default_gN X509_EXTENSION_free X509_NAME_cmp X509_NAME_dup X509_NAME_free X509_STORE_CTX_cleanup X509_STORE_CTX_get0_param X509_STORE_CTX_get_ex_new_index X509_STORE_CTX_init X509_STORE_CTX_set_default X509_STORE_CTX_set_ex_data X509_STORE_CTX_set_verify_cb X509_STORE_free X509_STORE_load_locations X509_STORE_new X509_STORE_set_default_paths X509_VERIFY_PARAM_free X509_VERIFY_PARAM_get_depth X509_VERIFY_PARAM_inherit X509_VERIFY_PARAM_new X509_VERIFY_PARAM_set1 X509_VERIFY_PARAM_set_depth X509_VERIFY_PARAM_set_purpose X509_VERIFY_PARAM_set_trust X509_certificate_type X509_check_private_key X509_check_purpose X509_free X509_get_pubkey X509_get_subject_name X509_verify_cert X509_verify_cert_error_string asn1_GetSequence asn1_add_error asn1_const_Finish d2i_ASN1_INTEGER d2i_ASN1_OCTET_STRING d2i_OCSP_RESPID d2i_PrivateKey d2i_PrivateKey_bio d2i_RSAPrivateKey d2i_RSAPrivateKey_bio d2i_X509 d2i_X509_EXTENSIONS d2i_X509_NAME d2i_X509_bio i2d_ASN1_INTEGER i2d_ASN1_OCTET_STRING i2d_OCSP_RESPID i2d_X509 i2d_X509_EXTENSIONS i2d_X509_NAME lh_delete lh_doall_arg lh_free lh_insert lh_new lh_num_items lh_retrieve pitem_free pitem_new pqueue_find pqueue_free pqueue_insert pqueue_iterator pqueue_new pqueue_next pqueue_peek pqueue_pop pqueue_size sk_dup sk_find sk_free sk_new sk_new_null sk_num sk_pop_free sk_push sk_set sk_set_cmp_func sk_shift sk_sort sk_value sk_zero

kernel32

DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcrt

__dllonexit _amsg_exit _errno _ftime _initterm _iob _lock _onexit time _unlock calloc fprintf free fwrite malloc memcmp memcpy memmove strchr strlen strncmp strncpy abort vfprintf

BIO_f_ssl BIO_new_buffer_ssl_connect BIO_new_ssl BIO_new_ssl_connect BIO_ssl_copy_session_id BIO_ssl_shutdown DTLSv1_client_method DTLSv1_method DTLSv1_server_method ERR_load_SSL_strings PEM_read_SSL_SESSION PEM_read_bio_SSL_SESSION PEM_write_SSL_SESSION PEM_write_bio_SSL_SESSION SRP_Calc_A_param SRP_generate_client_master_secret SRP_generate_server_master_secret SSL_CIPHER_description SSL_CIPHER_get_bits SSL_CIPHER_get_id SSL_CIPHER_get_name SSL_CIPHER_get_version SSL_COMP_add_compression_method SSL_COMP_get_compression_methods SSL_COMP_get_name SSL_CTX_SRP_CTX_free SSL_CTX_SRP_CTX_init SSL_CTX_add_client_CA SSL_CTX_add_session SSL_CTX_callback_ctrl SSL_CTX_check_private_key SSL_CTX_ctrl SSL_CTX_flush_sessions SSL_CTX_free SSL_CTX_get_cert_store SSL_CTX_get_client_CA_list SSL_CTX_get_client_cert_cb SSL_CTX_get_ex_data SSL_CTX_get_ex_new_index SSL_CTX_get_info_callback SSL_CTX_get_quiet_shutdown SSL_CTX_get_timeout SSL_CTX_get_verify_callback SSL_CTX_get_verify_depth SSL_CTX_get_verify_mode SSL_CTX_load_verify_locations SSL_CTX_new SSL_CTX_remove_session SSL_CTX_sess_get_get_cb SSL_CTX_sess_get_new_cb SSL_CTX_sess_get_remove_cb SSL_CTX_sess_set_get_cb SSL_CTX_sess_set_new_cb SSL_CTX_sess_set_remove_cb SSL_CTX_sessions SSL_CTX_set1_param SSL_CTX_set_cert_store SSL_CTX_set_cert_verify_callback SSL_CTX_set_cipher_list SSL_CTX_set_client_CA_list SSL_CTX_set_client_cert_cb SSL_CTX_set_client_cert_engine SSL_CTX_set_cookie_generate_cb SSL_CTX_set_cookie_verify_cb SSL_CTX_set_default_passwd_cb SSL_CTX_set_default_passwd_cb_userdata SSL_CTX_set_default_verify_paths SSL_CTX_set_ex_data SSL_CTX_set_generate_session_id SSL_CTX_set_info_callback SSL_CTX_set_msg_callback SSL_CTX_set_next_proto_select_cb SSL_CTX_set_next_protos_advertised_cb SSL_CTX_set_psk_client_callback SSL_CTX_set_psk_server_callback SSL_CTX_set_purpose SSL_CTX_set_quiet_shutdown SSL_CTX_set_session_id_context SSL_CTX_set_srp_cb_arg SSL_CTX_set_srp_client_pwd_callback SSL_CTX_set_srp_password SSL_CTX_set_srp_strength SSL_CTX_set_srp_username SSL_CTX_set_srp_username_callback SSL_CTX_set_srp_verify_param_callback SSL_CTX_set_ssl_version SSL_CTX_set_timeout SSL_CTX_set_tlsext_use_srtp SSL_CTX_set_tmp_dh_callback SSL_CTX_set_tmp_ecdh_callback SSL_CTX_set_tmp_rsa_callback SSL_CTX_set_trust SSL_CTX_set_verify SSL_CTX_set_verify_depth SSL_CTX_use_PrivateKey SSL_CTX_use_PrivateKey_ASN1 SSL_CTX_use_PrivateKey_file SSL_CTX_use_RSAPrivateKey SSL_CTX_use_RSAPrivateKey_ASN1 SSL_CTX_use_RSAPrivateKey_file SSL_CTX_use_certificate SSL_CTX_use_certificate_ASN1 SSL_CTX_use_certificate_chain_file SSL_CTX_use_certificate_file SSL_CTX_use_psk_identity_hint SSL_SESSION_free SSL_SESSION_get0_peer SSL_SESSION_get_compress_id SSL_SESSION_get_ex_data SSL_SESSION_get_ex_new_index SSL_SESSION_get_id SSL_SESSION_get_time SSL_SESSION_get_timeout SSL_SESSION_new SSL_SESSION_print SSL_SESSION_print_fp SSL_SESSION_set1_id_context SSL_SESSION_set_ex_data SSL_SESSION_set_time SSL_SESSION_set_timeout SSL_SRP_CTX_free SSL_SRP_CTX_init SSL_accept SSL_add_client_CA SSL_add_dir_cert_subjects_to_stack SSL_add_file_cert_subjects_to_stack SSL_alert_desc_string SSL_alert_desc_string_long SSL_alert_type_string SSL_alert_type_string_long SSL_cache_hit SSL_callback_ctrl SSL_check_private_key SSL_clear SSL_connect SSL_copy_session_id SSL_ctrl SSL_do_handshake SSL_dup SSL_dup_CA_list SSL_export_keying_material SSL_free SSL_get0_next_proto_negotiated SSL_get1_session SSL_get_SSL_CTX SSL_get_certificate SSL_get_cipher_list SSL_get_ciphers SSL_get_client_CA_list SSL_get_current_cipher SSL_get_current_compression SSL_get_current_expansion SSL_get_default_timeout SSL_get_error SSL_get_ex_data SSL_get_ex_data_X509_STORE_CTX_idx SSL_get_ex_new_index SSL_get_fd SSL_get_finished SSL_get_info_callback SSL_get_peer_cert_chain SSL_get_peer_certificate SSL_get_peer_finished SSL_get_privatekey SSL_get_psk_identity SSL_get_psk_identity_hint SSL_get_quiet_shutdown SSL_get_rbio SSL_get_read_ahead SSL_get_rfd SSL_get_selected_srtp_profile SSL_get_servername SSL_get_servername_type SSL_get_session SSL_get_shared_ciphers SSL_get_shutdown SSL_get_srp_N SSL_get_srp_g SSL_get_srp_userinfo SSL_get_srp_username SSL_get_srtp_profiles SSL_get_ssl_method SSL_get_verify_callback SSL_get_verify_depth SSL_get_verify_mode SSL_get_verify_result SSL_get_version SSL_get_wbio SSL_get_wfd SSL_has_matching_session_id SSL_library_init SSL_load_client_CA_file SSL_load_error_strings SSL_new SSL_peek SSL_pending SSL_read SSL_renegotiate SSL_renegotiate_abbreviated SSL_renegotiate_pending SSL_rstate_string SSL_rstate_string_long SSL_select_next_proto SSL_set1_param SSL_set_SSL_CTX SSL_set_accept_state SSL_set_bio SSL_set_cipher_list SSL_set_client_CA_list SSL_set_connect_state SSL_set_debug SSL_set_ex_data SSL_set_fd SSL_set_generate_session_id SSL_set_info_callback SSL_set_msg_callback SSL_set_psk_client_callback SSL_set_psk_server_callback SSL_set_purpose SSL_set_quiet_shutdown SSL_set_read_ahead SSL_set_rfd SSL_set_session SSL_set_session_id_context SSL_set_session_secret_cb SSL_set_session_ticket_ext SSL_set_session_ticket_ext_cb SSL_set_shutdown SSL_set_srp_server_param SSL_set_srp_server_param_pw SSL_set_ssl_method SSL_set_state SSL_set_tlsext_use_srtp SSL_set_tmp_dh_callback SSL_set_tmp_ecdh_callback SSL_set_tmp_rsa_callback SSL_set_trust SSL_set_verify SSL_set_verify_depth SSL_set_verify_result SSL_set_wfd SSL_shutdown SSL_srp_server_param_with_username SSL_state SSL_state_string SSL_state_string_long SSL_use_PrivateKey SSL_use_PrivateKey_ASN1 SSL_use_PrivateKey_file SSL_use_RSAPrivateKey SSL_use_RSAPrivateKey_ASN1 SSL_use_RSAPrivateKey_file SSL_use_certificate SSL_use_certificate_ASN1 SSL_use_certificate_file SSL_use_psk_identity_hint SSL_version SSL_want SSL_write SSLv23_client_method SSLv23_method SSLv23_server_method SSLv2_client_method SSLv2_method SSLv2_server_method SSLv3_client_method SSLv3_method SSLv3_server_method TLSv1_1_client_method TLSv1_1_method TLSv1_1_server_method TLSv1_2_client_method TLSv1_2_method TLSv1_2_server_method TLSv1_client_method TLSv1_method TLSv1_server_method d2i_SSL_SESSION i2d_SSL_SESSION

Name

.text

Size

282KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

superb.ovpn

SHA256 8cb9684a5d4e8bcf84a79dea1c8a72e4b1a414329bfcaf973385aae64a05b6bf
MD5 f07b78014a382013e3f1e5b7175e8ad0
SHA1 7a9947ff0561cfc6e94c7bc230a1c0a0e3b67829
SHA512 ba7c30c5d2121ee3d83462daeec7af2f8ad6ad4fa14178a5616d46bbf86935d416fafa33dbfa609ac8ce1f32f1bf3b6e68667d9a326c31d18eee70785ea76d9a
SSDEEP 96:r3KogclcmmbhibGDdAlibiwyoTiD3ZVpibagsXn476LjK5pM:rpymUMGDkMiwHmDpLMagsX47NbM
MD5 SHA1 SHA512 SSDEEP

test.ovpn

SHA256 a97786b46a1c1e23f8ee59970511e861df8ae828bef14483207f18a53415f0c8
MD5 7dfc62333c2c4ca41d86557b275d42c2
SHA1 0ca57000cca8952dfe533f14c2ff1a06a906ec69
SHA512 4cb42e9f7040da4a43990962aacb7c949794baa68677a164b757d0219c48508e955e6b1e35a19aca07147b67ccf52fd075e88e1ef7b126872f4bd2fe59b647e9
SSDEEP 192:ehHpyYquD1J837lXqGVD0NOwO1/oZXhr82gHGrxGd:eh4TuDMXqGVDwaVoZVmHi2
MD5 SHA1 SHA512 SSDEEP

vpn850936802.ovpn

SHA256 ef1bdf0280ead049d92f3fe4de5477fc93889b39f97d2903f2bc3c7634f873e6
MD5 ed9a309d88250d3c9825cbaccda266e8
SHA1 3104f2d3e8eaff90a3965b7dd00e0ac2508b07bb
SHA512 29708fa8b2ff7cbd1b067f062f1a217f519b5aaf1c38af8d0ca55f24fdf8608a3e1224573e628de4e98b83479ea8dd975432a44b5bfa282082078f563344b3b2
SSDEEP 192:ehHpyYquD1J837lXqGVD0NOwO1/oZXhr82gHGrxGR:eh4TuDMXqGVDwaVoZVmHi8
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer