General

Malware Config

Signatures

Files

• FortiClientVPNOnlineInstaller.exe

  .exe windows:6 windows x86 arch:x86

  7e218f80af54cd99fa3c7a5cdc029310

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:62:df:fe:c6:e9:33:2b:fa:93:b2:f1:87:86:36:42

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  07-06-2021 00:00

  Not After

  09-07-2024 23:59

  Subject

  CN=Fortinet Technologies (Canada) ULC,O=Fortinet Technologies (Canada) ULC,L=Burnaby,ST=British Columbia,C=CA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  52:2b:bb:34:ce:f4:c0:14:8a:0d:fb:6c:2d:a6:c9:de:c6:64:02:bf:37:52:c5:ec:1a:99:fb:7f:b6:74:a6:e8

  Signer

  Actual PE Digest

  52:2b:bb:34:ce:f4:c0:14:8a:0d:fb:6c:2d:a6:c9:de:c6:64:02:bf:37:52:c5:ec:1a:99:fb:7f:b6:74:a6:e8

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\jenkins\FCT0\GIT_CLONE_PARENT\FortiClientHS\service\FCInstallerLight\vpn\Win32\Release\FortiClientVPNInstaller.pdb

  Imports

  kernel32

  VerSetConditionMask

  GetCommandLineW

  DecodePointer

  CloseHandle

  RaiseException

  GetLastError

  SetLastError

  InitializeCriticalSectionEx

  DeleteCriticalSection

  CreateMutexW

  OpenMutexW

  GetCurrentProcess

  GetCurrentProcessId

  OpenProcess

  GetSystemDirectoryW

  FreeLibrary

  GetModuleFileNameW

  GetModuleHandleW

  GetProcAddress

  LoadLibraryExW

  LoadResource

  SizeofResource

  SetDefaultDllDirectories

  LocalFree

  lstrcmpiW

  LoadLibraryW

  FindResourceW

  SetSearchPathMode

  VerifyVersionInfoW

  MultiByteToWideChar

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  DeleteFileW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetFileAttributesW

  SetFileAttributesW

  SetEvent

  WaitForSingleObject

  CreateEventW

  TerminateThread

  ProcessIdToSessionId

  Sleep

  CreateThread

  GetTickCount

  WaitForMultipleObjects

  GetTimeZoneInformation

  WideCharToMultiByte

  GetLocaleInfoW

  ExpandEnvironmentStringsW

  SetCurrentDirectoryW

  GetFullPathNameW

  GetTempPathW

  CancelIo

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  SetWaitableTimer

  CancelWaitableTimer

  GetExitCodeProcess

  GetCurrentThreadId

  CreateProcessW

  CreateWaitableTimerW

  GetUserDefaultLCID

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  LoadLibraryExA

  GetEnvironmentVariableW

  SearchPathW

  CreateFileW

  GetCurrentDirectoryW

  GetFileSize

  QueryPerformanceCounter

  ReadFile

  GetFileSizeEx

  FileTimeToSystemTime

  DeviceIoControl

  GetVersionExW

  CreateNamedPipeW

  WaitForMultipleObjectsEx

  ReleaseMutex

  DisconnectNamedPipe

  OutputDebugStringW

  ResetEvent

  GetOverlappedResult

  ConnectNamedPipe

  FlushFileBuffers

  GetLongPathNameW

  K32EnumProcesses

  GetWindowsDirectoryW

  WTSGetActiveConsoleSessionId

  GetComputerNameW

  GetVolumeInformationW

  SetThreadLocale

  GetUserDefaultUILanguage

  GetACP

  LocalAlloc

  SetNamedPipeHandleState

  WriteFile

  WaitNamedPipeW

  TlsSetValue

  GetFullPathNameA

  UnmapViewOfFile

  GetLogicalDriveStringsW

  GetFileAttributesExW

  TlsAlloc

  TlsGetValue

  CreateFileMappingW

  MapViewOfFile

  GetDriveTypeW

  QueryDosDeviceW

  GetLogicalDrives

  FindFirstVolumeMountPointW

  FindFirstVolumeW

  HeapFree

  FindVolumeMountPointClose

  TerminateProcess

  K32GetModuleFileNameExW

  GetVolumePathNameW

  HeapSize

  GetVolumeNameForVolumeMountPointW

  FindNextVolumeMountPointW

  HeapReAlloc

  HeapAlloc

  HeapDestroy

  ReadProcessMemory

  FindVolumeClose

  GetProcessHeap

  FindNextVolumeW

  OpenThread

  OpenEventW

  GetSystemDirectoryA

  GetLocalTime

  GetCurrentThread

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  InitializeCriticalSectionAndSpinCount

  WaitForSingleObjectEx

  IsDebuggerPresent

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  EncodePointer

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  FlushInstructionCache

  VirtualAlloc

  VirtualFree

  SetConsoleMode

  GetSystemTime

  SystemTimeToFileTime

  FormatMessageA

  GetStringTypeW

  CreateDirectoryW

  FindFirstFileExW

  GetDiskFreeSpaceExW

  GetFileInformationByHandle

  GetFinalPathNameByHandleW

  SetFileInformationByHandle

  SetFileTime

  AreFileApisANSI

  CreateDirectoryExW

  CopyFileW

  MoveFileExW

  CreateHardLinkW

  GetFileInformationByHandleEx

  CreateSymbolicLinkW

  GetLocaleInfoEx

  QueryPerformanceFrequency

  LCMapStringEx

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  InitializeSRWLock

  ReleaseSRWLockExclusive

  AcquireSRWLockExclusive

  TryAcquireSRWLockExclusive

  InitOnceExecuteOnce

  InitializeConditionVariable

  WakeConditionVariable

  WakeAllConditionVariable

  SleepConditionVariableCS

  SleepConditionVariableSRW

  CreateEventExW

  CreateSemaphoreExW

  FlushProcessWriteBuffers

  GetCurrentProcessorNumber

  GetTickCount64

  FreeLibraryWhenCallbackReturns

  CreateThreadpoolWork

  SubmitThreadpoolWork

  CloseThreadpoolWork

  CreateThreadpoolTimer

  SetThreadpoolTimer

  WaitForThreadpoolTimerCallbacks

  CloseThreadpoolTimer

  CreateThreadpoolWait

  SetThreadpoolWait

  CloseThreadpoolWait

  CompareStringEx

  GetCPInfo

  RtlUnwind

  InterlockedFlushSList

  TlsFree

  GetFileType

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameA

  GetStdHandle

  SetFilePointerEx

  GetConsoleMode

  ReadConsoleW

  GetConsoleCP

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  IsValidLocale

  EnumSystemLocalesW

  SetStdHandle

  SetEndOfFile

  FindFirstFileExA

  FindNextFileA

  IsValidCodePage

  GetOEMCP

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetEnvironmentVariableW

  SetConsoleCtrlHandler

  OutputDebugStringA

  WriteConsoleW

  VirtualLock

  SwitchToFiber

  DeleteFiber

  CreateFiberEx

  LoadLibraryA

  ConvertFiberToThread

  ConvertThreadToFiberEx

  GlobalMemoryStatus

  ReadConsoleA

  ncrypt

  BCryptGenRandom

  Exports

  Exports

  BeginHttpRequest

  BeginHttpResponse

  FCP_add_param

  FCP_append_objdata_ff

  FCP_break_obj_header

  FCP_breakup_data_item

  FCP_calculate_obj_head_chksum

  FCP_chk_partial_obj_files

  FCP_cleanup

  FCP_clear_object_storage

  FCP_clear_package

  FCP_clear_params

  FCP_clear_request

  FCP_clear_response

  FCP_combine_params

  FCP_create_package_hdr

  FCP_del_param

  FCP_delete_file

  FCP_get_file_size

  FCP_get_obj_resume_info

  FCP_get_object_desc

  FCP_get_param

  FCP_init_object_storage

  FCP_init_package

  FCP_init_params

  FCP_init_request

  FCP_init_request_for_sending

  FCP_init_response

  FCP_init_response_for_sending

  FCP_initialize

  FCP_load_object

  FCP_load_package

  FCP_pack_obj

  FCP_parse_params

  FCP_recv_request

  FCP_recv_response

  FCP_send_n_recv

  FCP_send_object

  FCP_send_request

  FCP_send_response

  FCP_set_param

  FCP_unpack_obj

  FCP_unpack_obj_ff

  FCP_unpack_obj_fnfn

  FCP_verify_object_hdr

  FCP_verify_package_hdr

  FR_cleanup

  FR_close

  FR_connect

  FR_connected

  FR_get_local_addr

  FR_initialize

  FR_read

  FR_write

  Sections

  .text

  Size: 2.9MB - Virtual size: 2.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 724KB - Virtual size: 724KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 19KB - Virtual size: 45KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didat

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 168KB - Virtual size: 167KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 137KB - Virtual size: 136KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ