General

  • Target

    Outline-Client.exe

  • Size

    67.4MB

  • MD5

    0560efd75b432c5b0d4d9283e6adde47

  • SHA1

    b01abcd1821b1ad523410fd58e2ca422bd0f70fe

  • SHA256

    5615d293850a4c4a15c31b3aad262a29ab8b676a4dd1305d186d000ee6042590

  • SHA512

    c49bd64603eaa2b4ea643547c1a58880dda1bfb0e3b3937aa6fd8cd06d50aa63c9efd9e3fa2421399a418df297eddd23dca93afd3ec3ad7355b80103a66cb86e

  • SSDEEP

    1572864:L3ycjLk/X5W0eyA8iEc666RIndCltnPROFV7th:LCxP5W0e/wT66RIdQih

Score
3/10

Malware Config

Signatures

  • Unsigned PE 20 IoCs

    Checks for missing Authenticode signature.

Files

  • Outline-Client.exe
    .exe windows:4 windows x86 arch:x86

    b34f154ec913d2d2c435cbd644e91687


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/SpiderBanner.dll
    .dll windows:5 windows x86 arch:x86

    90179d905cdca282880541c826651c15


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StdUtils.dll
    .dll windows:5 windows x86 arch:x86

    7b79709c0d5576549eb261e3410f95f8


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    e1c0bd3d5b9f3f5cec7ea773ff66ac6e


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WinShell.dll
    .dll windows:4 windows x86 arch:x86

    a75c904bad153f5af2c37cfdf66eba5c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/app-32.7z
    .7z
  • LICENSE.electron.txt
  • LICENSES.chromium.html
  • Outline.exe
    .exe windows:5 windows x86 arch:x86

    9b7dc7892dd2845ee3be63b0d62b384d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • chrome_100_percent.pak
  • chrome_200_percent.pak
  • d3dcompiler_47.dll
    .dll windows:10 windows x86 arch:x86

    185ce3a45c3a9cfb3bf83afd7f79c140


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ffmpeg.dll
    .dll windows:5 windows x86 arch:x86

    c7497313062f9c96c83518b36f70731f


    Headers

    Imports

    Exports

    Sections

  • icudtl.dat
  • libEGL.dll
    .dll windows:5 windows x86 arch:x86

    14cd5ffd5d2a5e20eb8ffa21377b813a


    Headers

    Imports

    Exports

    Sections

  • libGLESv2.dll
    .dll windows:5 windows x86 arch:x86

    a3cf5bdf45630e05f03d9a6f7db22e7b


    Headers

    Imports

    Exports

    Sections

  • locales/af.pak
  • locales/am.pak
  • locales/ar.pak
  • locales/bg.pak
  • locales/bn.pak
  • locales/ca.pak
  • locales/cs.pak
  • locales/da.pak
  • locales/de.pak
  • locales/el.pak
  • locales/en-GB.pak
  • locales/en-US.pak
  • locales/es-419.pak
  • locales/es.pak
  • locales/et.pak
  • locales/fa.pak
  • locales/fi.pak
  • locales/fil.pak
  • locales/fr.pak
  • locales/gu.pak
  • locales/he.pak
  • locales/hi.pak
  • locales/hr.pak
  • locales/hu.pak
  • locales/id.pak
  • locales/it.pak
  • locales/ja.pak
  • locales/kn.pak
  • locales/ko.pak
  • locales/lt.pak
  • locales/lv.pak
  • locales/ml.pak
  • locales/mr.pak
  • locales/ms.pak
  • locales/nb.pak
  • locales/nl.pak
  • locales/pl.pak
  • locales/pt-BR.pak
  • locales/pt-PT.pak
  • locales/ro.pak
  • locales/ru.pak
  • locales/sk.pak
  • locales/sl.pak
  • locales/sr.pak
  • locales/sv.pak
  • locales/sw.pak
  • locales/ta.pak
  • locales/te.pak
  • locales/th.pak
  • locales/tr.pak
  • locales/uk.pak
  • locales/ur.pak
  • locales/vi.pak
  • locales/zh-CN.pak
  • locales/zh-TW.pak
  • resources.pak
  • resources/app-update.yml
  • resources/app.asar
    .js
  • resources/app.asar.unpacked/client/output/build/windows/tun2socks.exe
    .exe windows:6 windows x64 arch:x64

    9e38337f60123cc4f1c7c28b88c561bb


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • resources/app.asar.unpacked/client/resources/tray/connected.png
    .png
  • resources/app.asar.unpacked/client/resources/tray/disconnected.png
    .png
  • resources/app.asar.unpacked/client/www/6a9a3c1460491e5495ea8899784fc0fe.png
    .png
  • resources/app.asar.unpacked/client/www/8c59cf2168143c4cc938073f1a28650e.woff2
  • resources/app.asar.unpacked/client/www/assets/brand-logo.png
    .png
  • resources/app.asar.unpacked/client/www/assets/circle.png
    .png
  • resources/app.asar.unpacked/client/www/assets/icons/about.png
    .png
  • resources/app.asar.unpacked/client/www/assets/icons/add.png
    .png
  • resources/app.asar.unpacked/client/www/assets/icons/back.png
    .png
  • resources/app.asar.unpacked/client/www/assets/icons/change_language.png
    .png
  • resources/app.asar.unpacked/client/www/assets/icons/contact.png
    .png
  • resources/app.asar.unpacked/client/www/assets/icons/feedback.png
    .png
  • resources/app.asar.unpacked/client/www/assets/icons/help.png
    .png
  • resources/app.asar.unpacked/client/www/assets/icons/menu.png
    .png
  • resources/app.asar.unpacked/client/www/assets/icons/outline.png
    .png
  • resources/app.asar.unpacked/client/www/assets/icons/quit.png
    .png
  • resources/app.asar.unpacked/client/www/assets/jigsaw-logo.png
    .png
  • resources/app.asar.unpacked/client/www/assets/jigsaw-logo.svg
    .xml
  • resources/app.asar.unpacked/client/www/assets/logo-nav.png
    .png
  • resources/app.asar.unpacked/client/www/assets/material_icons.woff2
  • resources/app.asar.unpacked/client/www/assets/outline-client-logo.png
    .png
  • resources/app.asar.unpacked/client/www/assets/outline-client-logo.svg
    .xml
  • resources/app.asar.unpacked/client/www/assets/privacy-lock.png
    .png
  • resources/app.asar.unpacked/client/www/environment.json
  • resources/app.asar.unpacked/client/www/index_electron.html
    .html
  • resources/app.asar.unpacked/client/www/main.js
    .js
  • resources/app.asar.unpacked/client/www/main.js.LICENSE.txt
  • resources/app.asar.unpacked/client/www/messages/af.json
  • resources/app.asar.unpacked/client/www/messages/am.json
  • resources/app.asar.unpacked/client/www/messages/ar.json
  • resources/app.asar.unpacked/client/www/messages/az.json
  • resources/app.asar.unpacked/client/www/messages/bg.json
  • resources/app.asar.unpacked/client/www/messages/bn.json
  • resources/app.asar.unpacked/client/www/messages/bs.json
  • resources/app.asar.unpacked/client/www/messages/ca.json
  • resources/app.asar.unpacked/client/www/messages/cs.json
  • resources/app.asar.unpacked/client/www/messages/da.json
  • resources/app.asar.unpacked/client/www/messages/de.json
  • resources/app.asar.unpacked/client/www/messages/el.json
  • resources/app.asar.unpacked/client/www/messages/en-GB.json
  • resources/app.asar.unpacked/client/www/messages/en.json
  • resources/app.asar.unpacked/client/www/messages/es-419.json
  • resources/app.asar.unpacked/client/www/messages/es.json
  • resources/app.asar.unpacked/client/www/messages/et.json
  • resources/app.asar.unpacked/client/www/messages/fa.json
  • resources/app.asar.unpacked/client/www/messages/fi.json
  • resources/app.asar.unpacked/client/www/messages/fil.json
  • resources/app.asar.unpacked/client/www/messages/fr.json
  • resources/app.asar.unpacked/client/www/messages/he.json
  • resources/app.asar.unpacked/client/www/messages/hi.json
  • resources/app.asar.unpacked/client/www/messages/hr.json
  • resources/app.asar.unpacked/client/www/messages/hu.json
  • resources/app.asar.unpacked/client/www/messages/hy.json
  • resources/app.asar.unpacked/client/www/messages/id.json
  • resources/app.asar.unpacked/client/www/messages/is.json
  • resources/app.asar.unpacked/client/www/messages/it.json
  • resources/app.asar.unpacked/client/www/messages/ja.json
  • resources/app.asar.unpacked/client/www/messages/ka.json
  • resources/app.asar.unpacked/client/www/messages/kk.json
  • resources/app.asar.unpacked/client/www/messages/km.json
  • resources/app.asar.unpacked/client/www/messages/ko.json
  • resources/app.asar.unpacked/client/www/messages/lo.json
  • resources/app.asar.unpacked/client/www/messages/lt.json
  • resources/app.asar.unpacked/client/www/messages/lv.json
  • resources/app.asar.unpacked/client/www/messages/mk.json
  • resources/app.asar.unpacked/client/www/messages/mn.json
  • resources/app.asar.unpacked/client/www/messages/mr.json
  • resources/app.asar.unpacked/client/www/messages/ms.json
  • resources/app.asar.unpacked/client/www/messages/my.json
  • resources/app.asar.unpacked/client/www/messages/ne.json
  • resources/app.asar.unpacked/client/www/messages/nl.json
  • resources/app.asar.unpacked/client/www/messages/no.json
  • resources/app.asar.unpacked/client/www/messages/pl.json
  • resources/app.asar.unpacked/client/www/messages/pt-BR.json
  • resources/app.asar.unpacked/client/www/messages/pt-PT.json
  • resources/app.asar.unpacked/client/www/messages/ro.json
  • resources/app.asar.unpacked/client/www/messages/ru.json
  • resources/app.asar.unpacked/client/www/messages/si.json
  • resources/app.asar.unpacked/client/www/messages/sk.json
  • resources/app.asar.unpacked/client/www/messages/sl.json
  • resources/app.asar.unpacked/client/www/messages/sq.json
  • resources/app.asar.unpacked/client/www/messages/sr-Latn.json
  • resources/app.asar.unpacked/client/www/messages/sr.json
  • resources/app.asar.unpacked/client/www/messages/sv.json
  • resources/app.asar.unpacked/client/www/messages/sw.json
  • resources/app.asar.unpacked/client/www/messages/ta.json
  • resources/app.asar.unpacked/client/www/messages/th.json
  • resources/app.asar.unpacked/client/www/messages/tr.json
  • resources/app.asar.unpacked/client/www/messages/uk.json
  • resources/app.asar.unpacked/client/www/messages/ur.json
  • resources/app.asar.unpacked/client/www/messages/vi.json
  • resources/app.asar.unpacked/client/www/messages/zh-CN.json
  • resources/app.asar.unpacked/client/www/messages/zh-TW.json
  • resources/app.asar.unpacked/client/www/ui_components/licenses/licenses.txt
  • resources/elevate.exe
    .exe windows:6 windows x86 arch:x86

    c3afe98a750f2d4f1ed5d2ac323cb5e0


    Code Sign

    Headers

    Imports

    Sections

  • snapshot_blob.bin
  • v8_context_snapshot.bin
  • vk_swiftshader.dll
    .dll windows:5 windows x86 arch:x86

    e4ad26ec9334769567aee040de43484d


    Headers

    Imports

    Exports

    Sections

  • vk_swiftshader_icd.json
  • vulkan-1.dll
    .dll windows:5 windows x86 arch:x86

    555db08aac990c6cbb99d14d12be6861


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d31c5eb927119d00232e4d4b0e32fcdb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    439074d1c01f7b16781bdf060930814a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsis7z.dll
    .dll windows:6 windows x86 arch:x86

    2656ea25cde98f31a490513c2db04ae8


    Headers

    Imports

    Exports

    Sections

  • $R0/Uninstall Outline.exe
    .exe windows:4 windows x86 arch:x86

    b34f154ec913d2d2c435cbd644e91687


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/StdUtils.dll
    .dll windows:5 windows x86 arch:x86

    7b79709c0d5576549eb261e3410f95f8


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UAC.dll
    .dll windows:4 windows x86 arch:x86

    0ef725341a4aecf8398c0e2132f38049


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/WinShell.dll
    .dll windows:4 windows x86 arch:x86

    a75c904bad153f5af2c37cfdf66eba5c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    d31c5eb927119d00232e4d4b0e32fcdb


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:5 windows x86 arch:x86

    439074d1c01f7b16781bdf060930814a


    Headers

    Imports

    Exports

    Sections

  • tap-windows6/OemVista.inf
  • tap-windows6/tap0901.cat
  • tap-windows6/tap0901.sys
    .sys windows:6 windows x64 arch:x64

    a13cebc938af36dab20cc614c6fb7e94


    Headers

    Imports

    Sections

  • tap-windows6/tapinstall.exe
    .exe windows:6 windows x64 arch:x64

    59dfe5c9f961f1417775cd3a41a8be62


    Code Sign

    Headers

    Imports

    Sections