openvpn[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

openvpn.exe
Size

821KB
MD5

29562191c6d1e228381db383159dfe10
SHA1

22895b8ecdb21f588744d3f47aa95db8b65eb499
SHA256

2e33a911babfe1ef856b63b3ce485cd67b27de5604254c74af7bb62d1d5013ff
SHA512

744bdc53c91d96f44b1e652ae2fc1116c3807ffe0d11f292970c94a190db3b11906706c8c2f58684fd540b8f4a1b325156a3c23683d54a7a7ccb850e9cc76f1d
SSDEEP

24576:e1d4irue3EG5AuABYsh9/7TXLUVOAxP2Pl:eGe3EGuuAOs/nwW

Score

1^/10

Malware Config

Signatures

Files

openvpn.exe
.exe windows:6 windows x64 arch:x64

a8641247c772b5ce93bcd14ad2bdece5

Code Sign

0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/10/2019, 00:00

Not After

04/11/2022, 12:00

Subject

CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:db:8f:fe:f0:4c:ae:d4:d3:a6:69:ce:d1:ea:c6:25:d5:0a:b2:a4:bf:62:78:3b:21:fa:4e:f6:99:75:96:7b
Signer

Actual PE Digest

0c:db:8f:fe:f0:4c:ae:d4:d3:a6:69:ce:d1:ea:c6:25:d5:0a:b2:a4:bf:62:78:3b:21:fa:4e:f6:99:75:96:7b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\vagrant\build\openvpn\x64-Output\Release\openvpn.pdb

Imports

ncrypt

NCryptFreeObject
NCryptSignHash

ws2_32

htonl
htons
WSAWaitForMultipleEvents
ioctlsocket
WSAGetLastError
setsockopt
WSACleanup
WSAStartup
WSAEventSelect
WSAEnumNetworkEvents
getservbyname
ntohl
bind
WSASend
WSASendTo
getaddrinfo
socket
connect
WSARecv
getsockopt
WSARecvFrom
inet_ntop
WSAGetOverlappedResult
getnameinfo
select
closesocket
listen
send
inet_ntoa
recv
getsockname
freeaddrinfo
WSASetLastError
inet_pton
ntohs
accept

crypt32

CryptAcquireCertificatePrivateKey
CertVerifyTimeValidity
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertFreeCertificateContext

iphlpapi

AddIPAddress
GetAdaptersInfo
GetIpInterfaceEntry
GetBestRoute2
GetBestInterfaceEx
GetAdapterIndex
CreateIpForwardEntry
GetIpForwardTable
ConvertInterfaceIndexToLuid
InitializeIpInterfaceEntry
SetIpInterfaceEntry
FlushIpNetTable
GetPerAdapterInfo
IpRenewAddress
GetInterfaceInfo
DeleteIPAddress
DeleteIpForwardEntry
IpReleaseAddress

fwpuclnt

FwpmFreeMemory0
FwpmEngineOpen0
FwpmEngineClose0
FwpmSubLayerGetByKey0
FwpmFilterAdd0
FwpmSubLayerAdd0
FwpmGetAppIdFromFileName0

setupapi

CM_Get_Device_Interface_ListA
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsExA
CM_Get_Device_Interface_List_SizeA

advapi32

RegEnumKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
SetKernelObjectSecurity
RegQueryValueExW
CryptSignHashA
CryptCreateHash
CryptSetHashParam
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext

libcrypto-1_1-x64

X509_get0_notBefore
EC_KEY_get_method
X509_STORE_set_flags
ERR_peek_error
BIO_new_file
X509_STORE_add_lookup
d2i_ECDSA_SIG
X509_get_pubkey
X509_NAME_entry_count
BN_bn2dec
OBJ_txt2nid
ASN1_BIT_STRING_free
X509_STORE_CTX_get_ex_data
X509_STORE_CTX_get_current_cert
X509_check_purpose
X509_get_ext_d2i
X509_NAME_print_ex
X509_NAME_ENTRY_get_object
EVP_sha1
X509_verify_cert_error_string
X509_STORE_CTX_get_error_depth
OBJ_obj2txt
X509_NAME_ENTRY_get_data
PEM_write_X509
X509_STORE_CTX_get_error
X509V3_EXT_print
EVP_sha256
ASN1_OBJECT_free
X509_get_ext_by_NID
X509_NAME_get_index_by_NID
OBJ_obj2nid
ASN1_BIT_STRING_get_bit
ASN1_STRING_to_UTF8
X509_NAME_get_index_by_OBJ
X509_digest
ASN1_INTEGER_to_BN
OBJ_txt2obj
X509_NAME_get_entry
X509_get_ext
d2i_PKCS12_bio
BIO_f_base64
OPENSSL_sk_push
OPENSSL_sk_value
PKCS12_parse
X509_LOOKUP_hash_dir
X509_cmp_time
OPENSSL_sk_find
X509_OBJECT_free
BIO_test_flags
BIO_write
X509_STORE_add_crl
OPENSSL_sk_pop_free
PEM_X509_INFO_read_bio
EVP_PKEY_bits
EC_GROUP_get_curve_name
X509_NAME_cmp
OPENSSL_sk_delete
OpenSSL_version
PEM_read_bio_DHparams
EC_KEY_get0_group
X509_INFO_free
X509_OBJECT_get_type
X509_get_signature_nid
d2i_PKCS12_fp
X509_STORE_get0_objects
EC_get_builtin_curves
EC_KEY_new_by_curve_name
OBJ_sn2nid
DH_size
OPENSSL_sk_new
i2a_ASN1_INTEGER
BIO_read
X509_get_serialNumber
BN_dup
EC_KEY_METHOD_set_sign
EC_KEY_set_method
RSA_meth_set_pub_enc
EVP_PKEY_meth_find
RSA_meth_set_priv_enc
EVP_PKEY_meth_add0
ERR_load_strings
EVP_PKEY_new
RSA_set_flags
RSA_meth_get0_app_data
RSA_new
RSA_meth_new
RSA_free
d2i_X509
X509_get0_pubkey
EVP_PKEY_meth_set_sign
RSA_flags
X509_NAME_dup
RSA_meth_set0_app_data
BN_free
ECDSA_size
EVP_PKEY_meth_new
EC_KEY_get_ex_data
PKCS12_free
DH_free
EC_KEY_set_ex_data
RSA_set_method
X509_get0_notAfter
RSA_meth_set_finish
RSA_get0_key
EVP_PKEY_get0_EC_KEY
X509_STORE_add_cert
EVP_PKEY_assign
OPENSSL_sk_num
EC_KEY_free
EVP_PKEY_get0_RSA
EC_KEY_METHOD_free
ECDSA_SIG_free
EVP_PKEY_CTX_get0_pkey
EVP_PKEY_free
RSA_pkey_ctx_ctrl
EC_KEY_METHOD_set_init
RSA_meth_set_pub_dec
RSA_meth_set_init
RSA_size
RSA_meth_free
EVP_PKEY_meth_get_sign
RSA_bits
RSA_meth_set_priv_dec
RSA_get_method
EVP_PKEY_CTX_ctrl
ECDSA_SIG_set0
X509_free
RSA_set0_key
CRYPTO_get_ex_new_index
EVP_PKEY_meth_copy
EC_KEY_METHOD_new
EC_KEY_dup
ERR_put_error
EC_KEY_OpenSSL
ECDSA_SIG_new
BN_bin2bn
i2d_ECDSA_SIG
EVP_CIPHER_CTX_key_length
EVP_CIPHER_iv_length
EVP_CIPHER_CTX_new
ENGINE_free
ENGINE_ctrl_cmd_string
EVP_get_cipherbyname
EVP_CipherUpdate
ENGINE_load_private_key
OBJ_nid2sn
BIO_new
EVP_CIPHER_CTX_iv_length
HMAC_Final
BIO_ctrl
EVP_MD_size
DES_set_odd_parity
EVP_CIPHER_block_size
ENGINE_load_builtin_engines
ENGINE_get_name
EVP_CIPHER_CTX_cipher
UI_create_method
EVP_DigestFinal
EVP_MD_CTX_new
PEM_read_bio
EVP_get_digestbyname
EVP_CipherFinal
EVP_MD_CTX_reset
ERR_get_error
CRYPTO_memcmp
DES_ecb_encrypt
HMAC_CTX_free
EVP_CipherInit
EVP_DigestUpdate
HMAC_Init_ex
EVP_Digest
PEM_write_bio
ENGINE_get_first
ENGINE_register_all_complete
BIO_s_mem
UI_destroy_method
ENGINE_finish
CRYPTO_free
EVP_MD_CTX_free
EVP_CipherInit_ex
ERR_error_string
RAND_bytes
ENGINE_by_id
HMAC_Update
DES_is_weak_key
BIO_free
HMAC_CTX_reset
UI_set_result
HMAC_CTX_new
DES_set_key_unchecked
EVP_DigestInit
HMAC_size
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_key_length
ENGINE_set_default
UI_method_set_reader
ERR_clear_error
BIO_new_mem_buf
UI_get_string_type
DES_check_key_parity
ENGINE_get_id
EVP_CIPHER_CTX_reset
ENGINE_get_next
EVP_CIPHER_nid
ENGINE_init
EVP_CIPHER_CTX_block_size
EVP_CIPHER_CTX_free
EVP_CIPHER_key_length
UI_get0_user_data
EVP_MD_type
EVP_CIPHER_flags
BIO_push
X509_get_subject_name
PEM_read_bio_X509_CRL
PEM_read_bio_X509
X509_CRL_free
OPENSSL_sk_free
BIO_free_all
EVP_PKEY_id
PEM_read_bio_PrivateKey
X509_LOOKUP_ctrl

libssl-1_1-x64

SSL_CTX_get_default_passwd_cb
SSL_CTX_get_default_passwd_cb_userdata
SSL_CTX_ctrl
SSL_CTX_use_PrivateKey
SSL_CTX_use_RSAPrivateKey
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_ex_data
SSL_set_connect_state
SSL_CTX_add_client_CA
TLS_server_method
SSL_CTX_get0_certificate
SSL_get_current_cipher
SSL_CTX_set_security_level
SSL_CTX_check_private_key
SSL_CIPHER_get_name
SSL_set_accept_state
SSL_CTX_set_cipher_list
SSL_CIPHER_get_version
SSL_CTX_set_info_callback
SSL_CTX_set_verify
SSL_set_bio
TLS_client_method
SSL_CTX_set_ciphersuites
SSL_CTX_set_client_CA_list
SSL_CTX_new
SSL_set_ex_data
SSL_export_keying_material
SSL_get_version
SSL_CTX_free
SSL_new
SSL_get_peer_certificate
SSL_CTX_set_options
SSL_CTX_get_cert_store
SSL_free
TLS_method
SSL_CTX_set_default_passwd_cb
BIO_f_ssl
SSL_get1_supported_ciphers
SSL_CTX_use_certificate

lzo2

lzo1x_1_15_compress
lzo1x_decompress_safe
__lzo_init_v2
lzo_version_string

libpkcs11-helper-1

pkcs11h_openssl_session_getEVP
pkcs11h_openssl_getX509
pkcs11h_openssl_session_getX509
pkcs11h_openssl_createSession
pkcs11h_openssl_freeSession
pkcs11h_setLogHook
pkcs11h_certificate_freeCertificate
pkcs11h_addProvider
pkcs11h_setProtectedAuthentication
pkcs11h_setForkMode
pkcs11h_certificate_create
pkcs11h_setPINPromptHook
pkcs11h_setPINCachePeriod
pkcs11h_certificate_serializeCertificateId
pkcs11h_engine_setSystem
pkcs11h_certificate_deserializeCertificateId
pkcs11h_certificate_freeCertificateIdList
pkcs11h_certificate_freeCertificateId
pkcs11h_getMessage
pkcs11h_terminate
pkcs11h_certificate_getCertificateBlob
pkcs11h_setTokenPromptHook
pkcs11h_setLogLevel
pkcs11h_initialize
pkcs11h_logout
pkcs11h_certificate_enumCertificateIds

kernel32

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
GetExitCodeProcess
WriteConsoleInputA
CreateSemaphoreA
MapViewOfFile
CreateProcessA
VerifyVersionInfoW
CreateProcessW
GetNumberOfConsoleInputEvents
VerSetConditionMask
GetStartupInfoA
GetConsoleTitleA
ReadConsoleInputA
MultiByteToWideChar
GetEnvironmentVariableA
GetTempPathW
GetModuleFileNameW
ReleaseSemaphore
SetConsoleTitleA
SetConsoleCtrlHandler
GetModuleFileNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
ReadFile
GetStdHandle
IsDebuggerPresent
GetModuleHandleW
DeleteFileW
DuplicateHandle
GetCurrentProcess
SetConsoleOutputCP
Sleep
SetEvent
CreateEventA
CreateFileMappingA
GetOverlappedResult
CloseHandle
CreateFileA
UnmapViewOfFile
GetCurrentThreadId
DeviceIoControl
WriteFile
CancelIo
ResetEvent
FreeLibrary
GetProcAddress
LoadLibraryW
GetStartupInfoW
SetConsoleMode
GetConsoleMode
ReadConsoleW
WideCharToMultiByte
GetFileType
SetLastError
GetLastError
LocalFree
FormatMessageA
SetFilePointer
CreateFileW
WaitForSingleObject
GetCurrentProcessId

vcruntime140

__C_specific_handler
memset
memmove
memcpy
strstr
strrchr
strchr
__current_exception
__current_exception_context
memcmp

api-ms-win-crt-stdio-l1-1-0

fflush
feof
ftell
ferror
clearerr
_read
fseek
_fileno
_setmode
_close
_open
fwrite
_lseek
fgetc
fopen
__stdio_common_vfprintf
_dup2
_open_osfhandle
_dup
__acrt_iob_func
_write
fread
_chsize
_set_fmode
__stdio_common_vswprintf
fgets
__stdio_common_vsscanf
fclose
_wfopen
_wopen
__stdio_common_vsprintf
__p__commode

api-ms-win-crt-runtime-l1-1-0

__p___wargv
__p___argc
_initterm_e
terminate
_crt_atexit
_initterm
_c_exit
_initialize_wide_environment
_configure_wide_argv
strerror
_cexit
_set_app_type
_register_onexit_function
_seh_filter_exe
_get_initial_wide_environment
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_errno
_exit
exit

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
_set_new_mode

api-ms-win-crt-string-l1-1-0

strtok
strncmp
toupper
_stricmp
isprint
isdigit
strcmp
ispunct
isspace
_strdup
_strnicmp
iscntrl
tolower
isalnum
isxdigit
strncpy
isalpha
strcspn

api-ms-win-crt-utility-l1-1-0

rand
srand
qsort

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdopen

api-ms-win-crt-convert-l1-1-0

strtoul
atoll
atoi

api-ms-win-crt-time-l1-1-0

_localtime64
_time64
_difftime64

api-ms-win-crt-filesystem-l1-1-0

_waccess
_wstat64i32
_wchdir

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

OPENSSL_Applink

Sections

.text
Size: 544KB - Virtual size: 544KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a8641247c772b5ce93bcd14ad2bdece5

Code Sign

0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0c:db:8f:fe:f0:4c:ae:d4:d3:a6:69:ce:d1:ea:c6:25:d5:0a:b2:a4:bf:62:78:3b:21:fa:4e:f6:99:75:96:7bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ncrypt

ws2_32

crypt32

iphlpapi

fwpuclnt

setupapi

advapi32

libcrypto-1_1-x64

libssl-1_1-x64

lzo2

libpkcs11-helper-1

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 544KB - Virtual size: 544KB

.rdata Size: 241KB - Virtual size: 241KB

.data Size: 1024B - Virtual size: 37KB

.pdata Size: 23KB - Virtual size: 22KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 900B

0b:de:83:ae:2f:95:07:36:d3:b5:9b:0e:0d:23:c2:16
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0c:db:8f:fe:f0:4c:ae:d4:d3:a6:69:ce:d1:ea:c6:25:d5:0a:b2:a4:bf:62:78:3b:21:fa:4e:f6:99:75:96:7b
Signer

.text
Size: 544KB - Virtual size: 544KB

.rdata
Size: 241KB - Virtual size: 241KB

.data
Size: 1024B - Virtual size: 37KB

.pdata
Size: 23KB - Virtual size: 22KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 900B