Overview

overview

7

Static

static

3

gp_vpn_cli..._5.exe

windows7-x64

7

gp_vpn_cli..._5.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

bin/GPVPNService.exe

windows7-x64

1

bin/GPVPNService.exe

windows10-2004-x64

3

bin/Lizenz...en.pdf

windows7-x64

3

bin/Lizenz...en.pdf

windows10-2004-x64

3

bin/VpnClient.exe

windows7-x64

3

bin/VpnClient.exe

windows10-2004-x64

3

bin/X509_cert.dll

windows7-x64

3

bin/X509_cert.dll

windows10-2004-x64

3

bin/ipsec.exe

windows7-x64

3

bin/ipsec.exe

windows10-2004-x64

3

bin/libcklic.dll

windows7-x64

3

bin/libcklic.dll

windows10-2004-x64

3

bin/libeay32.dll

windows7-x64

3

bin/libeay32.dll

windows10-2004-x64

3

bin/libpkc...-1.dll

windows7-x64

3

bin/libpkc...-1.dll

windows10-2004-x64

3

bin/libssl32.dll

windows7-x64

3

bin/libssl32.dll

windows10-2004-x64

3

bin/openvpn.exe

windows7-x64

1

bin/openvpn.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    gp_vpn_client_v2_5.exe

  • Size

    4.2MB

  • MD5

    b23328c28d9de03ca46b890f8d9f0a8b

  • SHA1

    49754e127c8405030aca33056616c4654b2a2c49

  • SHA256

    384490be969abc3dbd130e8e19dbab3262db8003eea5c736636d91486083f3d9

  • SHA512

    84d2a35fe40ad62d0812d6a0c2e96794b1ba9f14644de833323609ebc62b28114acba8a8c174fa9333729224da7cc4cca85a593e66d8db4d4157144810bfab4e

  • SSDEEP

    49152:fMfKhjZwqK7i1ZjyOfC7XPUJRYYEcz4U+HDnMUmCE2Gx5TR17E9KbHSOc2cPMDCB:UfKLGaZA7/EIUiX1S5TR1IsbyOdcPMar

Score
3/10
pdflink

Malware Config

Signatures

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • Unsigned PE 17 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • gp_vpn_client_v2_5.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    7fa974366048f9c551ef45714595665e


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    a648aeaa164b592c1e8892a10400b5ae


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    afa8e526425f3585465337467d0b5909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    d83f71e61ee459ee63ca3e829966a9dc


    Headers

    Imports

    Exports

    Sections

  • bin/GPVPNService.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    56bc545ff131dd468a2f35ea14a03d02


    Headers

    Imports

    Sections

  • bin/Lizenzbedingungen.PDF
    .pdf

    Password: infected

    • http://Makefile.in

    • http://OpenLDAP.org

    • http://PopDel.py

    • http://abadonna.franken.de

    • http://acm.org

    • http://acme.com

    • http://alumni.caltech.edu

    • http://andrew.cmu.edu

    • http://apple.com

    • Show all
  • bin/VpnClient.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    54030e0a516c291d8dd19a63b5721f22


    Headers

    Imports

    Sections

  • bin/Vpn_gpcs.ico
  • bin/X509_cert.dll
    .dll windows:4 windows x86 arch:x86

    59d86017f388527e13ca57fb6b93ed8c


    Headers

    Imports

    Exports

    Sections

  • bin/ipsec.exe
    .exe windows:4 windows x86 arch:x86

    4a778fe85d9937496541164e662b47d6


    Headers

    Imports

    Sections

  • bin/language/Deutsch.lang
  • bin/language/English.lang
  • bin/language/Francais.lang
  • bin/language/Italiano.lang
  • bin/language/Nederlands.lang
  • bin/libcklic.dll
    .dll windows:4 windows x86 arch:x86

    fd9f5d71d0af22b38383649a75685ae2


    Headers

    Imports

    Exports

    Sections

  • bin/libeay32.dll
    .dll windows:4 windows x86 arch:x86

    5af07cc6c5b96153c023d496c3e85c34


    Headers

    Imports

    Exports

    Sections

  • bin/libpkcs11-helper-1.dll
    .dll windows:4 windows x86 arch:x86

    4d03c34bebc55eff949efdc1511a029f


    Headers

    Imports

    Exports

    Sections

  • bin/libssl32.dll
    .dll windows:4 windows x86 arch:x86

    4102a6eef85d5bc45424dc9080038ec5


    Headers

    Imports

    Exports

    Sections

  • bin/openvpn.exe
    .exe windows:4 windows x86 arch:x86

    5830f9c3dc334bd90addca8493238844


    Headers

    Imports

    Sections

  • bin/tapinstall.exe
    .exe windows:6 windows x64 arch:x64

    ce4a5cfcfb0452b87e013f07f4d59f9c


    Headers

    Imports

    Sections

  • driver/OemWin2k.inf
  • driver/tap0901.cat
  • driver/tap0901.sys
    .sys windows:6 windows x64 arch:x64

    5656451644eb67b677e2521bd39f7718


    Headers

    Imports

    Sections