General

  • Target

    openconnect-gui-1.5.3-win32.exe

  • Size

    22.6MB

  • MD5

    e7c6c332c837f5cfb6c358361002a2f5

  • SHA1

    83365898f0deb9ad86599ab3bad05cf2c0f9ab73

  • SHA256

    b1d4bd76b41f32d08287bf043b3dc8c798a145c02319217d45a74b0d9545a23d

  • SHA512

    2055a303ed6a40a0267203bc3c3d4ad14c86f7d690ab3cc85918ff0afc2103b1ca985e28f9e1efa92fb7b3cb41cd0add02aac9439a83b9b42e29e5bd01bff621

  • SSDEEP

    393216:hqontkN/S7+F4rxu30jgoM4EQQq2GJJvawfEWEjlSmZFY1ewMg16SNKltxSpmOQ:hqotkJ++uW0jvMSDJJ1fdg9HK7MCbNKN

Score
3/10

Malware Config

Signatures

  • Unsigned PE 32 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 6 IoCs

Files

  • openconnect-gui-1.5.3-win32.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    57e98d9a5a72c8d7ad8fb7a6a58b3daf


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    610235b90207a63ccf481f0d4375d329


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/NSIS.InstallOptions.ini
  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    17fb6a8708b9c0bb2d5d8687870eb415


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/UserInfo.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    cce05dea98cbac3a9d486b233588f528


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • Drivers/tap-windows.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    7fa974366048f9c551ef45714595665e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    b1cd0d78f652ce5fc63f0879371af012


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    2017f2acbdaa42ab3e4adeb8b4c37e7b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • bin/tapinstall.exe
    .exe windows:6 windows x64 arch:x64

    Password: infected

    59dfe5c9f961f1417775cd3a41a8be62


    Code Sign

    Headers

    Imports

    Sections

  • driver/OemVista.inf
  • driver/tap0901.cat
  • driver/tap0901.sys
    .sys windows:6 windows x64 arch:x64

    a13cebc938af36dab20cc614c6fb7e94


    Headers

    Imports

    Sections

  • Drivers/vcredist_x86.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    8e2588a9cf43886de3449dfff03137b6


    Code Sign

    Headers

    Imports

    Sections

  • LICENSE.txt
  • Qt5Core.dll
    .dll windows:4 windows x86 arch:x86

    47c1631253f0b0b93d12a277d92a0710


    Headers

    Imports

    Exports

    Sections

  • Qt5Gui.dll
    .dll windows:4 windows x86 arch:x86

    fef66c84d92eca00a5b895e0595a16da


    Headers

    Imports

    Exports

    Sections

  • Qt5Network.dll
    .dll windows:4 windows x86 arch:x86

    f2f3b1ca6603de49b920c9e8d8a592eb


    Headers

    Imports

    Exports

    Sections

  • Qt5Widgets.dll
    .dll windows:4 windows x86 arch:x86

    57b0245b08926f9b99d9030daf4fe1ae


    Headers

    Imports

    Exports

    Sections

  • Uninstall.exe
    .exe windows:4 windows x86 arch:x86

    57e98d9a5a72c8d7ad8fb7a6a58b3daf


    Headers

    Imports

    Sections

  • iconv.dll
    .dll windows:4 windows x86 arch:x86

    18af433a49fff3a611f0bb05b3e4a589


    Headers

    Imports

    Exports

    Sections

  • libffi-6.dll
    .dll windows:4 windows x86 arch:x86

    8678bcc2dbe18635fe86607fa227d775


    Headers

    Imports

    Exports

    Sections

  • libgcc_s_dw2-1.dll
    .dll windows:4 windows x86 arch:x86

    5a18b12e92e997d2ca370de96393cb7f


    Headers

    Imports

    Exports

    Sections

  • libgcc_s_sjlj-1.dll
    .dll windows:4 windows x86 arch:x86

    acf98f37c909d3e1d8941c3855a5dbd1


    Headers

    Imports

    Exports

    Sections

  • libgmp-10.dll
    .dll windows:4 windows x86 arch:x86

    ad83c523f93213d18ccd3d6841295b44


    Headers

    Imports

    Exports

    Sections

  • libgnutls-30.dll
    .dll windows:4 windows x86 arch:x86

    47a92f87a32f5ab60e5c510e65fd1fb2


    Headers

    Imports

    Exports

    Sections

  • libhogweed-4.dll
    .dll windows:4 windows x86 arch:x86

    1dc74852495addd20c3a2c4b2627fbbb


    Headers

    Imports

    Exports

    Sections

  • libnettle-6.dll
    .dll windows:4 windows x86 arch:x86

    f0cfccb715d995a51c58249b736e2d96


    Headers

    Imports

    Exports

    Sections

  • libopenconnect-5.dll
    .dll windows:4 windows x86 arch:x86

    59a55a64302f25a0432b9a67e68c32d2


    Headers

    Imports

    Exports

    Sections

  • libp11-kit-0.dll
    .dll windows:4 windows x86 arch:x86

    823b1a8f7850c1b05e09e09072d490d5


    Headers

    Imports

    Exports

    Sections

  • libstdc++-6.dll
    .dll windows:4 windows x86 arch:x86

    a510f8d03e357874fce2349915374c7a


    Headers

    Imports

    Exports

    Sections

  • libstoken-1.dll
    .dll windows:4 windows x86 arch:x86

    b0a6023e88b8e7ca01b518414d3e05c3


    Headers

    Imports

    Exports

    Sections

  • libtasn1-6.dll
    .dll windows:4 windows x86 arch:x86

    ed3648e1e27d4744c2324634ec5916b1


    Headers

    Imports

    Exports

    Sections

  • libwinpthread-1.dll
    .dll windows:4 windows x86 arch:x86

    e923b264e10de76cdc0f3fd9e04671bb


    Headers

    Imports

    Exports

    Sections

  • libxml2-2.dll
    .dll windows:4 windows x86 arch:x86

    e4746ae0b768f887efcee1307d84c4d2


    Headers

    Imports

    Exports

    Sections

  • openconnect-gui.exe
    .exe windows:4 windows x86 arch:x86

    32c87ab8fdccc7597663bcb4f546c0a5


    Headers

    Imports

    Sections

  • openconnect.exe
    .exe windows:4 windows x86 arch:x86

    7f72cd41999baf138457a383fb420035


    Headers

    Imports

    Sections

  • plugins/platforms/qwindows.dll
    .dll windows:4 windows x86 arch:x86

    ab7d98eec69f4b69e53aaa19a29fa3cc


    Headers

    Imports

    Exports

    Sections

  • plugins/styles/qwindowsvistastyle.dll
    .dll windows:4 windows x86 arch:x86

    bbd2b3c0906768eb832cc982da1ed8fd


    Headers

    Imports

    Exports

    Sections

  • qt.conf
  • vpnc-script-win.js
    .js
  • vpnc-script.js
    .js
  • zlib1.dll
    .dll windows:4 windows x86 arch:x86

    5ae8eab4351f05e72186efb3e23fd305


    Headers

    Imports

    Exports

    Sections