openvpn-gui-x64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
openvpn-gui-x64.zip
Size 591KB
Sample261113-bl45gaes7x
SHA256 c37f16119bf15fd85d0face946d81d17df726998e00c4ed1181c2b51652cd851
MD5 ad21a000b7ef63bae2772ea966d73758
SHA1 1898c25a8c573130ba6d1dc99a07840c7450e8a9
SHA512 755cc84e3683c5995e20546bada7b0198315b6f13e85a9cc43851f8d27e55dc04fc034a4515c902a1584ee9795689462d4dc5d0a911b8564a71d39e496e3e0d3
SSDEEP 12288:kyLaUUlzKpY0pVOv5TOcOWtHipADZ3zY+mAvn0oS6ywfJthIj1oPXFWNWwRXlHhy:kyLa3N+IMcMpCZ8tZo20JtGj1oPXFkRS
TLSH
T152D423CB48A9C42DA669F13479F61DC28A30D3C17A36067AB0BD4D56DF1B44E03DBA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/libopenvpn_plap.dll
unpack001/openvpn-gui.exe

File Explorer

openvpn-gui-x64.zip

.zip 591KB
libopenvpn_plap.dll

.dll 1.1MB
openvpn-gui.exe

.exe 1.0MB

openvpn-gui-x64.zip

SHA256 c37f16119bf15fd85d0face946d81d17df726998e00c4ed1181c2b51652cd851
MD5 ad21a000b7ef63bae2772ea966d73758
SHA1 1898c25a8c573130ba6d1dc99a07840c7450e8a9
SHA512 755cc84e3683c5995e20546bada7b0198315b6f13e85a9cc43851f8d27e55dc04fc034a4515c902a1584ee9795689462d4dc5d0a911b8564a71d39e496e3e0d3
SSDEEP 12288:kyLaUUlzKpY0pVOv5TOcOWtHipADZ3zY+mAvn0oS6ywfJthIj1oPXFWNWwRXlHhy:kyLa3N+IMcMpCZ8tZo20JtGj1oPXFkRS
TLSH
T152D423CB48A9C42DA669F13479F61DC28A30D3C17A36067AB0BD4D56DF1B44E03DBA1B
MD5 SHA1 SHA512 SSDEEP TLSH

libopenvpn_plap.dll

IMPHASH 399426b55f2a4af74d216c8a2f1eb4bb
SHA256 f9fe6e8dd4d9f71fc01166bed4013ab18e7ca3568543716b4f900bc217ae3c0e
MD5 2b5ddff27b877f1d4d15ba0bb42f7aa1
SHA1 67260bea1df0e161a75b0181f4c4e6b7f14c8079
SHA512 6d580fe6a574d28d1c0e69d5b69eeb5d761dc8437c3eb77b13c7fa2e2cf0069d34ba0e40b42f00a81962dd82b06d7a180611ee67bc218a1f127a86592dc11732
SSDEEP 6144:7sgWjNf4aRuMqldCD4f//K6ky4hbS8oDJpOHXothEcBKn3TjBtmYiERi461:4gWJf9RuMP4n/K6D0bSRSGQvBtmUi4
TLSH
T1E6352D81A3F98214FDF36B34DD7A465E5A37BC815A30CABE5254315E0972AB0D838B37
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

134048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ws2_32

inet_addr inet_ntoa InetPtonW ntohs closesocket getsockname bind WSAAsyncSelect WSACleanup WSAStartup socket send recv ioctlsocket connect htons

comctl32

ord345 InitMUILanguage

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpDetectAutoProxyConfigUrl WinHttpCloseHandle WinHttpOpen

crypt32

CertCreateCertificateContext CryptBinaryToStringA CryptStringToBinaryA CertGetNameStringW CertFreeCertificateContext

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree CoTaskMemAlloc

shlwapi

StrTrimA PathIsRelativeW PathAddBackslashW PathCombineW SHStrDupW

gdi32

SelectObject GetStockObject GetDeviceCaps GetTextExtentPoint32W SetTextColor LPtoDP CreateFontIndirectW DeleteObject GetObjectW CreateCompatibleBitmap CreateCompatibleDC DeleteDC

cryptui

CryptUIDlgViewContext

rpcrt4

UuidToStringA RpcStringFreeA

iphlpapi

GetExtendedTcpTable

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader VerSetConditionMask NtQuerySystemInformation RtlNtStatusToDosError

kernel32

RaiseException LoadLibraryExW GetProcAddress FreeLibrary GetModuleHandleExW ExitProcess EncodePointer SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FileTimeToLocalFileTime FindResourceExW GetModuleFileNameW LoadResource SizeofResource FindResourceW EnumResourceLanguagesW FileTimeToSystemTime GetDateFormatW GetTimeFormatW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx Sleep CreateDirectoryW CreateFileW GetFileAttributesW GetFileInformationByHandle CloseHandle GetLastError ReleaseSemaphore WaitForSingleObject CreateSemaphoreW GetExitCodeProcess GetTickCount64 MulDiv WriteConsoleW MultiByteToWideChar WideCharToMultiByte GetStdHandle ReadFile ReadFileEx GetProcessHeap SetHandleInformation CreatePipe SetNamedPipeHandleState PeekNamedPipe CancelIo SetEvent CreateEventW GetCurrentProcessId TerminateProcess CreateThread GetCurrentThreadId TerminateThread ResumeThread CreateProcessW GetStartupInfoW OpenProcess GetTickCount GetNamedPipeServerProcessId VerifyVersionInfoW FindClose FindFirstFileW FindNextFileW ExpandEnvironmentStringsW GlobalFree GetWindowsDirectoryW OpenThread GetExitCodeThread GetModuleHandleW LoadLibraryW GetTempPathW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection DisableThreadLibraryCalls TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsValidCodePage GetACP HeapAlloc GetOEMCP GetCPInfo GetCommandLineA GetFileSizeEx SetFilePointerEx SetStdHandle ReadConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx HeapSize GetFileType WriteFile SetEndOfFile VirtualProtect CompareStringW LCMapStringW HeapReAlloc GetStringTypeW OutputDebugStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetTimeZoneInformation CopyFileW FindFirstFileExW HeapFree

user32

GetSysColor GetWindowRect GetClientRect GetWindowTextW SetWindowTextW RemovePropW GetPropW SetPropW InvalidateRect IsWindowEnabled EnableWindow KillTimer SetTimer SetFocus GetDlgCtrlID SetDlgItemTextW EndDialog SetWindowPos MoveWindow DestroyWindow CreateWindowExW DefWindowProcW PostMessageW LoadBitmapW IsDialogMessageW MessageBoxW GetWindowTextLengthW ReleaseDC GetDC SetForegroundWindow MsgWaitForMultipleObjectsEx keybd_event CallMsgFilterW GetDlgItemTextW PostQuitMessage PeekMessageW DispatchMessageW TranslateMessage LoadImageW CreateIconFromResourceEx LookupIconIdFromDirectory SetWindowLongPtrW MessageBoxExW GetSystemMetrics IsDlgButtonChecked CheckRadioButton GetDlgItem DialogBoxIndirectParamW CreateDialogIndirectParamW ShowWindow SendMessageW ShowWindowAsync GetWindowLongW FillRect AdjustWindowRectEx EnumThreadWindows SendInput DialogBoxParamW IsWindow GetDlgItemInt GetMessageW SetDlgItemInt SetDlgItemTextA

shell32

ShellExecuteExW ShellExecuteW SHCreateItemFromParsingName

advapi32

RegCloseKey RegDeleteValueW RegOpenKeyExW AllocateAndInitializeSid CheckTokenMembership FreeSid RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash InitializeSecurityDescriptor SetSecurityDescriptorDacl RegEnumKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW RegGetValueW RegCopyTreeW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceStatusEx StartServiceW RegCreateKeyExW

Name

.text

Size

291KB

Virtual Size

291KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

686KB

Virtual Size

685KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

openvpn-gui.exe

IMPHASH a97002e69e0c7f0ac8deedd4d2b2ff4f
SHA256 90dcb5e18c852ff53793f07a0842098a42e5ba1c2606a83111d5878ef348be8d
MD5 7ec56f14291d1bc8754af4ed33a491a7
SHA1 ab52c61a1bd789a929604d128680a14f56aabcc0
SHA512 f73b3fd5a252d8c943c81c50310e03e1a7f970748dab1809efe6a7c4c32700917432341c66469a31963a7d7e1a2a0ad96127b666e05122f18ae6fe11b30b6796
SSDEEP 6144:3dSXYLINyINHJl715Je7k5xrbWxe+Ntz8pJyD3jxz5BKn3Tj5tmYiERi4q1:8XY8oAH7VQk55bqe+NWGTxvQv5tmUi4
TLSH
T102357F01B3FA8118F5F3AB349DB646526E37BC815A30CA8F52A5715E0A72E90DD74B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

164448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\openvpn-gui-custom\openvpn-gui-custom\out\build\x64\Release\openvpn-gui.pdb

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

netapi32

NetApiBufferFree NetLocalGroupGetMembers

ws2_32

inet_addr ntohs htons getsockname bind WSAAsyncSelect WSACleanup WSAStartup socket send recv ioctlsocket connect closesocket inet_ntoa InetPtonW

winhttp

WinHttpOpen WinHttpDetectAutoProxyConfigUrl WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle

secur32

GetUserNameExW

comctl32

PropertySheetW InitMUILanguage

crypt32

CertCreateCertificateContext CertFreeCertificateContext CryptStringToBinaryA CryptBinaryToStringA CryptUnprotectData CertGetNameStringW CryptProtectData

shlwapi

PathAddBackslashW StrTrimA PathIsRelativeW PathCombineW PathCanonicalizeW UrlUnescapeA

advapi32

RegisterEventSourceW CryptGetHashParam CryptReleaseContext CryptAcquireContextW ReportEventW FreeSid CheckTokenMembership AllocateAndInitializeSid RegGetValueW RegSetKeyValueW RegDeleteKeyValueW DeregisterEventSource RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupAccountNameW LookupAccountSidW GetTokenInformation EqualSid CreateWellKnownSid CopySid StartServiceW QueryServiceStatusEx QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle RegCopyTreeW RegDeleteTreeW RegSetValueExW OpenProcessToken CryptCreateHash CryptHashData CryptDestroyHash InitializeSecurityDescriptor CryptGenRandom SetSecurityDescriptorDacl RegEnumKeyExW RegQueryValueExW

shell32

Shell_NotifyIconW SHAppBarMessage SHCreateItemFromParsingName ShellExecuteW Shell_NotifyIconGetRect ShellExecuteExW

gdi32

GetDeviceCaps DeleteDC DeleteObject GetPixel SetTextColor SetPixel CreateFontIndirectW GetObjectW CreateCompatibleBitmap LPtoDP GetStockObject SelectObject GetTextExtentPoint32W CreateCompatibleDC

comdlg32

GetOpenFileNameW

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree

cryptui

CryptUIDlgViewContext

wininet

HttpQueryInfoW HttpOpenRequestW InternetSetOptionW InternetSetOptionA InternetReadFile InternetCloseHandle HttpSendRequestW InternetConnectW HttpQueryInfoA InternetOpenW

iphlpapi

GetExtendedTcpTable

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader NtQuerySystemInformation RtlNtStatusToDosError VerSetConditionMask

kernel32

TlsFree LoadLibraryExW EncodePointer RaiseException ExitProcess GetModuleHandleExW GetDriveTypeW GetFileType SystemTimeToTzSpecificLocalTime DeleteFileW WriteConsoleW HeapFree HeapAlloc HeapReAlloc FlsAlloc FlsGetValue TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetStringTypeW GetCurrentDirectoryW GetFullPathNameW SetStdHandle GetConsoleOutputCP HeapSize ReadConsoleW FlushFileBuffers GetTimeZoneInformation GetProcessHeap GetConsoleMode SetEndOfFile SetLastError IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter OutputDebugStringW GetFileSizeEx SetNamedPipeHandleState SetEnvironmentVariableW GetCommandLineA GetCPInfo GetOEMCP CloseHandle GetLastError ReleaseSemaphore WaitForSingleObject GetCurrentProcess GetSystemDirectoryW MulDiv GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal FileTimeToLocalFileTime FindResourceExW GetModuleFileNameW LoadResource SizeofResource FindResourceW EnumResourceLanguagesW FileTimeToSystemTime GetDateFormatW GetTimeFormatW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetCommandLineW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW VerifyVersionInfoW Sleep CreateDirectoryW CreateFileW GetFileAttributesW GetFileInformationByHandle CreateSemaphoreW GetExitCodeProcess GetTickCount64 CopyFileW MultiByteToWideChar WideCharToMultiByte GetStdHandle ReadFile ReadFileEx WriteFile SetHandleInformation CreatePipe PeekNamedPipe CancelIo SetEvent CreateEventW GetCurrentProcessId TerminateProcess CreateThread GetCurrentThreadId TerminateThread ResumeThread CreateProcessW GetStartupInfoW OpenProcess GetTickCount GetNamedPipeServerProcessId FindClose FindFirstFileW FindNextFileW ExpandEnvironmentStringsW GlobalFree GetWindowsDirectoryW LocalFree GetTempPathW FormatMessageW FindFirstFileExW IsValidCodePage GetACP SetFilePointerEx

user32

LookupIconIdFromDirectory CreateIconFromResourceEx LoadImageW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW IsWindow DestroyWindow SetDlgItemTextW GetDlgItemTextW SetTimer KillTimer GetMenuItemID GetMenuInfo FindWindowW LoadCursorW PeekMessageW SetDlgItemTextA CallMsgFilterW keybd_event MsgWaitForMultipleObjectsEx GetDC ReleaseDC GetWindowTextLengthW IsDialogMessageW HideCaret MoveWindow SetWindowLongPtrW GetDlgCtrlID SetFocus EnableWindow IsWindowEnabled SetPropW GetPropW RemovePropW GetWindowTextW GetClientRect GetSysColor EnumThreadWindows SetDlgItemInt GetDlgItemInt CreatePopupMenu DestroyMenu CheckMenuItem EnableMenuItem AppendMenuW SetMenuItemBitmaps TrackPopupMenu SetMenuInfo GetIconInfo SetCursor DialogBoxParamW SendInput AdjustWindowRectEx FillRect GetWindowRect MessageBoxW SetForegroundWindow SetWindowTextW InvalidateRect GetSystemMetrics IsDlgButtonChecked MessageBoxExW CheckRadioButton DialogBoxIndirectParamW CreateDialogIndirectParamW SetWindowLongW GetWindowLongW OffsetRect EndDialog GetDlgItem ShowCaret SetWindowPos ShowWindowAsync ShowWindow SendMessageTimeoutW PostMessageW SendMessageW

Name

.text

Size

325KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

601KB

Virtual Size

601KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

openvpn-gui-x64.zip

libopenvpn_plap.dll

ws2_32

comctl32

winhttp

crypt32

ole32

shlwapi

gdi32

cryptui

rpcrt4

iphlpapi

ntdll

kernel32

user32

shell32

advapi32

generic

openvpn-gui.exe

wtsapi32

netapi32

ws2_32

winhttp

secur32

comctl32

crypt32

shlwapi

advapi32

shell32

gdi32

comdlg32

ole32

cryptui

wininet

iphlpapi

ntdll

kernel32

user32

generic