openvpn-gui-x86[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
openvpn-gui-x86.zip
Size 555KB
Sample261113-bl4hyaes7w
SHA256 8d5e3d2d2086701b56813b7cbb026d501eb6d9a3f6da423b6e47f2cb7cbe690a
MD5 f5dcc672d35a9af7b92dbace0dba13fe
SHA1 f4f0af49dacb648bf86c147856c2b00fd03c3fc7
SHA512 892f236c423cd4a88eb3bd88cd5d3f349e60afc5c5ee493a2be057734c4e50e4b57cb7a5f527b66593bd6712aeeb332735f25246503e93747df568008bc3670f
SSDEEP 12288:Xa/oFM6G/3jJSpuSeUWS5HXXH1DmtG4s6YLhVY:Xq20/3IppeU/n1Dmk4s6Y9u
TLSH
T1DAC423C3FC7AE9C406F8B95E68CC292DDB536E9A2C1A15A7C7BA54D8E4113DE9143E00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/libopenvpn_plap.dll
unpack001/openvpn-gui.exe

File Explorer

openvpn-gui-x86.zip

.zip 555KB
libopenvpn_plap.dll

.dll 1.0MB
openvpn-gui.exe

.exe 979KB

openvpn-gui-x86.zip

SHA256 8d5e3d2d2086701b56813b7cbb026d501eb6d9a3f6da423b6e47f2cb7cbe690a
MD5 f5dcc672d35a9af7b92dbace0dba13fe
SHA1 f4f0af49dacb648bf86c147856c2b00fd03c3fc7
SHA512 892f236c423cd4a88eb3bd88cd5d3f349e60afc5c5ee493a2be057734c4e50e4b57cb7a5f527b66593bd6712aeeb332735f25246503e93747df568008bc3670f
SSDEEP 12288:Xa/oFM6G/3jJSpuSeUWS5HXXH1DmtG4s6YLhVY:Xq20/3IppeU/n1Dmk4s6Y9u
TLSH
T1DAC423C3FC7AE9C406F8B95E68CC292DDB536E9A2C1A15A7C7BA54D8E4113DE9143E00
MD5 SHA1 SHA512 SSDEEP TLSH

libopenvpn_plap.dll

IMPHASH b4b18f684d831fe60923c5e85dd49963
SHA256 ac619d508c18d5d118b8b32d5dab0e32064dfc28e08e57c3a734febfb3788fc7
MD5 8426939ca45d82c6be2b8533720dc187
SHA1 a6bc162bb9eafb1aed81ebf1c4ea31812e07ca16
SHA512 357a9ba3a82189a079ffe7b3b5fbf06599f3bf2b5515f0bf9c5f886ac6a6eeaf3c349686b9a6a0c18094022c95a34db33bccab9103bd087ed6c91d5a4fb26239
SSDEEP 12288:h2beAtzVdlVYLrnNDr4bCGQvBtmUi4aVam6:OeABcnNQbO8Vam
TLSH
T19D25508062F48214FDF32B34DDBA465D1E3BBC915A30CABE5295715E0971AB0D938B3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

send WSAAsyncSelect bind getsockname WSAStartup socket recv ioctlsocket connect WSACleanup closesocket htons inet_addr inet_ntoa InetPtonW ntohs

comctl32

ord345 InitMUILanguage

winhttp

WinHttpOpen WinHttpDetectAutoProxyConfigUrl WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle

crypt32

CertCreateCertificateContext CryptBinaryToStringA CryptStringToBinaryA CertGetNameStringW CertFreeCertificateContext

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree CoTaskMemAlloc

shlwapi

StrTrimA PathIsRelativeW PathAddBackslashW PathCombineW SHStrDupW

gdi32

SelectObject GetStockObject GetDeviceCaps GetTextExtentPoint32W SetTextColor LPtoDP CreateFontIndirectW DeleteObject GetObjectW CreateCompatibleBitmap CreateCompatibleDC DeleteDC

cryptui

CryptUIDlgViewContext

rpcrt4

UuidToStringA RpcStringFreeA

iphlpapi

GetExtendedTcpTable

ntdll

VerSetConditionMask NtQuerySystemInformation RtlNtStatusToDosError RtlUnwind

kernel32

HeapFree WriteConsoleW GetFileType GetModuleHandleExW FlsAlloc HeapAlloc LCMapStringW CompareStringW VirtualProtect FileTimeToLocalFileTime FindResourceExW GetModuleFileNameW LoadResource SizeofResource FindResourceW EnumResourceLanguagesW FileTimeToSystemTime GetDateFormatW GetTimeFormatW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx Sleep CreateDirectoryW CreateFileW GetFileAttributesW GetFileInformationByHandle CloseHandle GetLastError ReleaseSemaphore WaitForSingleObject CreateSemaphoreW GetExitCodeProcess GetTickCount64 MulDiv FlsSetValue MultiByteToWideChar WideCharToMultiByte GetStdHandle ReadFile ReadFileEx WriteFile CreatePipe SetNamedPipeHandleState PeekNamedPipe CancelIo SetEvent CreateEventW GetCurrentProcessId TerminateProcess CreateThread GetCurrentThreadId TerminateThread ResumeThread CreateProcessW GetStartupInfoW OpenProcess GetTickCount GetNamedPipeServerProcessId VerifyVersionInfoW FindClose FindFirstFileW FindNextFileW ExpandEnvironmentStringsW GlobalFree GetWindowsDirectoryW OpenThread GetExitCodeThread GetModuleHandleW LoadLibraryW GetTempPathW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection DisableThreadLibraryCalls ExitProcess RaiseException EncodePointer LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter HeapReAlloc GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetTimeZoneInformation FindFirstFileExW OutputDebugStringW FlsGetValue SetHandleInformation IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetFileSizeEx SetFilePointerEx SetStdHandle ReadConsoleW HeapSize SetEndOfFile CopyFileW DecodePointer InitializeCriticalSectionEx FlsFree

user32

GetSysColor GetWindowRect GetClientRect GetWindowTextW SetWindowTextW RemovePropW GetPropW SetPropW InvalidateRect IsWindowEnabled EnableWindow KillTimer SetTimer SetFocus GetDlgCtrlID SetDlgItemTextW EndDialog SetWindowPos MoveWindow DestroyWindow CreateWindowExW DefWindowProcW PostMessageW SetDlgItemInt IsDialogMessageW MessageBoxW GetWindowTextLengthW ReleaseDC GetDC SetForegroundWindow MsgWaitForMultipleObjectsEx keybd_event CallMsgFilterW GetDlgItemTextW SetDlgItemTextA PostQuitMessage PeekMessageW DispatchMessageW TranslateMessage LoadImageW CreateIconFromResourceEx LookupIconIdFromDirectory SetWindowLongW MessageBoxExW GetSystemMetrics IsDlgButtonChecked CheckRadioButton GetDlgItem DialogBoxIndirectParamW CreateDialogIndirectParamW ShowWindow SendMessageW LoadBitmapW ShowWindowAsync GetWindowLongW FillRect EnumThreadWindows AdjustWindowRectEx SendInput DialogBoxParamW IsWindow GetMessageW GetDlgItemInt

shell32

SHCreateItemFromParsingName ShellExecuteExW ShellExecuteW

advapi32

RegCloseKey RegDeleteValueW RegOpenKeyExW AllocateAndInitializeSid CheckTokenMembership FreeSid RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash InitializeSecurityDescriptor SetSecurityDescriptorDacl RegEnumKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW RegGetValueW RegCopyTreeW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceStatusEx StartServiceW RegCreateKeyExW

Name

.text

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

686KB

Virtual Size

685KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

openvpn-gui.exe

IMPHASH 7273a51da37efa137fa821c07c1bcf5e
SHA256 611892682cba79ff5307341725b4c39afc55d60aea7c82e53b8aa6975d85f79e
MD5 3b2758bcd8a20d3668893250aa7ed135
SHA1 14b42b6b4ef9a5d20e8a123ec5612949a6461ed5
SHA512 4084777165c61d0a1abe6ce5e69f3e5c2e9e663fdce5663eba210f5e4fe5d5d1be73332362fa4faaa6b7c507181e1f6bbff06c085b746e59c0035a1c1aa97e89
SSDEEP 12288:HkuJyScjDQlk/xtpmUgQHCii7SFvQv5tmUi4N38:mLdFCii7SFoj
TLSH
T1EC257F01B3FA8114F1F36B759DBA4AA25E3BBC915E30C98F6295315E1972E90D930B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\openvpn-gui-custom\openvpn-gui-custom\out\build\x86\Release\openvpn-gui.pdb

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

netapi32

NetLocalGroupGetMembers NetApiBufferFree

ws2_32

ioctlsocket connect closesocket WSAStartup send recv WSACleanup WSAAsyncSelect inet_addr inet_ntoa InetPtonW ntohs htons getsockname bind socket

winhttp

WinHttpDetectAutoProxyConfigUrl WinHttpOpen WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle

secur32

GetUserNameExW

comctl32

PropertySheetW InitMUILanguage

crypt32

CertCreateCertificateContext CertFreeCertificateContext CryptStringToBinaryA CryptBinaryToStringA CryptUnprotectData CertGetNameStringW CryptProtectData

shlwapi

PathAddBackslashW StrTrimA PathIsRelativeW PathCombineW PathCanonicalizeW UrlUnescapeA

advapi32

RegisterEventSourceW CryptGetHashParam CryptReleaseContext CryptAcquireContextW ReportEventW FreeSid CheckTokenMembership AllocateAndInitializeSid RegGetValueW RegSetKeyValueW RegDeleteKeyValueW DeregisterEventSource RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupAccountNameW LookupAccountSidW GetTokenInformation EqualSid CreateWellKnownSid CopySid StartServiceW QueryServiceStatusEx QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle RegCopyTreeW RegDeleteTreeW RegSetValueExW OpenProcessToken CryptCreateHash CryptHashData CryptDestroyHash InitializeSecurityDescriptor CryptGenRandom SetSecurityDescriptorDacl RegEnumKeyExW RegQueryValueExW

shell32

ShellExecuteW SHAppBarMessage Shell_NotifyIconW ShellExecuteExW SHCreateItemFromParsingName Shell_NotifyIconGetRect

gdi32

GetDeviceCaps DeleteDC DeleteObject GetPixel SetTextColor SetPixel CreateFontIndirectW GetObjectW CreateCompatibleBitmap LPtoDP GetStockObject SelectObject GetTextExtentPoint32W CreateCompatibleDC

comdlg32

GetOpenFileNameW

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoTaskMemFree

cryptui

CryptUIDlgViewContext

wininet

InternetConnectW InternetReadFile InternetSetOptionA InternetSetOptionW HttpOpenRequestW InternetOpenW HttpQueryInfoA HttpQueryInfoW HttpSendRequestW InternetCloseHandle

iphlpapi

GetExtendedTcpTable

ntdll

VerSetConditionMask RtlNtStatusToDosError RtlUnwind NtQuerySystemInformation

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetStringTypeW GetCurrentDirectoryW GetFullPathNameW HeapReAlloc HeapAlloc HeapFree WriteConsoleW DeleteFileW SystemTimeToTzSpecificLocalTime SetStdHandle GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx OutputDebugStringW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA SetEnvironmentVariableW GetProcessHeap GetTimeZoneInformation FlushFileBuffers GetFileType GetDriveTypeW GetModuleHandleExW ExitProcess RaiseException ReadConsoleW HeapSize EncodePointer LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError SetEndOfFile SetHandleInformation IsDebuggerPresent InitializeSListHead CloseHandle GetLastError ReleaseSemaphore WaitForSingleObject GetCurrentProcess GetSystemDirectoryW MulDiv GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal FileTimeToLocalFileTime FindResourceExW GetModuleFileNameW LoadResource SizeofResource FindResourceW EnumResourceLanguagesW FileTimeToSystemTime GetDateFormatW GetTimeFormatW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetCommandLineW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW VerifyVersionInfoW Sleep CreateDirectoryW CreateFileW GetFileAttributesW GetFileInformationByHandle CreateSemaphoreW GetExitCodeProcess GetTickCount64 CopyFileW MultiByteToWideChar WideCharToMultiByte GetStdHandle ReadFile ReadFileEx WriteFile DecodePointer CreatePipe SetNamedPipeHandleState PeekNamedPipe CancelIo SetEvent CreateEventW GetCurrentProcessId TerminateProcess CreateThread GetCurrentThreadId TerminateThread ResumeThread CreateProcessW GetStartupInfoW OpenProcess GetTickCount GetNamedPipeServerProcessId FindClose FindFirstFileW FindNextFileW ExpandEnvironmentStringsW GlobalFree GetWindowsDirectoryW LocalFree GetTempPathW FormatMessageW GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter

user32

LoadImageW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW IsWindow DestroyWindow SetDlgItemTextW GetDlgItemTextW SetTimer KillTimer GetMenuItemID GetMenuInfo FindWindowW LoadCursorW PeekMessageW SetDlgItemTextA CallMsgFilterW keybd_event MsgWaitForMultipleObjectsEx GetDC ReleaseDC GetWindowTextLengthW IsDialogMessageW PostMessageW MoveWindow OffsetRect GetDlgCtrlID CreateIconFromResourceEx EnableWindow IsWindowEnabled SetPropW GetPropW RemovePropW GetWindowTextW GetClientRect GetSysColor EnumThreadWindows SetDlgItemInt GetDlgItemInt CreatePopupMenu DestroyMenu CheckMenuItem EnableMenuItem AppendMenuW SetMenuItemBitmaps TrackPopupMenu SetMenuInfo GetIconInfo SetCursor DialogBoxParamW SendInput AdjustWindowRectEx FillRect ShowCaret HideCaret SendMessageTimeoutW SendMessageW MessageBoxW SetForegroundWindow GetWindowRect SetWindowTextW MessageBoxExW LookupIconIdFromDirectory IsDlgButtonChecked CheckRadioButton DialogBoxIndirectParamW CreateDialogIndirectParamW SetWindowLongW SetFocus GetWindowLongW InvalidateRect GetSystemMetrics GetDlgItem SetWindowPos ShowWindowAsync EndDialog ShowWindow

Name

.text

Size

284KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

601KB

Virtual Size

601KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

openvpn-gui-x86.zip

libopenvpn_plap.dll

ws2_32

comctl32

winhttp

crypt32

ole32

shlwapi

gdi32

cryptui

rpcrt4

iphlpapi

ntdll

kernel32

user32

shell32

advapi32

generic

openvpn-gui.exe

wtsapi32

netapi32

ws2_32

winhttp

secur32

comctl32

crypt32

shlwapi

advapi32

shell32

gdi32

comdlg32

ole32

cryptui

wininet

iphlpapi

ntdll

kernel32

user32

generic