openvpn-gui-x64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
openvpn-gui-x64.zip
Size 591KB
Sample261113-bl7klaes71
SHA256 6a9ff5d0ca9080dee4120ebf5cd61bb382ffa7f6e360f16b8676a20c6b4c4e7e
MD5 14f19f9892be0f14dcc5c5a55bf2e9aa
SHA1 d57737c892bacfeeb645abc9f884029415a047fc
SHA512 df4faf4a67c9f1b125a2ff14ddeb18c91daf95feb5c851338d803e1a83323ad56e756c233ee2bd4e3bcf237106cfd3a444ddeb83205728efb6f0cffa6014ffdc
SSDEEP 12288:N2XDJP57rnpCCeMe20qBxq6eyR0smL/qgY13DJefvGqsJjPRQOXVXNF7V:AFB7DpKMJ0qBxNarigyDJeHGqsJmqV9
TLSH
T16DD423F45883C9000C1E63147AEEFD012398A1EEE831A43777316AECD726A5FF5DA959
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/libopenvpn_plap.dll
unpack001/openvpn-gui.exe

File Explorer

openvpn-gui-x64.zip

.zip 591KB
libopenvpn_plap.dll

.dll 1.1MB
openvpn-gui.exe

.exe 1.0MB

openvpn-gui-x64.zip

SHA256 6a9ff5d0ca9080dee4120ebf5cd61bb382ffa7f6e360f16b8676a20c6b4c4e7e
MD5 14f19f9892be0f14dcc5c5a55bf2e9aa
SHA1 d57737c892bacfeeb645abc9f884029415a047fc
SHA512 df4faf4a67c9f1b125a2ff14ddeb18c91daf95feb5c851338d803e1a83323ad56e756c233ee2bd4e3bcf237106cfd3a444ddeb83205728efb6f0cffa6014ffdc
SSDEEP 12288:N2XDJP57rnpCCeMe20qBxq6eyR0smL/qgY13DJefvGqsJjPRQOXVXNF7V:AFB7DpKMJ0qBxNarigyDJeHGqsJmqV9
TLSH
T16DD423F45883C9000C1E63147AEEFD012398A1EEE831A43777316AECD726A5FF5DA959
MD5 SHA1 SHA512 SSDEEP TLSH

libopenvpn_plap.dll

IMPHASH 399426b55f2a4af74d216c8a2f1eb4bb
SHA256 ca26587975cc9062fd7218436d075589b628f0411e9b46ca32f7a097bb5f59d3
MD5 da5c0bb80187e26c220a5a8add6dc64e
SHA1 46c5b4fbcf242b4815edc6aafce335a7500119d8
SHA512 16c5c769f1968907636de8dd0314a0f290357124fbda006b6ce3df8bfb262b0f2dbaaebe1da78bf5c10738286ea9ced6cdc02bf93353802a22d3ac2c04b3f6a0
SSDEEP 6144:OsgWjNf4aRuMqldCD4f//K6ky4hbS8oDcpOHXothEcBKn3TjBtmYiERi461:lgWJf9RuMP4n/K6D0bS0SGQvBtmUi4
TLSH
T138352D81A3F98214FDF36B34DD7A465E5A37BC815A30CABE5254315E0972AB0D838B37
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

134048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ws2_32

inet_addr inet_ntoa InetPtonW ntohs closesocket getsockname bind WSAAsyncSelect WSACleanup WSAStartup socket send recv ioctlsocket connect htons

comctl32

ord345 InitMUILanguage

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpDetectAutoProxyConfigUrl WinHttpCloseHandle WinHttpOpen

crypt32

CertCreateCertificateContext CryptBinaryToStringA CryptStringToBinaryA CertGetNameStringW CertFreeCertificateContext

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree CoTaskMemAlloc

shlwapi

StrTrimA PathIsRelativeW PathAddBackslashW PathCombineW SHStrDupW

gdi32

SelectObject GetStockObject GetDeviceCaps GetTextExtentPoint32W SetTextColor LPtoDP CreateFontIndirectW DeleteObject GetObjectW CreateCompatibleBitmap CreateCompatibleDC DeleteDC

cryptui

CryptUIDlgViewContext

rpcrt4

UuidToStringA RpcStringFreeA

iphlpapi

GetExtendedTcpTable

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader VerSetConditionMask NtQuerySystemInformation RtlNtStatusToDosError

kernel32

RaiseException LoadLibraryExW GetProcAddress FreeLibrary GetModuleHandleExW ExitProcess EncodePointer SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FileTimeToLocalFileTime FindResourceExW GetModuleFileNameW LoadResource SizeofResource FindResourceW EnumResourceLanguagesW FileTimeToSystemTime GetDateFormatW GetTimeFormatW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx Sleep CreateDirectoryW CreateFileW GetFileAttributesW GetFileInformationByHandle CloseHandle GetLastError ReleaseSemaphore WaitForSingleObject CreateSemaphoreW GetExitCodeProcess GetTickCount64 MulDiv WriteConsoleW MultiByteToWideChar WideCharToMultiByte GetStdHandle ReadFile ReadFileEx GetProcessHeap SetHandleInformation CreatePipe SetNamedPipeHandleState PeekNamedPipe CancelIo SetEvent CreateEventW GetCurrentProcessId TerminateProcess CreateThread GetCurrentThreadId TerminateThread ResumeThread CreateProcessW GetStartupInfoW OpenProcess GetTickCount GetNamedPipeServerProcessId VerifyVersionInfoW FindClose FindFirstFileW FindNextFileW ExpandEnvironmentStringsW GlobalFree GetWindowsDirectoryW OpenThread GetExitCodeThread GetModuleHandleW LoadLibraryW GetTempPathW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection DisableThreadLibraryCalls TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsValidCodePage GetACP HeapAlloc GetOEMCP GetCPInfo GetCommandLineA GetFileSizeEx SetFilePointerEx SetStdHandle ReadConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx HeapSize GetFileType WriteFile SetEndOfFile VirtualProtect CompareStringW LCMapStringW HeapReAlloc GetStringTypeW OutputDebugStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetTimeZoneInformation CopyFileW FindFirstFileExW HeapFree

user32

GetSysColor GetWindowRect GetClientRect GetWindowTextW SetWindowTextW RemovePropW GetPropW SetPropW InvalidateRect IsWindowEnabled EnableWindow KillTimer SetTimer SetFocus GetDlgCtrlID SetDlgItemTextW EndDialog SetWindowPos MoveWindow DestroyWindow CreateWindowExW DefWindowProcW PostMessageW LoadBitmapW IsDialogMessageW MessageBoxW GetWindowTextLengthW ReleaseDC GetDC SetForegroundWindow MsgWaitForMultipleObjectsEx keybd_event CallMsgFilterW GetDlgItemTextW PostQuitMessage PeekMessageW DispatchMessageW TranslateMessage LoadImageW CreateIconFromResourceEx LookupIconIdFromDirectory SetWindowLongPtrW MessageBoxExW GetSystemMetrics IsDlgButtonChecked CheckRadioButton GetDlgItem DialogBoxIndirectParamW CreateDialogIndirectParamW ShowWindow SendMessageW ShowWindowAsync GetWindowLongW FillRect AdjustWindowRectEx EnumThreadWindows SendInput DialogBoxParamW IsWindow GetDlgItemInt GetMessageW SetDlgItemInt SetDlgItemTextA

shell32

ShellExecuteExW ShellExecuteW SHCreateItemFromParsingName

advapi32

RegCloseKey RegDeleteValueW RegOpenKeyExW AllocateAndInitializeSid CheckTokenMembership FreeSid RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash InitializeSecurityDescriptor SetSecurityDescriptorDacl RegEnumKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW RegGetValueW RegCopyTreeW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceStatusEx StartServiceW RegCreateKeyExW

Name

.text

Size

291KB

Virtual Size

291KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

686KB

Virtual Size

685KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

openvpn-gui.exe

IMPHASH a97002e69e0c7f0ac8deedd4d2b2ff4f
SHA256 6ebcd7961826b70ee73344cd6adce2c83e1e6869ebdc05aaf8996e69a6bc6334
MD5 92772ebc90694c90a9fb751855fbed3b
SHA1 06fd12c4eea87b1f75701775af50817db42fa043
SHA512 78beec44e631d2f49e31a85239ba926c6c3e948d23f17cca0a75d282ef6f8da01ca08808da120a3b481badd0f3dbc642dfcef1c1866b473a1873e790a2021bce
SSDEEP 6144:jdSXYLINyINHJl715Je7k5xrbWxe+NtznpJyD3jxz5BKn3Tj5tmYiERi4q1:gXY8oAH7VQk55bqe+NBGTxvQv5tmUi4
TLSH
T1F8357F01B3FA8118F5F3AB349DB646526E37BC815A30CA8F52A5715E0A72E90DD74B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

164448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\openvpn-gui-custom\openvpn-gui-custom\out\build\x64\Release\openvpn-gui.pdb

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

netapi32

NetApiBufferFree NetLocalGroupGetMembers

ws2_32

inet_addr ntohs htons getsockname bind WSAAsyncSelect WSACleanup WSAStartup socket send recv ioctlsocket connect closesocket inet_ntoa InetPtonW

winhttp

WinHttpOpen WinHttpDetectAutoProxyConfigUrl WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle

secur32

GetUserNameExW

comctl32

PropertySheetW InitMUILanguage

crypt32

CertCreateCertificateContext CertFreeCertificateContext CryptStringToBinaryA CryptBinaryToStringA CryptUnprotectData CertGetNameStringW CryptProtectData

shlwapi

PathAddBackslashW StrTrimA PathIsRelativeW PathCombineW PathCanonicalizeW UrlUnescapeA

advapi32

RegisterEventSourceW CryptGetHashParam CryptReleaseContext CryptAcquireContextW ReportEventW FreeSid CheckTokenMembership AllocateAndInitializeSid RegGetValueW RegSetKeyValueW RegDeleteKeyValueW DeregisterEventSource RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupAccountNameW LookupAccountSidW GetTokenInformation EqualSid CreateWellKnownSid CopySid StartServiceW QueryServiceStatusEx QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle RegCopyTreeW RegDeleteTreeW RegSetValueExW OpenProcessToken CryptCreateHash CryptHashData CryptDestroyHash InitializeSecurityDescriptor CryptGenRandom SetSecurityDescriptorDacl RegEnumKeyExW RegQueryValueExW

shell32

Shell_NotifyIconW SHAppBarMessage SHCreateItemFromParsingName ShellExecuteW Shell_NotifyIconGetRect ShellExecuteExW

gdi32

GetDeviceCaps DeleteDC DeleteObject GetPixel SetTextColor SetPixel CreateFontIndirectW GetObjectW CreateCompatibleBitmap LPtoDP GetStockObject SelectObject GetTextExtentPoint32W CreateCompatibleDC

comdlg32

GetOpenFileNameW

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree

cryptui

CryptUIDlgViewContext

wininet

HttpQueryInfoW HttpOpenRequestW InternetSetOptionW InternetSetOptionA InternetReadFile InternetCloseHandle HttpSendRequestW InternetConnectW HttpQueryInfoA InternetOpenW

iphlpapi

GetExtendedTcpTable

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader NtQuerySystemInformation RtlNtStatusToDosError VerSetConditionMask

kernel32

TlsFree LoadLibraryExW EncodePointer RaiseException ExitProcess GetModuleHandleExW GetDriveTypeW GetFileType SystemTimeToTzSpecificLocalTime DeleteFileW WriteConsoleW HeapFree HeapAlloc HeapReAlloc FlsAlloc FlsGetValue TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetStringTypeW GetCurrentDirectoryW GetFullPathNameW SetStdHandle GetConsoleOutputCP HeapSize ReadConsoleW FlushFileBuffers GetTimeZoneInformation GetProcessHeap GetConsoleMode SetEndOfFile SetLastError IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter OutputDebugStringW GetFileSizeEx SetNamedPipeHandleState SetEnvironmentVariableW GetCommandLineA GetCPInfo GetOEMCP CloseHandle GetLastError ReleaseSemaphore WaitForSingleObject GetCurrentProcess GetSystemDirectoryW MulDiv GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal FileTimeToLocalFileTime FindResourceExW GetModuleFileNameW LoadResource SizeofResource FindResourceW EnumResourceLanguagesW FileTimeToSystemTime GetDateFormatW GetTimeFormatW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetCommandLineW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW VerifyVersionInfoW Sleep CreateDirectoryW CreateFileW GetFileAttributesW GetFileInformationByHandle CreateSemaphoreW GetExitCodeProcess GetTickCount64 CopyFileW MultiByteToWideChar WideCharToMultiByte GetStdHandle ReadFile ReadFileEx WriteFile SetHandleInformation CreatePipe PeekNamedPipe CancelIo SetEvent CreateEventW GetCurrentProcessId TerminateProcess CreateThread GetCurrentThreadId TerminateThread ResumeThread CreateProcessW GetStartupInfoW OpenProcess GetTickCount GetNamedPipeServerProcessId FindClose FindFirstFileW FindNextFileW ExpandEnvironmentStringsW GlobalFree GetWindowsDirectoryW LocalFree GetTempPathW FormatMessageW FindFirstFileExW IsValidCodePage GetACP SetFilePointerEx

user32

LookupIconIdFromDirectory CreateIconFromResourceEx LoadImageW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW IsWindow DestroyWindow SetDlgItemTextW GetDlgItemTextW SetTimer KillTimer GetMenuItemID GetMenuInfo FindWindowW LoadCursorW PeekMessageW SetDlgItemTextA CallMsgFilterW keybd_event MsgWaitForMultipleObjectsEx GetDC ReleaseDC GetWindowTextLengthW IsDialogMessageW HideCaret MoveWindow SetWindowLongPtrW GetDlgCtrlID SetFocus EnableWindow IsWindowEnabled SetPropW GetPropW RemovePropW GetWindowTextW GetClientRect GetSysColor EnumThreadWindows SetDlgItemInt GetDlgItemInt CreatePopupMenu DestroyMenu CheckMenuItem EnableMenuItem AppendMenuW SetMenuItemBitmaps TrackPopupMenu SetMenuInfo GetIconInfo SetCursor DialogBoxParamW SendInput AdjustWindowRectEx FillRect GetWindowRect MessageBoxW SetForegroundWindow SetWindowTextW InvalidateRect GetSystemMetrics IsDlgButtonChecked MessageBoxExW CheckRadioButton DialogBoxIndirectParamW CreateDialogIndirectParamW SetWindowLongW GetWindowLongW OffsetRect EndDialog GetDlgItem ShowCaret SetWindowPos ShowWindowAsync ShowWindow SendMessageTimeoutW PostMessageW SendMessageW

Name

.text

Size

325KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

601KB

Virtual Size

601KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

openvpn-gui-x64.zip

libopenvpn_plap.dll

ws2_32

comctl32

winhttp

crypt32

ole32

shlwapi

gdi32

cryptui

rpcrt4

iphlpapi

ntdll

kernel32

user32

shell32

advapi32

generic

openvpn-gui.exe

wtsapi32

netapi32

ws2_32

winhttp

secur32

comctl32

crypt32

shlwapi

advapi32

shell32

gdi32

comdlg32

ole32

cryptui

wininet

iphlpapi

ntdll

kernel32

user32

generic