openvpn-gui-x86[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
openvpn-gui-x86.zip
Size 555KB
Sample261113-caf4yae14k
SHA256 89fe86fe0f59422d684a05bdc48d6e7a97cc43e2d6372edcc7ef61ad9288a336
MD5 36b7e67e15dc28ad60b0d7e63de9fa6d
SHA1 2d51340b70bd791282af52e47044776532d8d66b
SHA512 b5385836c67bffc38976c01faef89bfed01ecb24a142c55e54507369a975f2f3a813c893ade90e6506007fd9bc9b2dc098879f1e106a6c41b42039b1f742e44c
SSDEEP 12288:W6bKmOp3oCOQrVFqTL9mjqRjUWcDkSpNp57h8LqP9xEJ3THIw:WsKmOp3oPQBFe9mONUbkSTR2uEJ3THIw
TLSH
T1A8C423D4A7D1F291F46EB91A7D357C4E503680B891F2602333BCA4F06D97AADCFA44A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/libopenvpn_plap.dll
unpack001/openvpn-gui.exe

File Explorer

openvpn-gui-x86.zip

.zip 555KB
libopenvpn_plap.dll

.dll 1.0MB
openvpn-gui.exe

.exe 979KB

openvpn-gui-x86.zip

SHA256 89fe86fe0f59422d684a05bdc48d6e7a97cc43e2d6372edcc7ef61ad9288a336
MD5 36b7e67e15dc28ad60b0d7e63de9fa6d
SHA1 2d51340b70bd791282af52e47044776532d8d66b
SHA512 b5385836c67bffc38976c01faef89bfed01ecb24a142c55e54507369a975f2f3a813c893ade90e6506007fd9bc9b2dc098879f1e106a6c41b42039b1f742e44c
SSDEEP 12288:W6bKmOp3oCOQrVFqTL9mjqRjUWcDkSpNp57h8LqP9xEJ3THIw:WsKmOp3oPQBFe9mONUbkSTR2uEJ3THIw
TLSH
T1A8C423D4A7D1F291F46EB91A7D357C4E503680B891F2602333BCA4F06D97AADCFA44A0
MD5 SHA1 SHA512 SSDEEP TLSH

libopenvpn_plap.dll

IMPHASH b4b18f684d831fe60923c5e85dd49963
SHA256 c26c25a7c49a1fe706edd1ded8363056c9122041e3c79e791a0a69998693ad34
MD5 0250edee349dc5b7ff0251d093319012
SHA1 2366c9974123a63b361173a1c2624fed0aa69cc3
SHA512 ac08f8fd53835167ec91977de9c1b6dbea9b1864cd585a514e38e579b247476e322e591d9558c114089179f9343c24ce52d41253d7773bbd3fa8b477ac9fde50
SSDEEP 12288:N2beAtzVdlVYLrnNDf4bCGQvBtmUi4aVam6:KeABcnNcbO8Vam
TLSH
T12F25508062F48214FDF32B34DDBA465D1E3BBC915A30CABE5295715E0971AB0D938B3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

send WSAAsyncSelect bind getsockname WSAStartup socket recv ioctlsocket connect WSACleanup closesocket htons inet_addr inet_ntoa InetPtonW ntohs

comctl32

ord345 InitMUILanguage

winhttp

WinHttpOpen WinHttpDetectAutoProxyConfigUrl WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle

crypt32

CertCreateCertificateContext CryptBinaryToStringA CryptStringToBinaryA CertGetNameStringW CertFreeCertificateContext

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree CoTaskMemAlloc

shlwapi

StrTrimA PathIsRelativeW PathAddBackslashW PathCombineW SHStrDupW

gdi32

SelectObject GetStockObject GetDeviceCaps GetTextExtentPoint32W SetTextColor LPtoDP CreateFontIndirectW DeleteObject GetObjectW CreateCompatibleBitmap CreateCompatibleDC DeleteDC

cryptui

CryptUIDlgViewContext

rpcrt4

UuidToStringA RpcStringFreeA

iphlpapi

GetExtendedTcpTable

ntdll

VerSetConditionMask NtQuerySystemInformation RtlNtStatusToDosError RtlUnwind

kernel32

HeapFree WriteConsoleW GetFileType GetModuleHandleExW FlsAlloc HeapAlloc LCMapStringW CompareStringW VirtualProtect FileTimeToLocalFileTime FindResourceExW GetModuleFileNameW LoadResource SizeofResource FindResourceW EnumResourceLanguagesW FileTimeToSystemTime GetDateFormatW GetTimeFormatW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx Sleep CreateDirectoryW CreateFileW GetFileAttributesW GetFileInformationByHandle CloseHandle GetLastError ReleaseSemaphore WaitForSingleObject CreateSemaphoreW GetExitCodeProcess GetTickCount64 MulDiv FlsSetValue MultiByteToWideChar WideCharToMultiByte GetStdHandle ReadFile ReadFileEx WriteFile CreatePipe SetNamedPipeHandleState PeekNamedPipe CancelIo SetEvent CreateEventW GetCurrentProcessId TerminateProcess CreateThread GetCurrentThreadId TerminateThread ResumeThread CreateProcessW GetStartupInfoW OpenProcess GetTickCount GetNamedPipeServerProcessId VerifyVersionInfoW FindClose FindFirstFileW FindNextFileW ExpandEnvironmentStringsW GlobalFree GetWindowsDirectoryW OpenThread GetExitCodeThread GetModuleHandleW LoadLibraryW GetTempPathW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection DisableThreadLibraryCalls ExitProcess RaiseException EncodePointer LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter HeapReAlloc GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetTimeZoneInformation FindFirstFileExW OutputDebugStringW FlsGetValue SetHandleInformation IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetFileSizeEx SetFilePointerEx SetStdHandle ReadConsoleW HeapSize SetEndOfFile CopyFileW DecodePointer InitializeCriticalSectionEx FlsFree

user32

GetSysColor GetWindowRect GetClientRect GetWindowTextW SetWindowTextW RemovePropW GetPropW SetPropW InvalidateRect IsWindowEnabled EnableWindow KillTimer SetTimer SetFocus GetDlgCtrlID SetDlgItemTextW EndDialog SetWindowPos MoveWindow DestroyWindow CreateWindowExW DefWindowProcW PostMessageW SetDlgItemInt IsDialogMessageW MessageBoxW GetWindowTextLengthW ReleaseDC GetDC SetForegroundWindow MsgWaitForMultipleObjectsEx keybd_event CallMsgFilterW GetDlgItemTextW SetDlgItemTextA PostQuitMessage PeekMessageW DispatchMessageW TranslateMessage LoadImageW CreateIconFromResourceEx LookupIconIdFromDirectory SetWindowLongW MessageBoxExW GetSystemMetrics IsDlgButtonChecked CheckRadioButton GetDlgItem DialogBoxIndirectParamW CreateDialogIndirectParamW ShowWindow SendMessageW LoadBitmapW ShowWindowAsync GetWindowLongW FillRect EnumThreadWindows AdjustWindowRectEx SendInput DialogBoxParamW IsWindow GetMessageW GetDlgItemInt

shell32

SHCreateItemFromParsingName ShellExecuteExW ShellExecuteW

advapi32

RegCloseKey RegDeleteValueW RegOpenKeyExW AllocateAndInitializeSid CheckTokenMembership FreeSid RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash InitializeSecurityDescriptor SetSecurityDescriptorDacl RegEnumKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW RegGetValueW RegCopyTreeW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceStatusEx StartServiceW RegCreateKeyExW

Name

.text

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

686KB

Virtual Size

685KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

openvpn-gui.exe

IMPHASH 7273a51da37efa137fa821c07c1bcf5e
SHA256 f6eb36cfebfd8a08ae1ba361e0629f4418c02a6789c18cf6821799dc0c04bc9b
MD5 eca99c99944f46206dcb1e5ba748367e
SHA1 ed0f00c544d6742366dbd17abe90d32ab8568903
SHA512 407aa5ff2a7678c86cb89dc572acaa1449bbefad412424ff45d90e9e778da1e08af068dbcd3717088be3ce181f486ce1ca4aabc2bd59c48e7205049d28187ad1
SSDEEP 12288:fkuJyScjDQlk/xtpmUgQHCii7qFvQv5tmUi4N38:OLdFCii7qFoj
TLSH
T193257F01B3FA8114F1F36B759DBA4AA25E3BBC915E30C98F6295315E1972E90D930B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\openvpn-gui-custom\openvpn-gui-custom\out\build\x86\Release\openvpn-gui.pdb

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

netapi32

NetLocalGroupGetMembers NetApiBufferFree

ws2_32

ioctlsocket connect closesocket WSAStartup send recv WSACleanup WSAAsyncSelect inet_addr inet_ntoa InetPtonW ntohs htons getsockname bind socket

winhttp

WinHttpDetectAutoProxyConfigUrl WinHttpOpen WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle

secur32

GetUserNameExW

comctl32

PropertySheetW InitMUILanguage

crypt32

CertCreateCertificateContext CertFreeCertificateContext CryptStringToBinaryA CryptBinaryToStringA CryptUnprotectData CertGetNameStringW CryptProtectData

shlwapi

PathAddBackslashW StrTrimA PathIsRelativeW PathCombineW PathCanonicalizeW UrlUnescapeA

advapi32

RegisterEventSourceW CryptGetHashParam CryptReleaseContext CryptAcquireContextW ReportEventW FreeSid CheckTokenMembership AllocateAndInitializeSid RegGetValueW RegSetKeyValueW RegDeleteKeyValueW DeregisterEventSource RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupAccountNameW LookupAccountSidW GetTokenInformation EqualSid CreateWellKnownSid CopySid StartServiceW QueryServiceStatusEx QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle RegCopyTreeW RegDeleteTreeW RegSetValueExW OpenProcessToken CryptCreateHash CryptHashData CryptDestroyHash InitializeSecurityDescriptor CryptGenRandom SetSecurityDescriptorDacl RegEnumKeyExW RegQueryValueExW

shell32

ShellExecuteW SHAppBarMessage Shell_NotifyIconW ShellExecuteExW SHCreateItemFromParsingName Shell_NotifyIconGetRect

gdi32

GetDeviceCaps DeleteDC DeleteObject GetPixel SetTextColor SetPixel CreateFontIndirectW GetObjectW CreateCompatibleBitmap LPtoDP GetStockObject SelectObject GetTextExtentPoint32W CreateCompatibleDC

comdlg32

GetOpenFileNameW

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoTaskMemFree

cryptui

CryptUIDlgViewContext

wininet

InternetConnectW InternetReadFile InternetSetOptionA InternetSetOptionW HttpOpenRequestW InternetOpenW HttpQueryInfoA HttpQueryInfoW HttpSendRequestW InternetCloseHandle

iphlpapi

GetExtendedTcpTable

ntdll

VerSetConditionMask RtlNtStatusToDosError RtlUnwind NtQuerySystemInformation

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetStringTypeW GetCurrentDirectoryW GetFullPathNameW HeapReAlloc HeapAlloc HeapFree WriteConsoleW DeleteFileW SystemTimeToTzSpecificLocalTime SetStdHandle GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx OutputDebugStringW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA SetEnvironmentVariableW GetProcessHeap GetTimeZoneInformation FlushFileBuffers GetFileType GetDriveTypeW GetModuleHandleExW ExitProcess RaiseException ReadConsoleW HeapSize EncodePointer LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError SetEndOfFile SetHandleInformation IsDebuggerPresent InitializeSListHead CloseHandle GetLastError ReleaseSemaphore WaitForSingleObject GetCurrentProcess GetSystemDirectoryW MulDiv GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal FileTimeToLocalFileTime FindResourceExW GetModuleFileNameW LoadResource SizeofResource FindResourceW EnumResourceLanguagesW FileTimeToSystemTime GetDateFormatW GetTimeFormatW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetCommandLineW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW VerifyVersionInfoW Sleep CreateDirectoryW CreateFileW GetFileAttributesW GetFileInformationByHandle CreateSemaphoreW GetExitCodeProcess GetTickCount64 CopyFileW MultiByteToWideChar WideCharToMultiByte GetStdHandle ReadFile ReadFileEx WriteFile DecodePointer CreatePipe SetNamedPipeHandleState PeekNamedPipe CancelIo SetEvent CreateEventW GetCurrentProcessId TerminateProcess CreateThread GetCurrentThreadId TerminateThread ResumeThread CreateProcessW GetStartupInfoW OpenProcess GetTickCount GetNamedPipeServerProcessId FindClose FindFirstFileW FindNextFileW ExpandEnvironmentStringsW GlobalFree GetWindowsDirectoryW LocalFree GetTempPathW FormatMessageW GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter

user32

LoadImageW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW IsWindow DestroyWindow SetDlgItemTextW GetDlgItemTextW SetTimer KillTimer GetMenuItemID GetMenuInfo FindWindowW LoadCursorW PeekMessageW SetDlgItemTextA CallMsgFilterW keybd_event MsgWaitForMultipleObjectsEx GetDC ReleaseDC GetWindowTextLengthW IsDialogMessageW PostMessageW MoveWindow OffsetRect GetDlgCtrlID CreateIconFromResourceEx EnableWindow IsWindowEnabled SetPropW GetPropW RemovePropW GetWindowTextW GetClientRect GetSysColor EnumThreadWindows SetDlgItemInt GetDlgItemInt CreatePopupMenu DestroyMenu CheckMenuItem EnableMenuItem AppendMenuW SetMenuItemBitmaps TrackPopupMenu SetMenuInfo GetIconInfo SetCursor DialogBoxParamW SendInput AdjustWindowRectEx FillRect ShowCaret HideCaret SendMessageTimeoutW SendMessageW MessageBoxW SetForegroundWindow GetWindowRect SetWindowTextW MessageBoxExW LookupIconIdFromDirectory IsDlgButtonChecked CheckRadioButton DialogBoxIndirectParamW CreateDialogIndirectParamW SetWindowLongW SetFocus GetWindowLongW InvalidateRect GetSystemMetrics GetDlgItem SetWindowPos ShowWindowAsync EndDialog ShowWindow

Name

.text

Size

284KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

601KB

Virtual Size

601KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

openvpn-gui-x86.zip

libopenvpn_plap.dll

ws2_32

comctl32

winhttp

crypt32

ole32

shlwapi

gdi32

cryptui

rpcrt4

iphlpapi

ntdll

kernel32

user32

shell32

advapi32

generic

openvpn-gui.exe

wtsapi32

netapi32

ws2_32

winhttp

secur32

comctl32

crypt32

shlwapi

advapi32

shell32

gdi32

comdlg32

ole32

cryptui

wininet

iphlpapi

ntdll

kernel32

user32

generic