home

urvpn.exe

F5 Networks Firepass 1000

F5 Networks

This is a self-extracting archive and installer. This is installed with F5 Networks VPN Client for Windows. The file has been seen being downloaded from www.lbp-vpn.com and multiple other hosts.
Publisher:
F5 Networks  (signed and verified)

Product:
F5 Networks Firepass 1000

Description:
Driver Setup for F5 Networks SSL VPN

Version:
6031, 2010, 0617, 2020

MD5:
dfdf22c0697e775b8727792c3f8b5422

SHA-1:
c0b62aa991c933ddb76db9eb0b462d7b3f6ce82c

SHA-256:
e54fc997513b08f199c65df1470a9b1e2ba5601c90ea450884266a740ecb3937

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/15/2024 12:55:36 PM UTC  (today)

File size:
625.5 KB (640,552 bytes)

Product version:
6031, 2010, 0617, 2020

Copyright:
Copyright © 2002-2007

Original file name:
unzipstb.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\f5 vpn\f5_tmp\urvpn.exe

Digital Signature
Signed by:
F5 Networks

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
3/18/2010 7:00:00 PM

Valid to:
3/17/2013 6:59:59 PM

Subject:
CN=F5 Networks, OU=PRODUCT DEVELOPMENT, O=F5 Networks, L=Seattle, S=Washington, C=US

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
3E0190A50E1038DB25E2A58808511729

File PE Metadata
Compilation timestamp:
6/17/2010 3:20:10 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:NyyFyy/Ni5t1c8tQf8zX9JuSdMuwHVDNE5f8++4R1RdE14HjgzDXfwltzCE:fNi5tntQf879daL1Ef8bAbOzLGVCE

Entry address:
0x148D5

Entry point:
55, 8B, EC, 6A, FF, 68, 28, 45, 42, 00, 68, 30, 2B, 41, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 58, 53, 56, 57, 89, 65, E8, FF, 15, 24, 01, 42, 00, 33, D2, 8A, D4, 89, 15, 0C, C4, 42, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 08, C4, 42, 00, C1, E1, 08, 03, CA, 89, 0D, 04, C4, 42, 00, C1, E8, 10, A3, 00, C4, 42, 00, 6A, 01, E8, 83, 02, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, C3, 00, 00, 00, 59, E8, 87, 40, 00, 00, 85, C0, 75, 08, 6A, 10, E8, B2, 00, 00, 00, 59, 33, F6, 89, 75...
 
[+]

Entropy:
7.7614

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
122.5 KB (125,440 bytes)

The file urvpn.exe has been discovered within the following program.

F5 Networks VPN Client for Windows  by F5 Networks, Inc.
The F5 Networks VPN Client for Windows is a program that allows a user to initiate and use Network Access, App Tunnel, and Terminal Services sessions outside the context of an Internet browser. The F5 Networks VPN Client for Windows uses the FirePass controller API.
support.f5.com/kb/en-us/products/firepass/manuals/product/firepass_administrator_guide_6_0_3/fp_ag_9_clientdownload.html
About 2% of users remove it
 
Powered by Should I Remove It?

The file urvpn.exe has been seen being distributed by the following 2 URLs.

https://www.lbp-vpn.com/vdesk/.../urvpn.exe

https://a2fp3.alpineaccess.com/vdesk/.../urvpn.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.