home

vmware_index.html-setup.exe

SSL VPN-Plus

This is a self-extracting archive and installer. The file has been seen being downloaded from whtc36609-sslvpn.c3.cgi.com.
Product:
SSL VPN-Plus

Description:
stub for zip

Version:
1, 4, 0, 0

MD5:
33d29f18d2aef2921fd30ad528661a98

SHA-1:
54d930be3df2ebe2ef60daa56a5ca863c4941203

SHA-256:
943dc4d168df4a26b794d13efe6b46abc4542b6fcae4971b324a01e9d198213d

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/15/2024 4:54:17 PM UTC  (today)

File size:
1.2 MB (1,227,977 bytes)

Product version:
1, 4, 0, 0

Copyright:
Copyright © 2005

Original file name:
nazipstub.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\vmware_index.html-setup.exe

File PE Metadata
Compilation timestamp:
4/1/2015 4:43:43 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:oXf99l/ahdZmWzBzW5cEHzUnA2op32goQ6DhBiDA:gl9loR7E4A2iEQ6DrUA

Entry address:
0xF0BE

Entry point:
E8, FC, 6F, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 54, 24, 04, 89, 2A, 89, 5A, 04, 89, 7A, 08, 89, 72, 0C, 89, 62, 10, 8B, 04, 24, 89, 42, 14, C7, 42, 20, 30, 32, 43, 56, C7, 42, 24, 00, 00, 00, 00, 64, A1, 00, 00, 00, 00, 89, 42, 18, 83, F8, FF, 75, 09, C7, 42, 1C, FF, FF, FF, FF, EB, 3B, 8B, 4C, 24, 08, 0B, C9, 74, 0A, 8B, 44, 24, 0C, 89, 42, 24, 49, 75, 08, 8B, 40, 0C, 89, 42, 1C, EB, 21, 8B, 44, 24, 10, 89, 42, 1C, 49, 74, 17, 56, 57, 8D, 74, 24, 1C, 8D, 7A, 28, 83, F9, 06, 76...
 
[+]

Entropy:
7.9405  (probably packed)

Code size:
111 KB (113,664 bytes)

The file vmware_index.html-setup.exe has been seen being distributed by the following URL.

https://whtc36609-sslvpn.c3.cgi.com/phatclient/.../VMware_index.html-Setup.exe

Scan vmware_index.html-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.