» vpndownloader.exe
Overview
Analysis
File Details
Programs (2)
Downloads (2)

vpndownloader.exe

Cisco AnyConnect Secure Mobility Client

Cisco Systems, Inc.

This is installed with multiple programs including Cisco AnyConnect VPN Client and Cisco AnyConnect Secure Mobility Client. The file has been seen being downloaded from vpn.azbil.com and multiple other hosts.

File name:

vpndownloader.exe

Publisher:

Cisco Systems, Inc. (signed and verified)

Product:

Cisco AnyConnect Secure Mobility Client

Description:

Cisco AnyConnect Secure Mobility Client Downloader

Version:

3, 0, 10057

MD5:

3a2d9380be541eae0735a724bfc35292

SHA-1:

e0b16225ab49cd6a1a680e92c6f3ed507019191a

SHA-256:

4d803db2c16b7179f7dd2fcbab7c0608964a86f3d105a30ab33608a2b03378e8

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)

Analysis date:

11/16/2024 7:48:18 PM UTC (today)

File size:

663 KB (678,904 bytes)

Product version:

3, 0, 10057

Trademarks:

You can request legal trademarks and credits at anyconnect-credits@cisco.com

Original file name:

vpndownloader.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\cisco\cisco anyconnect vpn client\vpndownloader.exe

Digital Signature

Signed by:

Cisco Systems, Inc.

Authority:

VeriSign, Inc.

Valid from:

2/7/2011 5:00:00 PM

Valid to:

2/7/2013 4:59:59 PM

Subject:

CN="Cisco Systems, Inc.", OU=Endpoint Security, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Cisco Systems, Inc.", L=Boxborough, S=Massachusetts, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

06DB161D57C91FB4A942678B9975D458

File PE Metadata

Compilation timestamp:

9/26/2012 7:53:43 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

12288:4eJEc0L0ymPMiQ/YZz2O1DxXL0TIEu3HRxoJBLihtGlcJx1R:4eJEcGtmPMiKaKexXL0TIEu3fbtGlcJt

Entry address:

0x47459

Entry point:

E8, 79, 04, 00, 00, E9, 58, FD, FF, FF, CC, FF, 25, EC, 35, 45, 00, FF, 25, F0, 35, 45, 00, FF, 25, F4, 35, 45, 00, FF, 25, F8, 35, 45, 00, FF, 25, FC, 35, 45, 00, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, D0, 49, 49, 00, 89, 0D, CC, 49, 49, 00, 89, 15, C8, 49, 49, 00, 89, 1D, C4, 49, 49, 00, 89, 35, C0, 49, 49, 00, 89, 3D, BC, 49, 49, 00, 66, 8C, 15, E8, 49, 49, 00, 66, 8C, 0D, DC, 49, 49, 00, 66, 8C, 1D, B8, 49, 49, 00, 66, 8C, 05, B4, 49, 49, 00, 66, 8C, 25, B0, 49, 49, 00, 66, 8C, 2D, AC, 49, 49... 
[+]

Entropy:

6.5133

Code size:

326.5 KB (334,336 bytes)

The file vpndownloader.exe has been discovered within the following programs.

Cisco AnyConnect Secure Mobility Client by Cisco Systems, Inc.

Publisher's description - “Make the VPN experience easier and more secure with the enhanced remote access technology of Cisco AnyConnect Secure Mobility Client.”

www.cisco.com

7% remove it

Cisco AnyConnect VPN Client by Cisco Systems, Inc.

Publisher's description - “The Cisco AnyConnect VPN Client provides remote users with secure VPN connections to the Cisco ASA 5500 Series Adaptive Security Appliance using the Secure Socket Layer (SSL) protocol and the Datagram TLS (DTLS) protocol.”

9% remove it

The file vpndownloader.exe has been seen being distributed by the following 2 URLs.

https://vpn.azbil.com/CACHE/stc/1/.../vpndownloader.exe

https://matrix.desca.com/CACHE/stc/1/.../vpndownloader.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.