GtpToolsDownLoadHandler.ashx?filename=GTP_6_BrowserPlugin_Setup.exe
First submission 2024-10-15 21:23:10
File details
File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
Mime type: | application/x-dosexec |
File size: | 11918.33 KB (12204368 bytes) |
Compile time: | 2013-01-30 15:21:56 |
MD5: | f9e87cddd88808956105c810842b54e6 |
SHA1: | dded273a2fb3bc855aac1264fca4494e9b4c02cf |
SHA256: | 2726cb18d4fa06a0cbd68cd42ba60e3e888d5ebdc3eedbf3038a579738f04ad2 |
Import Hash : | 48aa5c8931746a9655524f67b25a47ef |
Sections 8 | .text .itext .data .bss .idata .tls .rdata .rsrc |
Directories 4 | import resource tls security |
File features detected
URLs, FQDN and IP indicators 1
PE Sections 3 suspicious
Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
---|---|---|---|---|---|---|
.text | 0x1000 | 0xf12c | 61952 | e446317d7cb464e9ab9c259129ffb390c0e85bbc | 3a126e478661f20816f9d9285615f98e | |
.itext | 0x11000 | 0xb44 | 3072 | 3ee09b4d597b2047cd658a1acfa454edb77e09c7 | ba48b9b17b3dd8b92da3bd93f20ddb34 | |
.data | 0x12000 | 0xc88 | 3584 | 04e9419b80ec90dff0906e2b7ef0749593fd8648 | d7fd5f4b562d7961758f3d6a8c834fd0 | |
.bss | 0x13000 | 0x56b4 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.idata | 0x19000 | 0xdd0 | 3584 | 391bdc96affa3aca04b3ed0fdce8edbd5a888a76 | 93d91a2b90e60bd758fc0c4908856ae1 | |
.tls | 0x1a000 | 0x8 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
.rdata | 0x1b000 | 0x18 | 512 | 45d8f890e32cc1adf7ded113fd19004c8869f419 | 3dffc444ccc131c9dcee18db49ee6403 | |
.rsrc | 0x1c000 | 0xb000 | 45056 | 382e439b681e01d01d251df2ed51381930e335c4 | 0ec3b0cbd28d69aeb07bf0445301b1a3 |
PE Resources 6
Name | Language | Sublanguage | Offset | Size | Data |
---|---|---|---|---|---|
RT_ICON | LANG_DUTCH | SUBLANG_DUTCH | 0x1cd94 | 2216 | |
RT_STRING | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1de14 | 660 | |
RT_RCDATA | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x264f0 | 44 | |
RT_GROUP_ICON | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2651c | 62 | |
RT_VERSION | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x2655c | 1268 | |
RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x26a50 | 1444 |
Meta infos 8
LegalCopyright: | Copyright 2014 Glodon Software Inc. |
FileVersion: | 6.2.09.19 |
CompanyName: | Glodon Software Inc. |
ProductVersion: | 6.2.08.15 |
FileDescription: | GTP 6 \x6d4f\x89c8\x5668\x4fee\x590d\x5de5\x5177 |
Translation: | 0x0000 0x04b0 |
Comments: | This installation was built with Inno Setup. |
ProductName: | GTP 6 \x6d4f\x89c8\x5668\x4fee\x590d\x5de5\x5177 |
Packers detected 2
Borland Delphi 3.0 (???) |
Borland Delphi 4.0 |
Anti debug functions 3
GetLastError |
RaiseException |
UnhandledExceptionFilter |
File signature
MD5 | SHA1 | Block size | Virtual Address |
---|---|---|---|
9fea6ec26c9d7f27d2cc679022a167aa | 6acea943ba139009912442e7e68907c47b5762e7 | 10328 | 12194040 |
Strings analysis - File found
Executable |
wnQ.so |
Autocad |
MwS.DwG |
Library |
KERNEL32.dll |
SHELL32.dll |
COMCTL32.dll |
OLEAUT32.dll |
USER32.dll |
ADVAPI32.dll |
Strings analysis - Possible IPs found 2
6.2.08.15 |
6.2.09.19 |
Strings analysis - Possible URLs found 16
http://ocsp.digicert.com0\ |
http://ocsp.digicert.com0C |
http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0 |
http://ocsp.digicert.com0A |
http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0 |
http://crl3.digicert.com/DigiCertTrustedRootG4.crl0 |
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline |
http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0 |
http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C |
http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0 |
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E |
http://schemas.microsoft.com/SMI/2005/WindowsSettings |
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0 |
http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S |
http://www.digicert.com/CPS0 |
http://ocsp.digicert.com0X |