GtpToolsDownLoadHandler.ashx?filename=GTP_6_BrowserPlugin_Setup.exe

First submission 2024-10-15 21:23:10

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 11918.33 KB (12204368 bytes)
Compile time: 2013-01-30 15:21:56
MD5: f9e87cddd88808956105c810842b54e6
SHA1: dded273a2fb3bc855aac1264fca4494e9b4c02cf
SHA256: 2726cb18d4fa06a0cbd68cd42ba60e3e888d5ebdc3eedbf3038a579738f04ad2
Import Hash : 48aa5c8931746a9655524f67b25a47ef
Sections 8 .text .itext .data .bss .idata .tls .rdata .rsrc
Directories 4 import resource tls security

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://hnjgdl.geps.glodon.com:8888/Services/Identification/Server/GtpToolsDownLoadHandler.ashx?filename=GTP_6_BrowserPlugin_Setup.exe VirusTotal Report hnjgdl.geps.glodon.com VirusTotal Report 2024-10-15 21:23:10

PE Sections 3 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0xf12c 61952 e446317d7cb464e9ab9c259129ffb390c0e85bbc 3a126e478661f20816f9d9285615f98e
.itext 0x11000 0xb44 3072 3ee09b4d597b2047cd658a1acfa454edb77e09c7 ba48b9b17b3dd8b92da3bd93f20ddb34
.data 0x12000 0xc88 3584 04e9419b80ec90dff0906e2b7ef0749593fd8648 d7fd5f4b562d7961758f3d6a8c834fd0
.bss 0x13000 0x56b4 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.idata 0x19000 0xdd0 3584 391bdc96affa3aca04b3ed0fdce8edbd5a888a76 93d91a2b90e60bd758fc0c4908856ae1
.tls 0x1a000 0x8 0 da39a3ee5e6b4b0d3255bfef95601890afd80709 d41d8cd98f00b204e9800998ecf8427e
.rdata 0x1b000 0x18 512 45d8f890e32cc1adf7ded113fd19004c8869f419 3dffc444ccc131c9dcee18db49ee6403
.rsrc 0x1c000 0xb000 45056 382e439b681e01d01d251df2ed51381930e335c4 0ec3b0cbd28d69aeb07bf0445301b1a3

PE Resources 6

Name Language Sublanguage Offset Size Data
RT_ICON LANG_DUTCH SUBLANG_DUTCH 0x1cd94 2216
RT_STRING LANG_NEUTRAL SUBLANG_NEUTRAL 0x1de14 660
RT_RCDATA LANG_NEUTRAL SUBLANG_NEUTRAL 0x264f0 44
RT_GROUP_ICON LANG_ENGLISH SUBLANG_ENGLISH_US 0x2651c 62
RT_VERSION LANG_ENGLISH SUBLANG_ENGLISH_US 0x2655c 1268
RT_MANIFEST LANG_ENGLISH SUBLANG_ENGLISH_US 0x26a50 1444

Meta infos 8

LegalCopyright: Copyright 2014 Glodon Software Inc.
FileVersion: 6.2.09.19
CompanyName: Glodon Software Inc.
ProductVersion: 6.2.08.15
FileDescription: GTP 6 \x6d4f\x89c8\x5668\x4fee\x590d\x5de5\x5177
Translation: 0x0000 0x04b0
Comments: This installation was built with Inno Setup.
ProductName: GTP 6 \x6d4f\x89c8\x5668\x4fee\x590d\x5de5\x5177

Packers detected 2

Borland Delphi 3.0 (???)
Borland Delphi 4.0

Anti debug functions 3

GetLastError
RaiseException
UnhandledExceptionFilter

File signature

MD5 SHA1 Block size Virtual Address
9fea6ec26c9d7f27d2cc679022a167aa 6acea943ba139009912442e7e68907c47b5762e7 10328 12194040

Strings analysis - File found

Executable
wnQ.so
Autocad
MwS.DwG
Library
KERNEL32.dll
SHELL32.dll
COMCTL32.dll
OLEAUT32.dll
USER32.dll
ADVAPI32.dll

Strings analysis - Possible IPs found 2

6.2.08.15
6.2.09.19

Strings analysis - Possible URLs found 16

http://ocsp.digicert.com0\
http://ocsp.digicert.com0C
http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
http://ocsp.digicert.com0A
http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
http://www.digicert.com/CPS0
http://ocsp.digicert.com0X

Import functions