General

  • Target

    GlassWireSetup_7.exe

  • Size

    80.1MB

  • MD5

    f87930ec04019aec26ea027ecb04b073

  • SHA1

    ccb0da3f7e88a7012728cc500a7f75a5beead660

  • SHA256

    07b77a8489c19924f82225fc1981195c178de97ea8d4cd97590cad4bbfb20c79

  • SHA512

    405bad6a3ee76d05074d384c5086a15b9b9aa1e1ca870d13b3a1fb6ab680a85415a80cd8f86052267b62e5c6fcb0104b090cd822f08585801c715ac0c7e7230e

  • SSDEEP

    1572864:dbVqMcAyCN59f7QRMLa3NY7CmnyXwd2aKn3JlA+zh:d5f5J97cMLa3Kmm6kqbl

Score
7/10

Malware Config

Signatures

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • GlassWireSetup_7.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Headers

    Imports

    Sections

  • $APPDATA/GlassWire/share/GeoLite2.mmdb
  • $APPDATA/GlassWire/share/storage.db
  • $PLUGINSDIR/GWInstSt.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    646971a3aef724d6f553f40ae84fe26b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/eventlog.man
    .xml
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    3b477381217c97b22146297f93df2a92


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    68b7023f8923dd087549802f8fa631c3


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsihelper.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • $PLUGINSDIR/vc_redist.x86.exe
    .exe windows:5 windows x86 arch:x86

    1a5cdbf711fee14b077e599d13fddab2


    Code Sign

    Headers

    Imports

    Sections

  • GWCtlSrv.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GWEventLog.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GWIdlMon.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • GWUnlock.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • GWUpgradeMonitor.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GlassWire.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • Qt5Core.dll
    .dll windows:6 windows x86 arch:x86

    92fc526ad6d9674f09604104cfa57819


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Gui.dll
    .dll windows:6 windows x86 arch:x86

    443275a6eb00ad3c85c2bc9c3fc2da3e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5OpenGL.dll
    .dll windows:6 windows x86 arch:x86

    001e5e687428b22462285c2750754dae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Svg.dll
    .dll windows:6 windows x86 arch:x86

    079b726a4a2f3a027f09f1cb4e2ed381


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Widgets.dll
    .dll windows:6 windows x86 arch:x86

    7485e296f2ad020a3dedc3de1b20dcfc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5WinExtras.dll
    .dll windows:6 windows x86 arch:x86

    6a5932ee8dcef2f266e2e0e799f280b3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • copyrights/ASIO-LICENSE_1_0.txt
  • copyrights/CURL-COPYING.txt
  • copyrights/GEOIP-LICENSE.txt
  • copyrights/GEOLITE2-COPYRIGHT.txt
  • copyrights/GEOLITE2-LICENSE.txt
  • copyrights/LZ4-LICENSE.txt
  • copyrights/OPENSSL-LICENSE.txt
  • copyrights/PROTOBYUF-LICENSE.txt
  • copyrights/QT-LICENSE.GPL3-EXCEPT.txt
  • copyrights/QT-LICENSE.txt
  • copyrights/RAPIDJSON-LICENSE.txt
  • copyrights/RAPIDXML-LICENSE.txt
  • copyrights/RECOG-COPYING.txt
  • copyrights/RLOTTIE-COPYING.MIT.txt
  • copyrights/SQLITE-COPYING.txt
  • copyrights/ZLIB-LICENSE.txt
  • driver/win-x64/gwdrv.cat
  • driver/win-x64/gwdrv.inf
  • driver/win-x64/gwdrv.sys
    .sys windows:6 windows x64 arch:x64

    f5dcd03cf0a08bfffee94eee61f2b56e


    Code Sign

    Headers

    Imports

    Sections

  • driver/win-x86/gwdrv.cat
  • driver/win-x86/gwdrv.inf
  • driver/win-x86/gwdrv.sys
    .sys windows:6 windows x86 arch:x86

    bc0fcd1e1a98457542ab10b8485f843f


    Code Sign

    Headers

    Imports

    Sections

  • driver/win7-x64/gwdrv.cat
  • driver/win7-x64/gwdrv.inf
  • driver/win7-x64/gwdrv.sys
    .sys windows:6 windows x64 arch:x64

    f5dcd03cf0a08bfffee94eee61f2b56e


    Code Sign

    Headers

    Imports

    Sections

  • driver/win7-x86/gwdrv.cat
  • driver/win7-x86/gwdrv.inf
  • driver/win7-x86/gwdrv.sys
    .sys windows:6 windows x86 arch:x86

    bc0fcd1e1a98457542ab10b8485f843f


    Code Sign

    Headers

    Imports

    Sections

  • iconengines/qsvgicon.dll
    .dll windows:6 windows x86 arch:x86

    e2a8abb2f62e90497419fca861c4de3a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qico.dll
    .dll windows:6 windows x86 arch:x86

    b127d2b5eb2d64741e8cf3a684f53083


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lang/de_de.qm
  • lang/en_gb.qm
  • lang/en_us.qm
  • lang/es_es.qm
  • lang/fr_fr.qm
  • lang/it_it.qm
  • lang/ja_jp.qm
  • lang/ko_kr.qm
  • lang/pl_pl.qm
  • lang/pt_br.qm
  • lang/ru_ru.qm
  • lang/tr_tr.qm
  • lang/zh_cn.qm
  • lang/zh_tw.qm
  • platforms/qwindows.dll
    .dll windows:6 windows x86 arch:x86

    29ed2e73839186c2a3b5a58cddc0eb48


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/windows.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/GWInstSt.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/eventlog.man
    .xml
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    3b477381217c97b22146297f93df2a92


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    68b7023f8923dd087549802f8fa631c3


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsihelper.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections