General

  • Target

    glasswire-setup-3.3.664-full.exe

  • Size

    80.1MB

  • MD5

    e5215b15447aeef707b0d19cea6bc891

  • SHA1

    f14ffcfac63233be00162d62638c805bf5073f17

  • SHA256

    81889b19715f4e523147f39f6a28d30fedece1b8f448e2965c9053ceea7d7325

  • SHA512

    e9d3f1180fb64c3b28c26e55d91627c83a0d9bdb4c4b0596df6ad37259a13bff2e356cd894aa43f59922d1aa394de0d4fd7fb9be504d2f5b0cee2e59b2b710bb

  • SSDEEP

    1572864:JbVqMcAyCN59f7QRMLa3NY7CmnyXwd2aKn3JlA+z4:J5f5J97cMLa3Kmm6kqbs

Score
7/10

Malware Config

Signatures

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • glasswire-setup-3.3.664-full.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections

  • $APPDATA/GlassWire/share/GeoLite2.mmdb
  • $APPDATA/GlassWire/share/storage.db
  • $PLUGINSDIR/GWInstSt.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $PLUGINSDIR/StartMenu.dll
    .dll windows:4 windows x86 arch:x86

    646971a3aef724d6f553f40ae84fe26b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/eventlog.man
    .xml
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    3b477381217c97b22146297f93df2a92


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    68b7023f8923dd087549802f8fa631c3


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsihelper.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • $PLUGINSDIR/vc_redist.x86.exe
    .exe windows:5 windows x86 arch:x86

    1a5cdbf711fee14b077e599d13fddab2


    Code Sign

    Headers

    Imports

    Sections

  • GWCtlSrv.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GWEventLog.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GWIdlMon.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • GWUnlock.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • GWUpgradeMonitor.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • GlassWire.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • Qt5Core.dll
    .dll windows:6 windows x86 arch:x86

    92fc526ad6d9674f09604104cfa57819


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Gui.dll
    .dll windows:6 windows x86 arch:x86

    443275a6eb00ad3c85c2bc9c3fc2da3e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5OpenGL.dll
    .dll windows:6 windows x86 arch:x86

    001e5e687428b22462285c2750754dae


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Svg.dll
    .dll windows:6 windows x86 arch:x86

    079b726a4a2f3a027f09f1cb4e2ed381


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Widgets.dll
    .dll windows:6 windows x86 arch:x86

    7485e296f2ad020a3dedc3de1b20dcfc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5WinExtras.dll
    .dll windows:6 windows x86 arch:x86

    6a5932ee8dcef2f266e2e0e799f280b3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • copyrights/ASIO-LICENSE_1_0.txt
  • copyrights/CURL-COPYING.txt
  • copyrights/GEOIP-LICENSE.txt
  • copyrights/GEOLITE2-COPYRIGHT.txt
  • copyrights/GEOLITE2-LICENSE.txt
  • copyrights/LZ4-LICENSE.txt
  • copyrights/OPENSSL-LICENSE.txt
  • copyrights/PROTOBYUF-LICENSE.txt
  • copyrights/QT-LICENSE.GPL3-EXCEPT.txt
  • copyrights/QT-LICENSE.txt
  • copyrights/RAPIDJSON-LICENSE.txt
  • copyrights/RAPIDXML-LICENSE.txt
  • copyrights/RECOG-COPYING.txt
  • copyrights/RLOTTIE-COPYING.MIT.txt
  • copyrights/SQLITE-COPYING.txt
  • copyrights/ZLIB-LICENSE.txt
  • driver/win-x64/gwdrv.cat
  • driver/win-x64/gwdrv.inf
  • driver/win-x64/gwdrv.sys
    .sys windows:6 windows x64 arch:x64

    f5dcd03cf0a08bfffee94eee61f2b56e


    Code Sign

    Headers

    Imports

    Sections

  • driver/win-x86/gwdrv.cat
  • driver/win-x86/gwdrv.inf
  • driver/win-x86/gwdrv.sys
    .sys windows:6 windows x86 arch:x86

    bc0fcd1e1a98457542ab10b8485f843f


    Code Sign

    Headers

    Imports

    Sections

  • driver/win7-x64/gwdrv.cat
  • driver/win7-x64/gwdrv.inf
  • driver/win7-x64/gwdrv.sys
    .sys windows:6 windows x64 arch:x64

    f5dcd03cf0a08bfffee94eee61f2b56e


    Code Sign

    Headers

    Imports

    Sections

  • driver/win7-x86/gwdrv.cat
  • driver/win7-x86/gwdrv.inf
  • driver/win7-x86/gwdrv.sys
    .sys windows:6 windows x86 arch:x86

    bc0fcd1e1a98457542ab10b8485f843f


    Code Sign

    Headers

    Imports

    Sections

  • iconengines/qsvgicon.dll
    .dll windows:6 windows x86 arch:x86

    e2a8abb2f62e90497419fca861c4de3a


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • imageformats/qico.dll
    .dll windows:6 windows x86 arch:x86

    b127d2b5eb2d64741e8cf3a684f53083


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lang/de_de.qm
  • lang/en_gb.qm
  • lang/en_us.qm
  • lang/es_es.qm
  • lang/fr_fr.qm
  • lang/it_it.qm
  • lang/ja_jp.qm
  • lang/ko_kr.qm
  • lang/pl_pl.qm
  • lang/pt_br.qm
  • lang/ru_ru.qm
  • lang/tr_tr.qm
  • lang/zh_cn.qm
  • lang/zh_tw.qm
  • platforms/qwindows.dll
    .dll windows:6 windows x86 arch:x86

    29ed2e73839186c2a3b5a58cddc0eb48


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • plugins/windows.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • uninstall.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/GWInstSt.exe
    .exe windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/eventlog.man
    .xml
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    3b477381217c97b22146297f93df2a92


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsExec.dll
    .dll windows:4 windows x86 arch:x86

    68b7023f8923dd087549802f8fa631c3


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsihelper.dll
    .dll windows:6 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections