General

  • Target
    dcsetup.exe
  • Size 12.8MB
  • Sample260804-cqeaaaen5v
  • SHA256 d7190ad8cdc908bc8fe3c7c289c480393c2e701496bd3cf06cb93df9988630d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • DLL Hijacking vulnerability 71 IoCs

    Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 10 IoCs

    Codesigned file was signed by an untrusted entity.

  • NSIS installer 6 IoCs

File Explorer

  • dcsetup.exe
    .exe 12.8MB
  • $PLUGINSDIR/DiskCleaner.ini
    560B
  • $PLUGINSDIR/InstallOptions.dll
    .dll 14KB
  • $PLUGINSDIR/KillProcDLL.dll
    .dll 14KB
  • $PLUGINSDIR/MachineCode.dll
    .dll 346KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/modern-header.bmp
    25KB
  • $PLUGINSDIR/modern-wizard.bmp
    149KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • $PLUGINSDIR/stalonestatisticsinfo.exe
    .exe 147KB
  • $PLUGINSDIR/Inetc.dll
    .dll 21KB
  • $PLUGINSDIR/xtInfoPlugin.dll
    .dll 160KB
  • AppMetrics.dll
    .dll 110KB
  • Backup.dll
    .dll 203KB
  • CheckUpdate.dll
    .dll 1.1MB
  • Config.dll
    .dll 41KB
  • CrashReport.dll
    .dll 300KB
  • CrashReport.exe
    .exe 304KB
  • DiskCleaner.dll
    .dll 1.3MB
  • DiskCleaner.exe
    .exe 263KB
  • GUAssistComSvc.exe
    .exe 130KB
  • GUWndManager.dll
    .dll 111KB
  • LockDll.dll
    .dll 575KB
  • Log.dll
    .dll 132KB
  • MachineCode.dll
    .dll 346KB
  • Memfiles.dll
    .dll 57KB
  • MemfilesService.exe
    .exe 301KB
  • Microsoft.VC90.CRT.manifest
    .xml 524B
  • Microsoft.VC90.MFC.manifest
    .xml 548B
  • ObjectAdmin.dll
    .dll 80KB
  • Register.dll
    .dll 596KB
  • Resources/settings/CleanRegistryImageList.bmp
    21KB
  • Resources/settings/DiskCleanerImageList.bmp
    25KB
  • Resources/settings/TracksEraseImageList.bmp
    33KB
  • RestoreCenter.dll
    .dll 354KB
  • ScanFile.dll
    .dll 77KB
  • ShortcutFixer.dll
    .dll 59KB
  • SkinsManager.dll
    .dll 273KB
  • StartupManager.dll
    .dll 2.0MB
  • TracksEraser.dll
    .dll 2.0MB
  • UserPath.dll
    .dll 274KB
  • UserSetting.dll
    .dll 57KB
  • data/ModuleInfo.ini
    14KB
  • data/backup.dat
    862B
  • data/junk.dat
    1KB
  • data/junkInfo.ini
    1KB
  • data/junkcleaner.dat
    142KB
  • dbghelp.dll
    .dll 1020KB
  • languages.dll
    .dll 53KB
  • languages/Afrikaans - [M.D.].lng
    248KB
  • languages/Albanian - [M.D.].lng
    249KB
  • languages/Amharic - [M.D.].lng
    196KB
  • languages/Arabic - [M.D.].lng
    226KB
  • languages/Armenian - [M.D.].lng
    261KB
  • languages/Armenian.lng
    258KB
  • languages/Bulgarian.lng
    209KB
  • languages/Catala.lng
    247KB
  • languages/Catala_Joan.lng
    223KB
  • languages/Croatian.lng
    251KB
  • languages/Cymraeg.lng
    252KB
  • languages/Czech.lng
    217KB
  • languages/Czech_Damned.lng
    218KB
  • languages/Danish(pallan).lng
    260KB
  • languages/Danish.lng
    226KB
  • languages/Danish_kt.lng
    230KB
  • languages/English (proofread by Dillon Ring).lng
    230KB
  • languages/Espanol_River.lng
    268KB
  • languages/Estonian.lng
    228KB
  • languages/Farsi.lng
    193KB
  • languages/Finnish.lng
    170KB
  • languages/Finnish_velimatti.lng
    224KB
  • languages/Francais (Philippe).lng
    274KB
  • languages/Francais (ReActif).lng
    307KB
  • languages/Francais (Tonton Greg).lng
    296KB
  • languages/Francais by gilleliot.lng
    287KB
  • languages/Francais(PBA).lng
    309KB
  • languages/Francais(PLL).lng
    306KB
  • languages/Francais.lng
    252KB
  • languages/French (Ad Lib).lng
    182KB
  • languages/French by Joe.lng
    273KB
  • languages/French(#DG#).lng
    191KB
  • languages/French(CA).lng
    249KB
  • languages/French(FR).lng
    196KB
  • languages/French(ReActif-Korrected).lng
    105KB
  • languages/French_(RT).lng
    195KB
  • languages/French_JeuMeu.lng
    313KB
  • languages/German.lng
    190KB
  • languages/German_A. Schuster.lng
    302KB
  • languages/German_Andy Kleinert.lng
    266KB
  • languages/German_Erik.lng
    245KB
  • languages/German_FINAL.lng
    275KB
  • languages/German_Sarakael.lng
    212KB
  • languages/Glary Utilities chineseT.lng
    156KB
  • languages/Greek.lng
    352KB
  • languages/Hungarian (Timinoun).lng
    283KB
  • languages/Hungarian.lng
    227KB
  • languages/Hungarian_l2belteki.lng
    228KB
  • languages/Igbo.lng
    211KB
  • languages/Italian_millo.lng
    278KB
  • languages/Korean by venusgirl.lng
    187KB
  • languages/Korean_kornet21c.lng
    187KB
  • languages/Magyar.lng
    238KB
  • languages/Magyar2.lng
    175KB
  • languages/PTpt.lng
    221KB
  • languages/Portuguese_Brazilian.lng
    249KB
  • languages/Romana.lng
    119KB
  • languages/Romania.lng
    181KB
  • languages/Romanian(zocoza).lng
    250KB
  • languages/Russian (ViktorOn).lng
    255KB
  • languages/Serbian latin.lng
    221KB
  • languages/Serbian.lng
    219KB
  • languages/Slovak_bugtom.lng
    225KB
  • languages/Slovak_momirek.lng
    212KB
  • languages/Swedish(ulfclaesson).lng
    281KB
  • languages/Swedish.lng
    184KB
  • languages/Turkish_Anteplim.lng
    236KB
  • languages/Trkce T9.lng
    250KB
  • languages/Zoulou.lng
    185KB
  • languages/arabic.lng
    172KB
  • languages/arabic_Saif.lng
    196KB
  • languages/arabic_hisham.lng
    246KB
  • languages/bosnian.lng
    231KB
  • languages/chinese.lng
    77KB
  • languages/chineseT.lng
    151KB
  • languages/dutch.lng
    295KB
  • languages/dutch_hmg.lng
    238KB
  • languages/english.lng
    271KB
  • languages/french.lng
    196KB
  • languages/french2.lng
    400KB
  • languages/french_Morvant.lng
    247KB
  • languages/french_andex.lng
    286KB
  • languages/french_largo.lng
    312KB
  • languages/french_nantesph.lng
    260KB
  • languages/hebrew.lng
    227KB
  • languages/italian.lng
    272KB
  • languages/italian2.lng
    182KB
  • languages/italian3.lng
    179KB
  • languages/italian_alexvis2015.lng
    358KB
  • languages/japanese.lng
    156KB
  • languages/japanese_lb.lng
    171KB
  • languages/korean.lng
    155KB
  • languages/kurdish.lng
    238KB
  • languages/latvian.lng
    215KB
  • languages/lithuanian.lng
    228KB
  • languages/norwegian.lng
    226KB
  • languages/norwegian_kurt.lng
    210KB
  • languages/polish.lng
    247KB
  • languages/polish_Marta.lng
    218KB
  • languages/ptbr.lng
    229KB
  • languages/russian.lng
    233KB
  • languages/slovenian.lng
    288KB
  • languages/slovenian_jrudec.lng
    286KB
  • languages/spain.lng
    195KB
  • languages/spanish (McM).lng
    244KB
  • languages/spanish (antonio perez).lng
    276KB
  • languages/spanish (smrolando).lng
    263KB
  • languages/spanish.lng
    313KB
  • languages/spanish_cannie new.lng
    254KB
  • languages/spanish_emiliograo.lng
    290KB
  • languages/spanish_ignacio.lng
    189KB
  • languages/turkish.lng
    221KB
  • languages/turkish_FaraDelisi.lng
    274KB
  • languages/turkish_fahriavci.lng
    285KB
  • languages/ukrainian.lng
    108KB
  • languages/ukrainian2.lng
    185KB
  • languages/vietnamese.lng
    216KB
  • languages/ by firecold.lng
    144KB
  • languages/ by gchee01.lng
    155KB
  • languages/.lng
    146KB
  • mfc90.dll
    .dll 1.1MB
  • mfc90u.dll
    .dll 1.1MB
  • msvcm90.dll
    .dll 219KB
  • msvcp90.dll
    .dll 555KB
  • msvcr90.dll
    .dll 640KB
  • settings.dll
    .dll 476KB
  • settings.ini
    46B
  • skins/default/DiskCleaner/Line.png
    .png 2KB
  • skins/default/DiskCleaner/OpenFile.png
    .png 3KB
  • skins/default/DiskCleaner/Property.png
    .png 3KB
  • skins/default/DiskCleaner/main_like.png
    .png 1KB
  • skins/default/DiskCleaner/oc_btn_click.png
    .png 2KB
  • skins/default/DiskCleaner/oc_btn_hover.png
    .png 2KB
  • skins/default/DiskCleaner/oc_btn_normal.png
    .png 2KB
  • skins/default/DiskCleaner/skin.ini
    4KB
  • skins/default/DiskCleaner/toolbar.png
    .png 7KB
  • skins/default/Register/InnerBuyRSS/English/images/bg.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/close-click.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/close-default.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/close-hover.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/ico-0.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/ico-2.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/ico-3.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/ico-4.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/ico-5.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/li-dot.png
    .png 978B
  • skins/default/Register/InnerBuyRSS/English/images/mark.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/purchasenow-click.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/purchasenow-default.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/images/purchasenow-hover.png
    .png 1KB
  • skins/default/Register/InnerBuyRSS/English/index.html
    .html .js 4KB
  • skins/default/Register/InnerBuyRSS/English/js/external-api.js
    .js 1KB
  • skins/default/Register/InnerBuyRSS/English/js/jquery.js
    .js 93KB
  • skins/default/Register/about/Scroll_shade.png
    .png 2KB
  • skins/default/Register/about/about-close-click.png
    .png 1KB
  • skins/default/Register/about/about-close-default.png
    .png 1KB
  • skins/default/Register/about/about-close-hover.png
    .png 1KB
  • skins/default/Register/about/about_backimage.png
    .png 2KB
  • skins/default/Register/about/about_shade_border.png
    .png 2KB
  • skins/default/Register/about/feedback-click.png
    .png 1KB
  • skins/default/Register/about/feedback-default.png
    .png 1KB
  • skins/default/Register/about/feedback-hover.png
    .png 1KB
  • skins/default/Register/about/home-click.png
    .png 1KB
  • skins/default/Register/about/home-default.png
    .png 1KB
  • skins/default/Register/about/home-hover.png
    .png 1KB
  • skins/default/Register/about/line.png
    .png 940B
  • skins/default/Register/active_click.png
    .png 1KB
  • skins/default/Register/active_hover.png
    .png 1KB
  • skins/default/Register/active_normal.png
    .png 1KB
  • skins/default/Register/buy_click.png
    .png 1KB
  • skins/default/Register/buy_hover.png
    .png 1KB
  • skins/default/Register/buy_normal.png
    .png 1KB
  • skins/default/Register/close_click.png
    .png 1KB
  • skins/default/Register/close_hover.png
    .png 1KB
  • skins/default/Register/close_normal.png
    .png 1KB
  • skins/default/Register/contact_us.png
    .png 1KB
  • skins/default/Register/edit_disable.png
    .png 1016B
  • skins/default/Register/edit_focus.png
    .png 1023B
  • skins/default/Register/edit_normal.png
    .png 1015B
  • skins/default/Register/email_focus.png
    .png 1KB
  • skins/default/Register/email_normal.png
    .png 1KB
  • skins/default/Register/export_click.png
    .png 1KB
  • skins/default/Register/export_hover.png
    .png 1KB
  • skins/default/Register/export_normal.png
    .png 1KB
  • skins/default/Register/login_click.png
    .png 1KB
  • skins/default/Register/login_hover.png
    .png 1KB
  • skins/default/Register/login_normal.png
    .png 1KB
  • skins/default/Register/logo.png
    .png 1KB
  • skins/default/Register/logomenu_click.png
    .png 966B
  • skins/default/Register/logomenu_hover.png
    .png 966B
  • skins/default/Register/logomenu_normal.png
    .png 965B
  • skins/default/Register/main_logo.png
    .png 1KB
  • skins/default/Register/menu_active.png
    .png 1KB
  • skins/default/Register/menu_cancel.png
    .png 1KB
  • skins/default/Register/menu_signin.png
    .png 1KB
  • skins/default/Register/menu_signup.png
    .png 1KB
  • skins/default/Register/menu_switch_user.png
    .png 1KB
  • skins/default/Register/my_account_menu.png
    .png 1KB
  • skins/default/Register/my_account_menu_border.png
    .png 1KB
  • skins/default/Register/my_app_img.png
    .png 6KB
  • skins/default/Register/my_app_img_s.png
    .png 5KB
  • skins/default/Register/my_buy_click.png
    .png 1KB
  • skins/default/Register/my_buy_hover.png
    .png 1KB
  • skins/default/Register/my_buy_normal.png
    .png 1KB
  • skins/default/Register/my_edit_focus.png
    .png 1KB
  • skins/default/Register/my_edit_normal.png
    .png 1KB
  • skins/default/Register/my_logout_click.png
    .png 1010B
  • skins/default/Register/my_logout_hover.png
    .png 1009B
  • skins/default/Register/my_logout_normal.png
    .png 1009B
  • skins/default/Register/my_menu_click.png
    .png 1KB
  • skins/default/Register/my_menu_hover.png
    .png 1KB
  • skins/default/Register/my_ok_click.png
    .png 1KB
  • skins/default/Register/my_ok_hover.png
    .png 1KB
  • skins/default/Register/my_ok_normal.png
    .png 1KB
  • skins/default/Register/my_quick_click.png
    .png 690B
  • skins/default/Register/my_quick_hover.png
    .png 687B
  • skins/default/Register/my_quick_normal.png
    .png 693B
  • skins/default/Register/my_user_normal.png
    .png 1KB
  • skins/default/Register/my_user_normal0.png
    .png 1KB
  • skins/default/Register/my_waiting.gif
    .gif 15KB
  • skins/default/Register/password_focus.png
    .png 1KB
  • skins/default/Register/password_normal.png
    .png 1KB
  • skins/default/Register/refresh_click.png
    .png 1KB
  • skins/default/Register/refresh_hover.png
    .png 1KB
  • skins/default/Register/refresh_normal.png
    .png 1KB
  • skins/default/Register/return_click.png
    .png 1KB
  • skins/default/Register/return_hover.png
    .png 1KB
  • skins/default/Register/return_normal.png
    .png 1KB
  • skins/default/Register/shadow_border.png
    .png 2KB
  • skins/default/Register/skin.ini
    33KB
  • skins/default/Register/trial_buy_click.png
    .png 973B
  • skins/default/Register/trial_buy_hover.png
    .png 974B
  • skins/default/Register/trial_buy_normal.png
    .png 973B
  • skins/default/Register/user_click.png
    .png 1KB
  • skins/default/Register/user_edit_focus.png
    .png 1KB
  • skins/default/Register/user_edit_normal.png
    .png 1KB
  • skins/default/Register/user_hover.png
    .png 1KB
  • skins/default/Register/user_normal.png
    .png 1KB
  • skins/default/Register/waiting.gif
    .gif 8KB
  • skins/default/Register/window_left.png
    .png 16KB
  • skins/default/common/1.png
    .png 154KB
  • skins/default/common/skin.ini
    6KB
  • sqlite3.dll
    .dll 336KB
  • uninst.exe
    .exe 409KB
  • $PLUGINSDIR/Inetc.dll
    .dll 21KB
  • $PLUGINSDIR/InstallOptions.dll
    .dll 14KB
  • $PLUGINSDIR/KillProcDLL.dll
    .dll 14KB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • $PLUGINSDIR/ioSpecial.ini
    211B
  • $PLUGINSDIR/modern-header.bmp
    25KB
  • $PLUGINSDIR/modern-wizard.bmp
    149KB
  • $PLUGINSDIR/nsDialogs.dll
    .dll 9KB
  • x64/CrashReport.dll
    .dll 109KB
  • x64/CrashReport.exe
    .exe 324KB
  • x64/GUAssistComSvc.exe
    .exe 149KB
  • x64/Log.dll
    .dll 153KB
  • x64/MemfilesService.exe
    .exe 406KB
  • x64/Microsoft.VC90.ATL.manifest
    .xml 468B
  • x64/Microsoft.VC90.CRT.manifest
    .xml 526B
  • x64/Microsoft.VC90.MFC.manifest
    .xml 550B
  • x64/ObjectAdmin.dll
    .dll 87KB
  • x64/Register.dll
    .dll 801KB
  • x64/ScanFile.dll
    .dll 86KB
  • x64/SkinsManager.dll
    .dll 116KB
  • x64/Win64ShellLink.exe
    .exe 147KB
  • x64/atl90.dll
    .dll 172KB
  • x64/mfc90.dll
    .dll 1.6MB
  • x64/mfc90u.dll
    .dll 1.6MB
  • x64/mfcm90.dll
    .dll 65KB
  • x64/mfcm90u.dll
    .dll 65KB
  • x64/msvcp90.dll
    .dll 831KB
  • x64/msvcr90.dll
    .dll 612KB
  • x64ProcessAssist.dll
    .dll 51KB
  • zlib1.dll
    .dll 92KB

dcsetup.exe

  • IMPHASH ced282d9b261d1462772017fe2f6972b
  • SHA256 d7190ad8cdc908bc8fe3c7c289c480393c2e701496bd3cf06cb93df9988630d7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a8:f6:88:ad:c9:b8:a0:41:b7:18:cd:42:77:68:db:82:77:c5:30:53:4e:e3:02:6d:5e:99:c5:14:87:85:93:88
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91110108680456115E,CN=Glarysoft Ltd,O=Glarysoft Ltd,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Digest
42:2c:2a:00:79:fc:71:82:18:d6:cd:dd:b7:a3:77:44:92:b4:e6:4c
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91110108680456115E,CN=Glarysoft Ltd,O=Glarysoft Ltd,ST=Beijing,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13104861696469616e204469737472696374,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Minor OS version
0
Major OS version
4
Entry point
13074
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths