home

glgo-1.4.exe

PANDA-glGo

PANDANET Inc.

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
PANDANET Inc.

Product:
PANDA-glGo

Version:
1.4

MD5:
6ecf4f280f67328be213298caf306d8c

SHA-1:
dae1d8a2ff7fd3b432ecb9b6f547e9baa1395136

SHA-256:
4e9fe5114fdb2045fcb2b2db9ea50b0c8355a9d6fe31142fbf2127cadefbfb2a

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/26/2024 4:55:51 PM UTC  (today)

File size:
6.6 MB (6,937,808 bytes)

Product version:
1.4

Copyright:
© 2003-2006 PANDANET Inc.

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\glgo-1.4.exe

File PE Metadata
Compilation timestamp:
3/4/2006 12:05:36 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:5i2bT7Jr27bwCJS9BVJDo920K7dejfQkgmMi:5i2f7o3YBVJUFeEQ/mMi

Entry address:
0x32E0

Entry point:
81, EC, 7C, 01, 00, 00, 53, 55, 56, 33, F6, 57, 89, 74, 24, 18, BD, 68, 91, 40, 00, C6, 44, 24, 10, 20, FF, 15, 30, 70, 40, 00, 56, FF, 15, 70, 72, 40, 00, A3, 10, 44, 42, 00, 56, 8D, 44, 24, 30, 68, 60, 01, 00, 00, 50, 56, 68, 20, FD, 41, 00, FF, 15, 58, 71, 40, 00, 68, 8C, 92, 40, 00, 68, 60, 3B, 42, 00, E8, 2C, 28, 00, 00, BB, 00, B4, 42, 00, 53, 68, 00, 04, 00, 00, FF, 15, B8, 70, 40, 00, E8, 64, FF, FF, FF, 85, C0, 75, 24, 68, FB, 03, 00, 00, 53, FF, 15, B4, 70, 40, 00, 68, 84, 92, 40, 00, 53, E8, 17...
 
[+]

Entropy:
7.9993

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file glgo-1.4.exe has been seen being distributed by the following 7 URLs.

http://gsf-cf.softonic.com/dae/1d8/.../file?SD_used=0&channel=WEB&fdh=no&id_file=62376&instance=softonic_fr&type=PROGRAM&Expires=1471388876&Signature=TYII9o0SFiE2UIBnaGukLZFPB3gBzFuuccH8K8KoOx2jdOhCDTKHS8S2pxOrXIDtxVUyk8ga67J~xdx-qNQdHPcncUpzIlGrwECkGxR-uiai6Ywnsok5~P3CqDqRv7Vgtm5mHzkvM3jmiahiuxmeKffYx9yNyXslnLLSrcrv1cc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glGo-1.4.exe

http://gsf-cf.softonic.com/dae/1d8/.../file?SD_used=0&channel=WEB&fdh=no&id_file=62376&instance=softonic_fr&type=PROGRAM&Expires=1456300535&Signature=RPXfrYxX5X7KZMXhYce5Z0MXnE1jG5C6bB9Nivv3n8KLm1Je4MRlGXFCVEXyreY1m1HC7qzzU~NWFyHbr7TDKATnLvuwC8jKu8Pui8gjRlaG9NLYpGJDyBX~hJL1FX-hKbmLBuRxo1cfI1Xqdrta7TFNwFz42nY9GcFSWlJyV6I_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glGo-1.4.exe

http://gsf-cf.softonic.com/dae/1d8/.../file?SD_used=0&channel=WEB&fdh=no&id_file=62376&instance=softonic_fr&type=PROGRAM&Expires=1448324334&Signature=QZZ6rKuclng5hNonSxknw6-PLrZh41VlDoti6rr2TtQ-miJOtenUjPFnKAA74w4EzMjMtjZT0DSqzSDuSFHk799aNDQ8OoG2Gu0sluxAyuDLC39LoYm-oozAWuSqfZ0q~oq-n84JRubyaTFx25mFbM0vBNqVkGgK6ZlFE4GCyaQ_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glGo-1.4.exe

http://gsf-cf.softonic.com/dae/1d8/.../file?SD_used=0&channel=WEB&fdh=no&id_file=62376&instance=softonic_fr&type=PROGRAM&Expires=1457923496&Signature=K3CXefxGAIRJsjT2IX4lkodjCER2wUcUQAzk2aNw65eciBwtEb83YNxokH5q6dlrPayFeqjX0bNgUfkMk2eSvLGnYoEajkKBZkRGi4eOq7bcSD8bXxggJan79SrQKL~EO7KhSQpmDT3Z8c~xSAwJFD9Sd7PkEYFLXTZR4D-9AK8_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glGo-1.4.exe

http://gsf-cf.softonic.com/dae/1d8/.../file?SD_used=0&channel=WEB&fdh=no&id_file=62376&instance=softonic_es&type=PROGRAM&Expires=1433655879&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&Signature=CpVpkI5sCn-Uozf-nvdpzw0B48ufI7CmnyPjgIKeHID4apUSpka86QtOATY~JMdaHwNqWvtkqReOiBiSzq~5DqZw7bwxDgWblMtZZRB0ajzUkcfppxsZnveBrcJyRA88CCKWAM9awzSTYTZXpO6q7QC4pROIJRCkZWKlvsniBd8_&filename=glGo-1.4.exe

http://gsf-cf.softonic.com/dae/1d8/.../file?SD_used=0&channel=WEB&fdh=no&id_file=62376&instance=softonic_fr&type=PROGRAM&Expires=1455510940&Signature=haUJ9tojZ5oaT3rwbAX7M~GprKExNS2h1aJ3ngoEFcOFERQsc-FHxr3Y1euq7qJQbPdcVeRJx4oyPYqCEOAWoXMBBBlwSTyuBCqiAxH-46aPD5jS9vVqWgcJy-PdXhBSnn~1R1FN7BMC8wTMApoDbWFAxnvOFf7AXJtHXdYH4-4_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=glGo-1.4.exe

http://www.pandanet.co.jp/English/glgo/.../glGo-1.4.exe

Scan glgo-1.4.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.