home

gu5setup.exe

Glarysoft LTD

The application gu5setup.exe by Glarysoft has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from lb.cdn.m6web.fr and multiple other hosts.
Publisher:
Glarysoft LTD  (signed and verified)

MD5:
876b71b14ba93f81fcc2ef0618d24d9d

SHA-1:
1a51a66b0069d557013af000e0b0c4f658405c0e

SHA-256:
87d3afda4a81d42617d3af6d6ebf417fadeaf77efd003d85a8071d18d5702d83

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 1:27:27 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Glarysoft.Optional (L)
16.10.13.21

File size:
15.5 MB (16,276,920 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\temp\gu5setup.exe

Digital Signature
Signed by:
Glarysoft LTD

Authority:
VeriSign, Inc.

Valid from:
2/5/2016 12:00:00 AM

Valid to:
2/4/2019 11:59:59 PM

Subject:
CN=Glarysoft LTD, O=Glarysoft LTD, L=Beijing, S=Beijing, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
60C19744D4DA5603BB57F39C75816E5B

File PE Metadata
Compilation timestamp:
12/5/2009 10:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
393216:PnnsTCkyV3DGn05oHxNRkYGfnDT0C7d9uZayYrF:PnmC9UeUxntKDoZ/OF

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9993

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file gu5setup.exe has been seen being distributed by the following 23 URLs.

http://lb.cdn.m6web.fr/d/c/a/3e24553d059d5a030fe7547852e33a95/574b3556/soft/.../glary-utilities_5-51_fr_73266.exe

http://www.logitheque.com/.../55bed29d.dl

http://www.lelogicielgratuit.com/.../55bed29d.dl

http://www.majorgeeks.com/index.php?ct=files&action=download&

http://lb.cdn.m6web.fr/d/c/a/e987dc9a9aadfe4cb3684213704b840e/5744b2e2/soft/.../glary-utilities_5-51_fr_73266.exe

http://www.skidajmo.com/download.php?path=1264102164784

http://everydownload.net/installing-82/us/glary-utilities/windows/.../?post_id=8515&sid=14647829

http://dw.uptodown.com/dwn/7EILIEqr1gIBsET1qdxKpzj8g3qJYkYUIgJRZdd7NNpuCmIqVaBJyuLrmmCo4YYOa3_8itrvHMAgXBfPuBzbI0xPs3seH2TPNR_rbDW7-07eunoqf8yXsuplNLFlxSvQ/7EhDNuYUtg1meZnVh5GxtnXk_ODxuQ4k3Z7tFKly9_D8cYtCPtxU3i-BUizEIfrjXQ62MJSzt9eT5hWtjedZfaNP-UKy9oZzM3q7-_RSjyvFxlYml2uQEzp7y5T3RGUv/RaoQ5XUu0Ig03LT0Dv9TyekxFNTUOr9ArVQxTkZ34j-CbDSIm-hm_HvPhCPEMeC_k5sOpML1diinnPcy6CRq4OwKheJj8Fxev-2MtMb1pDwrUo9mmlbTot9iwb1VUxk9/.../

http://software-files-a.cnet.com/s/software/13/80/12/.../gu5setup.exe

http://telechargement1.pcastuces.com/temp6bs2/.../gu5setup.exe

http://dw.uptodown.com/dwn/Fg1fMH7avUH_SqYREsHXO4RmuAZ6QFPwPxabk2KtT4wHOA1kcoK7vCE3oe7OfekAEmrn24I8gQmzQMhJCtnC15ZFx_OXJHGdmt8QXaxWoMal0sHk3YXIMTgc-0ji9ub_/jk1io5CH4_OlO5FmNnNgtL6j1cUmFRqZeQy65ROC8GWAFs-GdmZHO7Pr7dd_h0UlzlBRDlJEuSUg9tpDLiCGLONhd2AHvGveQQJ9m1orGEkFD7NlT-qXnHrkJP8hGm2g/NrvS1NZTCMFkQnt15wWRDw5o0btWRfeKOUgjm-CEVOZeZU2u8ZviMbE1hDX1_2QI7pg6p9cjvsw00FaNNVtn-xpUi-4lW-IpvR8Bi1Sd5Nwi26sQAOV2O8vhxapYMkvw/.../

http://bcdn.softcdn.ru/5.html?parameter=Glary_Utilities_Rus_Setup.exe&clr=1&se=besplatnyeprogrammy.ru&cid=1252738472.1463590843&uid=30323266.52748124&ref=HIDE_REF

http://everydownload.net/installing-70/us/glary-utilities/windows/.../?post_id=8515&sid=13294693

http://lb.cdn.m6web.fr/d/c/a/afe601fd95f53f7dcb040769c5d73e96/574b20b0/soft/.../glary-utilities_5-51_fr_73266.exe

http://software.thaiware.com/download_url.php?id=8252

http://lb.cdn.m6web.fr/d/c/a/1416a4b5e6d29ffad12e7ebddb244c1e/5744b43b/soft/.../glary-utilities_5-51_fr_73266.exe

http://dw.uptodown.com/dwn/aMaCPfHRogQVo5_MdamLqqpKFBfkzVFjEOXSYTizGsfwwuOGly0Qd0_vy1zWq9NN_xZxCEEBFFTOLcYlQlIMJhOweasH4nrXUpEbHgmfSzN-XdIC5vUAuwAJoDU17SmU/8pZW8Uv7qPi_lgc2HMF8Xe-SuWqwPmvmwOUYskqjitUr83RdVbj3fKyb84cfom_j3ZgZKjgAjCQorcFouCIz-RHLMu6bX-3VMfYLQBlD36Xk_ISXnYcum6B6qKZ6g6Jk/thpU6yPEfXdcs06ROcGd1gGYWtyrwfr4ryDacNVOrcBgANepUxQP20YnwrhTXJw6YGb6zIzC_QYkGeQ0aKLXlEXydq7dEKPluvfhGyQnz2EDv6G939IEXGUUUUa3gUT1/.../

http://lb.cdn.m6web.fr/d/c/a/4e6c15ab5375aadf5aff2e6b4dcb0707/573f1db4/soft/.../glary-utilities_5-51_fr_73266.exe

https://secure.avangate.com/affiliate.php?ACCOUNT=GLARYSOF&AFFILIATE=678&PATH=http://.../gu5setup.exe

http://files.downloadnow-1.com/s/software/14/68/71/.../gu5setup.exe

http://www.filehorse.com/download/file/.../

http://glary-utilities.softonic.com/download-tracker?th=8yS3 KGEYLiw7GKMHzA/.../51bqWxUChQBieWwWEUCWarD1bRmAY51L1qZ2HS8cAN2hP4BKkikHrL0HIEOOP7YZfhcGl5hsLhEC5cVuOZx7XiNgrEteFmJpvQZO2aAGksMtN8pGo=

http://download.glarysoft.com/gu5setup.exe

Remove gu5setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.