D:\VS2015\DunRunGate\FreeOg\RunGate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f6a90df86cc776d9a383eaa7cc330377d0d9b65bd5178d688f3937c3b8562c20.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6a90df86cc776d9a383eaa7cc330377d0d9b65bd5178d688f3937c3b8562c20.exe
Resource
win10v2004-20240802-en
General
-
Target
f6a90df86cc776d9a383eaa7cc330377d0d9b65bd5178d688f3937c3b8562c20
-
Size
1.5MB
-
MD5
97b7506469fd7e7d6ae212666cb41051
-
SHA1
90d4f1f28b39792023b0f8ec932b9be3dd8cb778
-
SHA256
f6a90df86cc776d9a383eaa7cc330377d0d9b65bd5178d688f3937c3b8562c20
-
SHA512
0fd88ab28bc69bdaeffd06dc9c09c0c8f09759eb3682e322c854881cb5d6c1df059ff786f8ec373ea63bd569448739a9d076f3bc28f357d0b4115ea4838eeea8
-
SSDEEP
24576:/xQ6gvG6gyYsjiptVQBjXhkR5uv0gR4ZPLeAenU1jwrac9mx4zdFd1xuCzUN6dqo:/WPemYscVkXGIYZPyA7hc913ovJU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6a90df86cc776d9a383eaa7cc330377d0d9b65bd5178d688f3937c3b8562c20
Files
-
f6a90df86cc776d9a383eaa7cc330377d0d9b65bd5178d688f3937c3b8562c20.exe windows:5 windows x86 arch:x86
3b10668acb13d882cf1482f7f235ffc5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
psapi
GetProcessImageFileNameA
kernel32
GetVersionExA
GetConsoleCP
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CallWindowProcA
gdi32
ExcludeClipRect
comdlg32
GetSaveFileNameA
advapi32
GetUserNameA
shell32
DragQueryFileA
ole32
CoTaskMemFree
oleaut32
VarUI4FromStr
comctl32
InitCommonControlsEx
ws2_32
WSARecv
wininet
InternetCloseHandle
iphlpapi
GetExtendedTcpTable
Exports
Exports
\�}�-b�"h�c\��&e�d�g�}���ec��g?h�����@��P��$��wE��R�Hfw�D ��-7F\m�"x��g.���N������������Ao������N��ݺa�?E��!���v����x*�_�x��7T�L~۠���;��[H�m���L��P{�g���������u.|�p�p�u�o��%w�ȃ�T�)hh�_�(t�6t�']� D��N]���P�ږa(-i�����>i^��=1%�p/,?����O�8���uI8�m�����gK�[�B��}�JdYCIt ���%�9-��Iٵ6}N��p�ĘU��k�����w)�*�5��#���d�ln���RGƚ�/'F �T� �6M<&�a�j�z����n��(87���|�M�9H[�c��_��K���?Kb���<�Z�� �8\���k�zN#ZY��@���"�"D�K����p���R�YO1a�qM.[���N��3(f��zw�Jߊ��;2�˂A1x�t���{`����fº���"�wɌ|�� lӕY��pu(�����,���B� �&4 đ�ma�Y����$�������:��̞�)JL���\~rQ+(`f�W�tw��.���ᓐ_\W T @1ra����8�m4�A�T��R#:2�f|���Z;/(6�b7���L���0W��l_���k���h�-�T�� ��$����YͿ����X�E ����CZ91� Py�\&Η����Ĵ��A���w2NE���.����4\::�7'�T5���zh�&��d�����Fߙ-��e����T�8�&el��B���?��2EI�fbj% �у�������n��)Th�C����YC�3ur�6)&*���I�K8��P���Yu������]��ƁCThTw���|zY�/�j�@��z����G��$�����}on79p7_�&0�<?6^8�i)��Y&�EB/�26:q�1ty4y$��=��e�b'juE!��P�V)An��wFB�E��Qry�Uj���:p��t{��F8�j튬�6�����2���6���O,O�t�>1Wa�R�����b�5 Ƙ��oO������ՔG��afz~K��Z�Bp��a� 4S���>\E�xQ$����\�i�d�i��nU���E���]Z�1rl�l������,UW.MA�v"����X�&.+�d���\�̍ *�C���������?����/Td�j�YL#����d=V�ZI���[%�dˍG#q�=���K�3�<�Ȉ��4���*B;��LÎ��;�TI6)*�S\�.ыkRā_`�o��\�2� (tY��9�8�A1c�$E|IȈ~[1��Ld�;Z�QW�oZZX��c}T�����Mt�'�*�Wg8Å��V��P�}b���2�8���HH��Wm�� YE:d��T��R8�x�ͭ�O�Hq��z�u�θC�ƍl��3hFf��]������6�n��-9.M��i۟�Qtg�]3W3x704 \,�5A�Ή��mh����B-��X~�u�8E���#��H�dG`acw�i���]�PT�c6�@<@����D���r=>�!ak'�pՈ�K�� }2�Rm���L�5O����0�tI�; ?T:y����ZN{���p@���*M�l���8��;����P�>Zd�����nhs��P���a�ݣ��d�]�d��"{=L)�S�,u����/3��e.�˜�j��ի-�*�o�'a�%r�'&�K�(��M4ǀ��u%�l��س�@��֑2hw��O�W"����#S�1aG�fXR͂��M�)B{w��f(��M�-��l���t�IC��Ļ'��l��.k���y���d]�`q/u��(��_��-�0�/1b�(���ީ�F�H랾m�i�����.���mm� �GM2�!F��5�C�]�)8���������\���ߖ0[7���jt�A��Jqκ�� �2�03����%��k����� ���3��P�G���@��J )y߄���.l�(Dl���ٸ�㟸�YMs]��"���@����l�<c28/�!B�Uj8F� 1M�\�|���R��_�ټ�(;2�.�l�EW��̹�$��ۢ���9� ��Hk�+��!%Zl��e�#�S�^�G$���]������e����$!�M[/��U� ���U�U�x�:zpA��e���~�S0����'!���0A�b0��զd)��E&f���u��,$`� �0�E2�����% N�ɒW7�s<�,��dZ���a`)�q?����t��*���,h�Nj�oz~tp��yB�dz?zA�!̈frj�D���B��khs�����j4� Ї��XE��,��*,3-}O'R�*��m�ywz�JȖ�Ӕs����@f��r��W���d�v�p�{6�8@��L�����#?��x�Q�;hx:�k��KD^ �j���ǫ1�j�oq.�&��cxB�0=���:Nh�L�{�5�I8�KK����2#g�A�r�p��}m�G�fY�o�?f\|`�p��F�H�v����#���r�G�E`m���#���@Fg��a%��lǃ��g�i��&���~�Zc7��y��⣅3|_�*(]�B��s�t������h��HL�%�^~N�Q�a� �TP��T����5��ף�|��١�L�Û0O0��g�#Ƭ��@���v��Vc�ԣͨ�h��si xC�l������-n�0z����q �����[ɽ�u�����{�ح?�U�6���̱�X\��N��4�`MjfiTo,l��4:�8��d\�I�&5�s ��3��Նr���]�u�K���&x�1�|[Q�l�K�00��=�� ����9Xs�N��1jIJ\6�pܴ揇~�5}����۞�(���Ti\�,�r8I��hMe��f�]e�����2Y��\쥯���&�.���w/��"����[�|����'FO��E��i�I�=f/g�3��3 øl�|o�D=����Q��6�it���a@��8�gM��y���^�� �t-�'�^/a�ݍEa;�;��
Sections
.text Size: - Virtual size: 624KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.beta0 Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.beta1 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ