D:\VS2015\DunRunGate\TMP1\RunGate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a41db9d89e7e189ed5dd6129fd97e7dd72d414340820ac1c16793b7471dcdc13.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a41db9d89e7e189ed5dd6129fd97e7dd72d414340820ac1c16793b7471dcdc13.exe
Resource
win10v2004-20240802-en
General
-
Target
a41db9d89e7e189ed5dd6129fd97e7dd72d414340820ac1c16793b7471dcdc13
-
Size
1.5MB
-
MD5
7b4632b7a429c089e1adc4ebf96ee7b8
-
SHA1
854ff07f269814bef74cdec29423f6d66c47e5c5
-
SHA256
a41db9d89e7e189ed5dd6129fd97e7dd72d414340820ac1c16793b7471dcdc13
-
SHA512
d3f96a9994e9f7d274258b2c7e12dd4e30c19d0cd706f076f2572348ae40fea7aea70fa52ed3f1771d0716f2049a1d1a20c77fb09044ba0e3d9b010fc3d6854d
-
SSDEEP
24576:htO6D503i9U83awv5pEqlkGsbm/03dpxZiI6CIPaCGwdnkiTWb2vNoz++qEZ9Qfh:rO6DI4Wwv5ZnIrx4H1Z1oK+qB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a41db9d89e7e189ed5dd6129fd97e7dd72d414340820ac1c16793b7471dcdc13
Files
-
a41db9d89e7e189ed5dd6129fd97e7dd72d414340820ac1c16793b7471dcdc13.exe windows:5 windows x86 arch:x86
d858e390f7c85ddca49f7b76f76b8725
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
psapi
GetProcessImageFileNameA
kernel32
GetVersionExA
CheckRemoteDebuggerPresent
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
FindWindowA
gdi32
DeleteDC
comdlg32
GetOpenFileNameA
advapi32
RegQueryValueExA
shell32
DragFinish
ole32
CoTaskMemAlloc
oleaut32
VarUI4FromStr
comctl32
ord6
ws2_32
ioctlsocket
wininet
HttpSendRequestA
iphlpapi
GetExtendedTcpTable
Exports
Exports
�Z��ܣ`x���+�8� ����ϼ�G�m܈+�3�.6={����7K(�m��=����v�Ȟ����D�I������n�B�k�mpd�|3]��\R��.7`���p��@uG�#���'韈��sB��揦`�GI���ݚ�s|���!�$�GO-)@���N{=�T����QG���{b�Bځaډ��?);q�w����I�a��ΘL_'LL>��p!�̬��}GH�h������5������u��WS�m���� "�4ᥭu����xߌ�>Z�lK�G�,�FR���|��SB�D���b�U�����J��t�� [&N�1Q-�փrVhnak4��f�#{ �x@���w8����C�EA�Z�@�J���l�:mS���[2���?'C���{R�p������)��x0�����x~N��ؚ� ��A�r������+D�K��E���7��ڛ��$� AJ�{ϠI��Y(��Z��ӯ��>A,�;%}pV��[?�Wu��-���N�E:�f�,���U�G�'�����$�@����[�D���H�U'�-�i��%0��ZEҌ���j�����U� Qf�YFy����I�D������>�-o!8�5��8Aoe4>俣��QG�%$PU����S�m�Ɖ��-@�w'�6hF����sc���1P�YC��o�}��3���\���y4= .��m���0U2k�B�2J���0��ƛ��>� �-�lRT�5W����R%k�����{��C������z@�)�p�'l;h�Q�=*���ӷN�� �fWi����̗���\�-��xG&S0�4��O�/��}�f�]PS�nMa���r#H���"466��-���?�c�_�IY�'�ՈU� ������@k����c֎� /��t`n$��j*?J���� b�pJ ���u�}�<�@14���z���UH�R�e�.5%��������'��$�8��Ό���]n㠠Zu�ɫmt�ThnJN����%�.̮�%S��}��3Rf+r�p���[���e��)��u$��ѳ���{���]߆b����S��� {g�zt ��W�8u{CzA���E�"�#����<�[��S��i\N���!�c D���[��d5ĺ�8��lZ�~)�W1T$�g?�n`{ Wp�ݴ!���-o#K��6u6�g=���y��ߎ����Y'W)!��X������bƛ��j�侧��{h�����~�c��u�:��># +R��EPoC��#;�j���|�M9�Ũ���C��v��!�����P�"����쑾�#������7h'ĵ��������b^S�m�0ltQf��`6cm{Aq���eO*ɭ�C�\�f:ņN v7=-���m�4���X ��?����*�yMD��G�/��T��ClG~ҧc�xM��u��uә����Ͱ�)`����������������h�~&��p�i"����z��,�*B�1\sު���a 49wdM�����]�^��6!N�����!*�����`T-m{X�����^Y���V'}���DR�1&�j�q���ס���z�Hh��*g��G�Ы-���m�1`���,����~z�Z+�A� $+�ҳ/DZ��T�:"sgLC���+�!}b{D���^�s�Q.�8R�%m(�4l;B&[cC�Ī?*��Tᙷrz$Z���6G����@`� �<�_�e8w�X�'��ޘwY�l�&�Awj��Ӓ�)��{� n�>EY�F6���Gn��+�t���K��>Z�Z|������J���O�o��"L�{6�x`�.و���.Q<�ҊW��7D��lr��J�E��S���iag���������r'��$��?(>a@ь��.�d�M!+J�{�l9>�T,]ܾ�OU�g�"�9$IX(ϑ�')'����Q��1ko�Qr� �G��}Yߕ5�%��p��SBG浡C����e�p���8ױ�@��摈1�mz\�ʆ����KFC�)�w^���[M�ߊ�*�wxŪ��_�ai�H ��DM��M�ú����������Ʊv9��YKɁ��#�Nm���E�I����8��ʈE���`xU4��F�{9�j#�gB���0�̌��<iۛ�t��Ej����s��4p�sKC��#vǞq�ɘt�iIzA䋟o�ć���ƿ��]��C�Z/�e��ha��n<P\���`��z���{oG�� eV� 7C�7L@�@�)����Pu�*O���S��p*�ͻ�`�P�rI5�#�Q气�Y3��_.���ã˜�ܐ�����R�����g���h���������9;���]LS�2��4�Bf�h*�|��a�O����\Ȟ�v8W�8�S:���P��-�l53.>��ħ����:i��32���ӏ�����i�AG�eJ������M��!>4����/�m��� ��K0����P�4���c�X^�����՛0�/�y�m;���$S���T�#�\b2q7 ���� ����� ��D��G�^�~��>����M�* G�:$����?�h 0NV5�z�FHLM� �;@�z��>3�j��5Og������M(��{'!��?���Y:C���k"�Z�b<y�~$��ԁ����c|�����/V�ӊF��k ��z��P��/쩸̖�#�� w�P�����"��'߿C�i�^6r���u�n}5آ(A�FԔN�� ���S�I��[pb��~ ������4��\����r��N&M꒟����k�C5������7}��'^96X~@y8�sC؝^Dut��k ?T���!���UV��D�[��!��KbDk����2�ӱ��+�1?˳�P����ʐYۮ=9�ƒ�'B������0,���T?p�;F5σ%4�w��0��~���0������"��iC嵴T" ����Di��5��G���8Kf��d��-ߥ� �9P�ba�������*�=-�o����k4~g����A��L/2Tp *��]|B�[�'�' ���I��La��R��<D�-eT�Ʀ��/B*�6Ri,d1�e[�I)�?:I��N.{�O�#�Px�Q���
Sections
.text Size: - Virtual size: 642KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.beta0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.beta1 Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ