Analysis Date2014-08-30 22:30:40
MD518357620987262da2885358505e61f09
SHA1c964dd81de5cdd3672ba64d2aa8fea2d99d896ba

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 27572020621616c03caeb0067574c802 sha1: df3fcb50f3b040b0091b1fd90062d59308ce58ca size: 120832
Section.rsrc md5: daa41411610dd9a27115e38807fe5feb sha1: 01dba6af74ccd7e71028925db4f187a17fc482ff size: 17408
Timestamp2008-07-26 21:24:57
VersionLegalCopyright: Copyright (C) 2003-2008
InternalName: Freegate
FileVersion: 0, 0, 0, 0
CompanyName:
PrivateBuild:
LegalTrademarks:
Comments:
ProductName: Freegate Application
SpecialBuild:
ProductVersion: 0, 0, 0, 0
FileDescription: Freegate Application
OriginalFilename: freegate.EXE
PackerPECompact 2.0x Heuristic Mode -> Jeremy Collake
PEhash72a2e7c3700f659ed313f1d4d9b224f96843a2a6
IMPhash09d0478591d4f788cb3e5ea416c25237

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Dgdebdtf ➝
5120
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePhysicalDrive0
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!

Network Details:

DNSw63.ziyoulonglive.com
Type: A
DNSw64.ziyoulonglive.com
Type: A
DNSw65.ziyoulonglive.com
Type: A
DNSw61.ziyoulonglive.com
Type: A
DNSw62.ziyoulonglive.com
Type: A
DNS22ef8d289eb7043d253073d530d19a7d1f88260d.b3aa51aebdeb4d250cab0895dec7925a512fae43.4.ziyouforever.com
Type: MX
DNSeb7166f3b00fd7ebd641338cf8097da1d616cdd6.9d1282784e9a0d7cc473ef493ea7d07560609b13.4.ziyouforever.com
Type: MX
DNSb14f45f1628308aa9d3316a225214fb88c28eed4.4f9e5d3905e82852195bdd503675c07b5d575533.4.ziyouforever.com
Type: MX
DNS3b90f858c3c3b49f29b3f8a1100be03206f7537d.eedee10cb168c6512c7172dacf53be3004fbea44.4.ziyouforever.com
Type: MX
DNSbdcbe6f8c109ed5c4c59249dddd6c7be80ac4ddd.ec14b8cfd4821a6de1ac55569e0b2f27943a9a52.4.ziyouforever.com
Type: MX
DNSd128189543d7b306d81810a1b008ba03ec4fb3b0.6ecae69540c32e518c7228eb806a644266a5eb2e.4.ziyouforever.com
Type: MX
DNS6598b81ada2862e90f70e9304052d62b58ff133f.f735377a97abd7c07c2844c3baa2d00ec465287b.4.ziyouforever.com
Type: MX
DNSa0bd80dc99934a59c254ba82431e73c29dda2bf9.b48e1fca5a8f84727f64e12a79022e09bbf15e23.4.ziyouforever.com
Type: MX
Flows UDP192.168.1.1:1031 ➝ 38.99.76.229:53
Flows UDP192.168.1.1:1032 ➝ 38.35.193.158:53
Flows UDP192.168.1.1:1032 ➝ 38.65.238.191:53
Flows UDP192.168.1.1:1032 ➝ 38.121.7.4:53
Flows UDP192.168.1.1:1031 ➝ 88.85.74.8:53
Flows UDP192.168.1.1:1032 ➝ 38.52.86.4:53
Flows UDP192.168.1.1:1031 ➝ 211.115.66.121:53
Flows UDP192.168.1.1:1032 ➝ 38.90.52.20:53
Flows UDP192.168.1.1:1032 ➝ 38.8.89.139:53
Flows UDP192.168.1.1:1031 ➝ 192.88.195.10:53
Flows UDP192.168.1.1:1032 ➝ 38.229.52.56:53
Flows UDP192.168.1.1:1032 ➝ 38.124.246.93:53
Flows UDP192.168.1.1:1032 ➝ 38.169.113.191:53
Flows UDP192.168.1.1:1031 ➝ 202.27.17.253:53
Flows UDP192.168.1.1:1032 ➝ 38.255.164.59:53
Flows UDP192.168.1.1:1031 ➝ 63.90.67.11:53
Flows UDP192.168.1.1:1032 ➝ 38.154.10.26:53
Flows UDP192.168.1.1:1032 ➝ 38.187.73.55:53
Flows UDP192.168.1.1:1031 ➝ 209.191.16.131:53
Flows UDP192.168.1.1:1032 ➝ 38.31.161.238:53
Flows UDP192.168.1.1:1032 ➝ 38.108.170.121:53
Flows UDP192.168.1.1:1031 ➝ 143.166.82.252:53
Flows UDP192.168.1.1:1032 ➝ 38.155.32.47:53
Flows UDP192.168.1.1:1032 ➝ 38.133.71.220:53
Flows UDP192.168.1.1:1031 ➝ 38.99.76.229:53
Flows UDP192.168.1.1:1032 ➝ 38.188.56.178:53
Flows UDP192.168.1.1:1032 ➝ 38.210.125.75:53
Flows UDP192.168.1.1:1032 ➝ 38.211.181.4:53
Flows UDP192.168.1.1:1032 ➝ 38.104.12.145:53
Flows UDP192.168.1.1:1032 ➝ 38.227.90.71:53
Flows UDP192.168.1.1:1032 ➝ 38.189.151.150:53
Flows UDP192.168.1.1:1032 ➝ 38.148.218.131:53
Flows UDP192.168.1.1:1032 ➝ 38.33.166.85:53
Flows UDP192.168.1.1:1032 ➝ 38.41.255.155:53
Flows UDP192.168.1.1:1032 ➝ 38.181.225.55:53
Flows UDP192.168.1.1:1032 ➝ 38.64.8.106:53
Flows UDP192.168.1.1:1032 ➝ 38.244.140.201:53
Flows UDP192.168.1.1:1032 ➝ 38.138.151.88:53
Flows UDP192.168.1.1:1032 ➝ 38.27.124.220:53
Flows UDP192.168.1.1:1032 ➝ 38.48.17.114:53
Flows UDP192.168.1.1:1032 ➝ 38.45.90.86:53
Flows UDP192.168.1.1:1032 ➝ 38.60.92.227:53
Flows UDP192.168.1.1:1032 ➝ 38.190.71.167:53
Flows UDP192.168.1.1:1032 ➝ 38.204.197.183:53
Flows UDP192.168.1.1:1032 ➝ 38.205.131.63:53
Flows UDP192.168.1.1:1032 ➝ 38.151.54.94:53
Flows UDP192.168.1.1:1032 ➝ 38.129.129.247:53
Flows UDP192.168.1.1:1032 ➝ 38.25.142.242:53
Flows UDP192.168.1.1:1032 ➝ 38.14.38.100:53
Flows UDP192.168.1.1:1032 ➝ 38.2.148.17:53
Flows UDP192.168.1.1:1032 ➝ 38.78.223.129:53
Flows UDP192.168.1.1:1032 ➝ 38.209.105.242:53
Flows UDP192.168.1.1:1032 ➝ 38.179.244.70:53
Flows UDP192.168.1.1:1033 ➝ 38.99.76.229:53
Flows UDP192.168.1.1:1033 ➝ 88.85.74.8:53
Flows UDP192.168.1.1:1033 ➝ 211.115.66.121:53
Flows UDP192.168.1.1:1033 ➝ 192.88.195.10:53
Flows UDP192.168.1.1:1033 ➝ 202.27.17.253:53
Flows UDP192.168.1.1:1033 ➝ 63.90.67.11:53
Flows UDP192.168.1.1:1033 ➝ 209.191.16.131:53
Flows UDP192.168.1.1:1033 ➝ 143.166.82.252:53
Flows TCP192.168.1.1:1034 ➝ 64.235.32.206:53
Flows TCP192.168.1.1:1035 ➝ 129.66.95.3:53
Flows TCP192.168.1.1:1036 ➝ 141.151.0.68:53
Flows TCP192.168.1.1:1037 ➝ 211.10.204.5:53
Flows TCP192.168.1.1:1038 ➝ 64.80.255.251:53
Flows TCP192.168.1.1:1039 ➝ 128.30.52.200:53
Flows TCP192.168.1.1:1040 ➝ 208.101.39.236:53

Raw Pcap
0x00000000 (00000)   02                                    .

0x00000000 (00000)   02                                    .

0x00000000 (00000)   02                                    .

0x00000000 (00000)   02                                    .

0x00000000 (00000)   02                                    .

0x00000000 (00000)   02                                    .

0x00000000 (00000)   02                                    .

Strings 
E.x
.
8..
.....
u.....
0, 0, 0, 0
040904b0
Comments
CompanyName
Copyright (C) 2003-2008
FileDescription
FileVersion
Freegate
Freegate Application
freegate.EXE
InternalName
LegalCopyright
LegalTrademarks
OriginalFilename
PrivateBuild
ProductName
ProductVersion
SpecialBuild
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
)@@*(,(
-082ZE
)#08#x
$"@0o?
`11D-9
~188881~
1.aWPR
\1Nq4*43
1nRI{r
=1Qi>y
1tWH,,
=1"Tx:.
1u4J_G26
+1<XN>WZEo
20yy.J$?
2ftRA7,ac
*2I1EE
2l94m<
2\<(-MUUVVVV
[2UMCR
2-(Y8\2u
37/e\l
>|3\>lA
%3{R9v
3S-|mHY:mZ{M
@4B}k)
4%g{=u
\5oZ[9
6EZ.#s
6kzen[
6uB$?WW
7C"gh{
]7gJ_Uh
7(N-'k
~8880000/01
8avqdO
8h1B^=
!8=/#H1z
8/y@+#u
	9#2tz
9d-P6kK)p
A[5)la
A}A{N)
ABb_CaJo
/aKn_>[
aKQoJ9
a<"U$?:e-}
b[bI(	0
BgGBy?
bh=fKpj
b'(?}K
!/BX*Y
Cb`VX]
(cCd@s
Cj^&0g
,.CKO-
D3tu@gBc
D3/}:wm
[Dd5DRjn<Lm#
Dp2)B){`tL(y
D$t4|H	SUV
d>$Y71#QU
e@1E	^
>E>6Eq
~<e9J].*
$/EF6xZh&
_EmkOe
	)eNFg
:e<'Oe
[eRiex
e+!va :
F0t&_'
FABVzH
F+asPXG|
fB-q	>
FB>{`Xh
FIfAsf8
Fj2zW0
F!uwp*
.	fxB2
fXok^58_zk
g6hJR=
G''+9T
G}b,mlh
+GBTq9i
GetProcAddress
g>%GOzQB
|$ GlC
g!oP0Q
gQ7>rW)
gS+;#E
~}H,(>&0)
H2$cXg
"H]5NG
hb~!hngxD
hdrI|&
hdWTZis
hhiQ6,
H	 pKZS
iBc'D 
-I-@'H
i@@@,-P
irtualA
i@;ZYd
}j/<ac7b
jC>&rHL
j&,GIO<
jiYgdm
&\JLqPi
jS=^>rNPy
%JTw_(
kernel32.dll
Kh9Tt_
K;j*WD
kpAW<c
`KRZ5H
ksum on
/KZH<'
@L-!2+
]~)l;C
LdeG1;
(LdUtxR
;LlIuU
LoadLibraryA
lQ:B'U
m1:c|}
Mf@yJT
MLKDc: 
+`M{NGq
ms9vbu
mV	wmxdEl]
MWKjUV6W
!mz{"~1
N34;2#
n(<5A~
n5y'ID
nA:'x?5
	Nu1(*t&
^NwzFV
@%]^^o
o5I<1H
?&Obo?
oDd\[p`
[Ok-d`
oLLc&C<
o@pf8]
OqLHZ']B3c
oRNEpc
OUD=4:a
)-^%p`
p>1l0)
@p4lN?
PECompact2
p_hUVX
`;PIc)
PiC{oF
pP 2E0e
puBLM>I
P-@U@VAVX
	]'=pX
[Q8KkZh<
qefn&F{
QKW)6#
%%qLwt
{qmKY_\
qQ\=Zj
QX]kfmgzC
q/zrN$t
,.:!_r
@R01_t
r8$BP[
RB#t<U
RHR<U;
rl$`pt
rr7vX+
RUOqJ5
]\rv=F
S5<kdy
/]SBJlK2B
?sIT</b$Q!f
sMG} BUJ
:;Snio
SOosD/`J
S;-+P5**
~S&rDL
sXhkMY
%sy5_l3\bz 
)t`,3`H
{T|5L@
\^/+tC
TEbl:-
!This program cannot be run in DOS mode.
TiOzIq
<tLzWn
UEd-'J]
UF87D*
UG]#c.lX
umxxmu
&u#PA-
USQWVR
|]UvM/
UVVVWX
UwII$]3
VirtualAlloc
VirtualFree
"V=j1_
vjBI\B
vky<xBUs
 v!|\l
"_vQhF
`#.'(vs
w1I8DJw
w64zIf
(/W{}8
w'8N{>
wjqT,i
w	P+@G
W%??%q
$	WUx 
wXZ9bk
-Xn]/t\
![X O+
+xp]zED
Xwv*%g
(,XZ*pP
y3}r9%
Y)cVjb?
y`E7Y$
_yFlTTSg
y"hySO
yKRH{#
"yPcv5
Z4 f]-
.zBbms%
=z`f}E
\>zpY'
Z^_Y[]