govnss
Static task
static1
Behavioral task
behavioral1
Sample
411e31c5a98dc0f8f5e21fbd5cc0f995.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
411e31c5a98dc0f8f5e21fbd5cc0f995.dll
Resource
win10v2004-20231215-en
General
-
Target
411e31c5a98dc0f8f5e21fbd5cc0f995
-
Size
68KB
-
MD5
411e31c5a98dc0f8f5e21fbd5cc0f995
-
SHA1
f3e513a45f14cecf93214ec87c20dad7b9f673d1
-
SHA256
e82529e34a07a1e7ac18551e12526fe87e61abee1dd80c5350df41b09388e588
-
SHA512
f6291d9f29111186e035a412d8b969f583d0d9aeb314aab872bdd14cff9ec4d65e44efd55d2ba72877bcf7afcacb4fde3caa12dccb90629996083b570ce7b163
-
SSDEEP
1536:Jxx8altpeAokCdm5fb/boZfeWPuFjlCkr:Jxx84tpeAzCdm5fb0pPmjskr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 411e31c5a98dc0f8f5e21fbd5cc0f995
Files
-
411e31c5a98dc0f8f5e21fbd5cc0f995.dll windows:4 windows x86 arch:x86
c83e31f147406ba2fd50815231a27c51
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
SetEvent
OpenEventW
SetCurrentDirectoryW
GetSystemDirectoryW
SetLastError
ExpandEnvironmentStringsW
GetStartupInfoW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
FindFirstFileW
FindClose
GetLocalTime
CreateThread
DeviceIoControl
SetErrorMode
GetVolumeInformationW
GetDiskFreeSpaceW
GetCommandLineW
GetDriveTypeW
SetVolumeLabelW
GetEnvironmentVariableW
Sleep
CloseHandle
SetStdHandle
SetConsoleCtrlHandler
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
SetFilePointer
GetLastError
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
MultiByteToWideChar
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
lstrcpyA
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
GetVersion
GetCommandLineA
RtlUnwind
GetDriveTypeA
GetFullPathNameA
GetCurrentDirectoryA
GetCurrentProcess
TerminateProcess
HeapFree
HeapAlloc
ExitThread
GetProcessHeap
msvcrt
memset
Exports
Exports
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ