internal[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
internal.exe
Size 25.9MB
Sample260810-m8hersstes
SHA256 b7dc841a8ebdedd3651301da7c7ef6e56f87c5f5d452ac3c181e95628fec358b
MD5 88a97474b28c7dc82b3637392a20b42b
SHA1 395959e5c85197bb115a219f8660ae085e962c6e
SHA512 15b68b7a61aa9e092f1102dd8dceaa0f90ac3154582de4d56f4ca78ad7b141ce47786c0c4c1086d8480c0f51f0950fffcec2c4f54c97352259fc7e648fe06dbe
SSDEEP 393216:9admtQ5sfAu+gBxOCrI/IVPR4jEji7rc4vZAJpCEGQP0bDHFgCS6YPa70YV7MGyP:95j4u+gBMVqRQ7rlviSbDHyYYUM
TLSH
T12457339642D5B2DCCBC18640374580CE78D4A49D40FEAD793FCF8D56EA28D8E058AEB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
internal.exe

File Explorer

internal.exe

.exe 25.9MB

internal.exe

IMPHASH af2182414f8a835b2080c5bbd875a6d9
SHA256 b7dc841a8ebdedd3651301da7c7ef6e56f87c5f5d452ac3c181e95628fec358b
MD5 88a97474b28c7dc82b3637392a20b42b
SHA1 395959e5c85197bb115a219f8660ae085e962c6e
SHA512 15b68b7a61aa9e092f1102dd8dceaa0f90ac3154582de4d56f4ca78ad7b141ce47786c0c4c1086d8480c0f51f0950fffcec2c4f54c97352259fc7e648fe06dbe
SSDEEP 393216:9admtQ5sfAu+gBxOCrI/IVPR4jEji7rc4vZAJpCEGQP0bDHFgCS6YPa70YV7MGyP:95j4u+gBMVqRQ7rlviSbDHyYYUM
TLSH
T12457339642D5B2DCCBC18640374580CE78D4A49D40FEAD793FCF8D56EA28D8E058AEB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37974474

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

13.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Protd

Size

Virtual Size

490B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Samar

Size

Virtual Size

794B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.UXI00

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.themida

Size

512B

Virtual Size

320B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

25.9MB

Virtual Size

25.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

internal.exe

urlmon

advapi32

kernel32

user32

shell32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic