internal[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
internal.dll
Size 4.8MB
Sample260916-prskhszhph
SHA256 4eaaad1731830246d3643fa6810a115145aaf94ffb0a1e04bce234c450e3fbd9
MD5 5e37fa0959d987655b76aa88d23de9f7
SHA1 2ce647bff2dc02c02dddeca70339b4bc6745e040
SHA512 2420dee4a6caa4bc192b773c6a94589bbc62268d359cb1d2e8f1424dac9c4a879d52a72537a05a67eb171de53f955cf3e2c2d56856108e5ddb537f033ce9c368
SSDEEP 98304:xPugxoFWsYfVFjJrxwSvlE0N2+0IPWp8yXc1VjzC4CDcY9in:kzFWPFBxwStE0Nj0IOp+VjzCvcY92
TLSH
T1A83633B17445B9CED67823BA0F6F52A206F7ABFA0C24254FB303C7A1495651CCBA47E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
internal.dll

File Explorer

internal.dll

.dll 4.8MB

internal.dll

SHA256 4eaaad1731830246d3643fa6810a115145aaf94ffb0a1e04bce234c450e3fbd9
MD5 5e37fa0959d987655b76aa88d23de9f7
SHA1 2ce647bff2dc02c02dddeca70339b4bc6745e040
SHA512 2420dee4a6caa4bc192b773c6a94589bbc62268d359cb1d2e8f1424dac9c4a879d52a72537a05a67eb171de53f955cf3e2c2d56856108e5ddb537f033ce9c368
SSDEEP 98304:xPugxoFWsYfVFjJrxwSvlE0N2+0IPWp8yXc1VjzC4CDcY9in:kzFWPFBxwStE0Nj0IOp+VjzCvcY92
TLSH
T1A83633B17445B9CED67823BA0F6F52A206F7ABFA0C24254FB303C7A1495651CCBA47E4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9146456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

Size

472KB

Virtual Size

1020KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

110KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

695KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

24KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

internal.dll

generic