SnowAC[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SnowAC.dll
Size 4.1MB
Sample260926-28q48stdkg
SHA256 d5d9e754f2bc9e9d8c91c0a15cc99639ad45547a7e233e5b15d5376d5061bbaa
MD5 a4b2d22dab4b4e6f1506f5c0e09bdb72
SHA1 37308522e68b9fcd01b69e91bc0cc148d15db5c8
SHA512 6c97b7e4949b0693565fc3a3bd26acc9a90da3cc2a0dfe899ee646eddc92784d5f4b06e2acd5eae13627b73c234bac87aa4daecf4ae9ab65f39296a6d7736e07
SSDEEP 98304:St+wahoXyp30UusJTWu6T+Ulln1OFCjdqlHo:o+wLBsRsZdZjdqlHo
TLSH
T17A16338FECE6E1B4D83B43B4FE5207DC8527C75ECF1FD09AA469429E44AF00B5695282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SnowAC.dll

File Explorer

SnowAC.dll

.dll 4.1MB

SnowAC.dll

SHA256 d5d9e754f2bc9e9d8c91c0a15cc99639ad45547a7e233e5b15d5376d5061bbaa
MD5 a4b2d22dab4b4e6f1506f5c0e09bdb72
SHA1 37308522e68b9fcd01b69e91bc0cc148d15db5c8
SHA512 6c97b7e4949b0693565fc3a3bd26acc9a90da3cc2a0dfe899ee646eddc92784d5f4b06e2acd5eae13627b73c234bac87aa4daecf4ae9ab65f39296a6d7736e07
SSDEEP 98304:St+wahoXyp30UusJTWu6T+Ulln1OFCjdqlHo:o+wLBsRsZdZjdqlHo
TLSH
T17A16338FECE6E1B4D83B43B4FE5207DC8527C75ECF1FD09AA469429E44AF00B5695282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8073304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Name

Size

545KB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

109KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

23KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

159B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.exports

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.imports

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.themida

Size

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

16B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SnowAC.dll

generic