Gridinsoft Logo

Winmm.dll Malware Packed Analysis

Updated 9 months ago
Checked by Malware Check
winmm.dll

Technical Analysis

File Name winmm.dll
File Type
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Scanner Version 1.0.192.174
Database Version 2024-10-11 00:00:25 UTC
⚠

Malware.Win64.Packed.cc

Malware family: Packed

Packed malware uses compression, encryption, or obfuscation techniques to alter code appearance and evade security detection. These methods modify the original malware structure to bypass signature-based detection systems and complicate analysis efforts.
N/A
Detection Rate
3,425,280
File Size (bytes)
2024-10-11
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
65fbcfeeeb2349543b40852a071a57af
SHA1
55e725af29707b5fc2e6223eb7221a48119e22c6
SHA256
47e1ca2cc1f871a61341f4db4cb825713f1526aca645f8437153c537e6b4772c
SHA512
298b9b354611a835f6a818fccc5f5b5e68b423a013e45d804e595d02e9284f45136437372c8581602bc2c42c57cd71e79a308d9614cac0601e086368910aaa2f
ImpHash
59b55678fa1594b54b3939b607a2dcb0

PE Analysis

Basic Information

▼
Image Base 0x180000000
Entry Point 0x1804a2058
Compilation Time 2023-10-22 08:11:25
Checksum 0x0034cf11 (Actual: 0x0034cf11)
OS Version 6.0
PEiD Signatures PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 3 libraries
kernel32, USER32, SHELL32
Exports 197 functions
Resources 1 Resources
Sections 13 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 188,768 bytes 98,304 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ C2B1074E41C6D4B77F2686C5FB36BE83
0x00030000 12,055 bytes 4,096 bytes 7.74 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ F1DA75A2BEB3C58219217AC26BDDF27C
0x00033000 88,442 bytes 38,912 bytes 7.94 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 136E3635E715A6C0CAFDF592EDB47A87
0x00049000 10,880 bytes 1,024 bytes 7.16 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 78AA85F25661E06D58FD10BCEC5C3B87
0x0004c000 9,588 bytes 5,632 bytes 7.65 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 8BFFC93F432AD832D72539E9F5CF3AF9
0x0004f000 348 bytes 512 bytes 4.53 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 5B1E37774AC360B551D029305E089A19
0x00050000 480 bytes 512 bytes 6.11 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6B3B9A7E631E9B8A0E3763EC6BFE0621
0x00051000 2,432 bytes 2,048 bytes 6.97 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 59ED1617636FB396B6FA778353296FE1
.edata 0x00052000 5,632 bytes 5,632 bytes 5.21 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 10763FD3112A586D450BBF474BBA467C
.idata 0x00054000 4,096 bytes 512 bytes 1.74 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 604B5C61EAFFBAB14565E25093DA39E0
.rsrc 0x00055000 4,096 bytes 512 bytes 4.72 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 907EA68DF12E0458BF5B9A6648BD9D91
.themida 0x00056000 4,505,600 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.boot 0x004a2000 3,266,048 bytes 3,266,048 bytes 7.95 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ DC1E3420B548E63CCD116A3F40161A90
Entropy Analysis Alert

5 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 1 (381 bytes)
Resource Type Count Total Size Percentage
RT_MANIFEST 1 381 bytes
100%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Malware.Win64.Packed.cc Removal

Gridinsoft has the capability to identify and eliminate Malware.Win64.Packed.cc without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware