Shrimpware[.]exe | Triage™

Resubmissions

16/09/2026, 06:21

260916-g4s3tazz9m10

16/09/2026, 04:38

260916-e9l6cazv4k10

Sharing

Copy URL Twitter E-mail

General

Target
Shrimpware.exe
Size 2.3MB
Sample260916-e9l6cazv4k
SHA256 d421e44e4d3d19621afc8b21d728170a8f452acdc68554b0b1d166a8d451036a
MD5 cdf34353ce91dba08fb7e1810251fa41
SHA1 6d1d37f5e6e3f03a4387b719f118794e0cc123dc
SHA512 dc9153092cf153e9e8f4ade4467d5b4581f8af439a1be0a6762653286f2478ec74f5913d5c0eb36ca3b009fa897c7d4329f0f76dd22570ee5efcab87e75aedb9
SSDEEP 12288:ZPfRGvNDtxfQQ+sgO0xpUf+XApiaNsPWBybSNenkla6xYXuthiAczdXCLEOOTKIL:dRGvNtqQh0rAczqEOOTKI9ncXnC
TLSH
T19DB5094023244061C4B2367DE26FB91A6B7DB14F33E02BD712EDBB09D99B95CC2752E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Shrimpware.exe

File Explorer

Shrimpware.exe

.exe 2.3MB

Shrimpware.exe

IMPHASH e535c89402e798b8227885d987927217
SHA256 d421e44e4d3d19621afc8b21d728170a8f452acdc68554b0b1d166a8d451036a
MD5 cdf34353ce91dba08fb7e1810251fa41
SHA1 6d1d37f5e6e3f03a4387b719f118794e0cc123dc
SHA512 dc9153092cf153e9e8f4ade4467d5b4581f8af439a1be0a6762653286f2478ec74f5913d5c0eb36ca3b009fa897c7d4329f0f76dd22570ee5efcab87e75aedb9
SSDEEP 12288:ZPfRGvNDtxfQQ+sgO0xpUf+XApiaNsPWBybSNenkla6xYXuthiAczdXCLEOOTKIL:dRGvNtqQh0rAczqEOOTKI9ncXnC
TLSH
T19DB5094023244061C4B2367DE26FB91A6B7DB14F33E02BD712EDBB09D99B95CC2752E6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

527376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

gdiplus

GdipGetImageWidth GdipAlloc GdipFree GdipCreateBitmapFromStream GdipBitmapLockBits GdipBitmapUnlockBits GdipCloneImage GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipDisposeImage

winhttp

WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect

bcrypt

BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptOpenAlgorithmProvider

ole32

CoUninitialize CoCreateInstance StringFromGUID2 CoInitializeEx CoSetProxyBlanket

oleaut32

VariantInit SysFreeString VariantClear SysStringLen SysAllocString

kernel32

SetUnhandledExceptionFilter InitializeSListHead GetTempPathW CreateDirectoryA GetCurrentProcessId GetSystemDirectoryA CreateFileA OpenProcess GetCurrentThreadId GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive VirtualAlloc VirtualFree SetLastError GetFileAttributesExA GetModuleFileNameA CreateFileW DeviceIoControl LocalFree GetLastError FormatMessageW DeleteFileA GetTempPathA CreateProcessA CloseHandle WaitForSingleObject CreatePipe SetHandleInformation ReadFile GetModuleHandleW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter Sleep

user32

GetMonitorInfoW PeekMessageW TranslateMessage PostQuitMessage GetDesktopWindow UpdateWindow GetKeyState GetMessageExtraInfo MonitorFromWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture DispatchMessageW SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData CreateWindowExW DestroyWindow DefWindowProcW MoveWindow SendMessageW GetWindowRect ShowWindow RegisterClassExW UnregisterClassW

advapi32

RegOpenKeyW RegCloseKey RegSetKeyValueW RegCreateKeyW RegDeleteTreeW

shell32

ShellExecuteA

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetCandidateWindow

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Query_perf_frequency ?_Xbad_function_call@std@@YAXXZ _Thrd_id ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Mtx_unlock _Thrd_detach _Query_perf_counter _Xtime_get_ticks _Thrd_join ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A

shlwapi

PathRemoveFileSpecA PathFileExistsA ord12

ntdll

RtlInitUnicodeString NtLoadDriver NtQuerySystemInformation RtlAdjustPrivilege NtUnloadDriver

dbghelp

SymFromName SymUnloadModule64 SymLoadModuleEx SymInitialize SymSetOptions SymCleanup

urlmon

URLDownloadToFileA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr __std_terminate _CxxThrowException memchr __std_exception_destroy __std_exception_copy memset memmove memcpy wcsstr __C_specific_handler __current_exception __current_exception_context memcmp

api-ms-win-crt-stdio-l1-1-0

fread __stdio_common_vsprintf _wfopen fwrite __stdio_common_vfprintf fputc fseek fclose fflush __acrt_iob_func __stdio_common_vsscanf __stdio_common_vsprintf_s fgetc __p__commode _set_fmode ftell fgetpos setvbuf ungetc fopen_s fsetpos _fseeki64 _get_stream_buffer_pointers

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-runtime-l1-1-0

terminate _get_initial_narrow_environment _initterm _initterm_e exit _errno _exit _crt_atexit __p___argc _seh_filter_exe _beginthreadex _set_app_type __p___argv _register_onexit_function _initialize_narrow_environment _cexit _configure_narrow_argv _initialize_onexit_table _c_exit system _register_thread_local_exe_atexit_callback

api-ms-win-crt-convert-l1-1-0

_itoa_s strtoll wcstombs_s strtoull strtod

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64_s _mkgmtime64

api-ms-win-crt-string-l1-1-0

strncpy_s _stricmp isspace strcmp strlen strncmp wcslen strncpy

api-ms-win-crt-filesystem-l1-1-0

_wremove _unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

cosf acosf fmodf __setusermatherr sinf sqrtf ceilf