Shrimpware (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Shrimpware (1).exe
Size 2.3MB
Sample260917-d2axnswtby
SHA256 bbe31d2b52d43c964de6750d558a22035d56bd6d9e2017d28314bccbea1468a5
MD5 534dc1a928024804fe3d2cd68335d9cd
SHA1 4beace0239ffdcc43bb9e9edb803c088f8110389
SHA512 419ce84c07f76de4fbbdcb245af21b18e9eb7e70820881de0ba3b414573e92c2a9f66e848063c3f5b81c3e693c78adca26e98583981c5268d8654c00966f6c58
SSDEEP 12288:/zRkG+sKnx5kDXvUx+AwpUf+XApiaNsPWBybSNenkla6xYXutIs+WIjmGHFDXcey:tkG+BnxYXdAZ+WIhNXcePKWan7uHC
TLSH
T1F0B50A4023244061C4B2367DE26FB91A6B7DB14F33E02BD712EDBB09D99B95CC2752E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Shrimpware (1).exe

File Explorer

Shrimpware (1).exe

.exe 2.3MB

Shrimpware (1).exe

IMPHASH e535c89402e798b8227885d987927217
SHA256 bbe31d2b52d43c964de6750d558a22035d56bd6d9e2017d28314bccbea1468a5
MD5 534dc1a928024804fe3d2cd68335d9cd
SHA1 4beace0239ffdcc43bb9e9edb803c088f8110389
SHA512 419ce84c07f76de4fbbdcb245af21b18e9eb7e70820881de0ba3b414573e92c2a9f66e848063c3f5b81c3e693c78adca26e98583981c5268d8654c00966f6c58
SSDEEP 12288:/zRkG+sKnx5kDXvUx+AwpUf+XApiaNsPWBybSNenkla6xYXutIs+WIjmGHFDXcey:tkG+BnxYXdAZ+WIhNXcePKWan7uHC
TLSH
T1F0B50A4023244061C4B2367DE26FB91A6B7DB14F33E02BD712EDBB09D99B95CC2752E6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

527552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

gdiplus

GdipGetImageWidth GdipAlloc GdipFree GdipCreateBitmapFromStream GdipBitmapLockBits GdipBitmapUnlockBits GdipCloneImage GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipDisposeImage

winhttp

WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect

bcrypt

BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptOpenAlgorithmProvider

ole32

CoUninitialize CoCreateInstance StringFromGUID2 CoInitializeEx CoSetProxyBlanket

oleaut32

VariantInit SysFreeString VariantClear SysStringLen SysAllocString

kernel32

SetUnhandledExceptionFilter InitializeSListHead GetTempPathW CreateDirectoryA GetCurrentProcessId GetSystemDirectoryA CreateFileA OpenProcess GetCurrentThreadId GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive VirtualAlloc VirtualFree SetLastError GetFileAttributesExA GetModuleFileNameA CreateFileW DeviceIoControl LocalFree GetLastError FormatMessageW DeleteFileA GetTempPathA CreateProcessA CloseHandle WaitForSingleObject CreatePipe SetHandleInformation ReadFile GetModuleHandleW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter Sleep

user32

GetMonitorInfoW PeekMessageW TranslateMessage PostQuitMessage GetDesktopWindow UpdateWindow GetKeyState GetMessageExtraInfo MonitorFromWindow ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture DispatchMessageW SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData CreateWindowExW DestroyWindow DefWindowProcW MoveWindow SendMessageW GetWindowRect ShowWindow RegisterClassExW UnregisterClassW

advapi32

RegOpenKeyW RegCloseKey RegSetKeyValueW RegCreateKeyW RegDeleteTreeW

shell32

ShellExecuteA

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext ImmSetCandidateWindow

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Query_perf_frequency ?_Xbad_function_call@std@@YAXXZ _Thrd_id ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Mtx_unlock _Thrd_detach _Query_perf_counter _Xtime_get_ticks _Thrd_join ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A

shlwapi

PathRemoveFileSpecA PathFileExistsA ord12

ntdll

RtlInitUnicodeString NtLoadDriver NtQuerySystemInformation RtlAdjustPrivilege NtUnloadDriver

dbghelp

SymFromName SymUnloadModule64 SymLoadModuleEx SymInitialize SymSetOptions SymCleanup

urlmon

URLDownloadToFileA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strstr __std_terminate _CxxThrowException memchr __std_exception_destroy __std_exception_copy memset memmove memcpy wcsstr __C_specific_handler __current_exception __current_exception_context memcmp

api-ms-win-crt-stdio-l1-1-0

fread __stdio_common_vsprintf _wfopen fwrite __stdio_common_vfprintf fputc fseek fclose fflush __acrt_iob_func __stdio_common_vsscanf __stdio_common_vsprintf_s fgetc __p__commode _set_fmode ftell fgetpos setvbuf ungetc fopen_s fsetpos _fseeki64 _get_stream_buffer_pointers

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-runtime-l1-1-0

terminate _get_initial_narrow_environment _initterm _initterm_e exit _errno _exit _crt_atexit __p___argc _seh_filter_exe _beginthreadex _set_app_type __p___argv _register_onexit_function _initialize_narrow_environment _cexit _configure_narrow_argv _initialize_onexit_table _c_exit system _register_thread_local_exe_atexit_callback

api-ms-win-crt-convert-l1-1-0

_itoa_s strtoll wcstombs_s strtoull strtod

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64_s _mkgmtime64

api-ms-win-crt-string-l1-1-0

strncpy_s _stricmp isspace strcmp strlen strncmp wcslen strncpy

api-ms-win-crt-filesystem-l1-1-0

_wremove _unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

cosf acosf fmodf __setusermatherr sinf sqrtf ceilf