shrimpware[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
shrimpware.exe
Size 2.6MB
Sample260920-28ca3svtfv
SHA256 ee3856e2582af0ea91144a82ea7b2abcd70e0b947e8973a12f0d34af8bc2469c
MD5 481e69f2e2c8b308833ea3d7beacf4e7
SHA1 473b497f23608efa935aa009d2146e7a134d5fb1
SHA512 ffc110afd26406847e580842404c5c0ea0e241f03f0186939d32d43eb7271723297155fe7505eadffd66e84542b7b7e35bc7be454325f7eb7b948696a10414c8
SSDEEP 49152:Drp91VKFQma+Mn1C4mLaSJtrBT1mq9tCVpT/qyj:7T21J3cq9oV
TLSH
T104D5AE17F35643ACD52A9838CBA2C356F33278506B2192CF63A41A595F6B2F40EB7781
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
shrimpware.exe

File Explorer

shrimpware.exe

.exe 2.6MB

shrimpware.exe

IMPHASH 0a5a996b44c2bc759c27f9ee584c56e2
SHA256 ee3856e2582af0ea91144a82ea7b2abcd70e0b947e8973a12f0d34af8bc2469c
MD5 481e69f2e2c8b308833ea3d7beacf4e7
SHA1 473b497f23608efa935aa009d2146e7a134d5fb1
SHA512 ffc110afd26406847e580842404c5c0ea0e241f03f0186939d32d43eb7271723297155fe7505eadffd66e84542b7b7e35bc7be454325f7eb7b948696a10414c8
SSDEEP 49152:Drp91VKFQma+Mn1C4mLaSJtrBT1mq9tCVpT/qyj:7T21J3cq9oV
TLSH
T104D5AE17F35643ACD52A9838CBA2C356F33278506B2192CF63A41A595F6B2F40EB7781
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

665264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

shell32

ShellExecuteA SHGetFolderPathA ShellExecuteW ord680

user32

PeekMessageA DefWindowProcA PostQuitMessage RegisterClassExA DispatchMessageA TranslateMessage ShowWindow SetLayeredWindowAttributes SetWindowPos SetFocus GetAsyncKeyState GetSystemMetrics UpdateWindow SetActiveWindow CreateWindowExA LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetWindowDisplayAffinity keybd_event SetWindowLongPtrA GetWindowLongPtrA MessageBoxA SetForegroundWindow

gdi32

GetStockObject

advapi32

RegSetValueExA RegCloseKey RegCreateKeyExA SetSecurityInfo InitializeAcl

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom

ntdll

RtlCaptureContext RtlUnwind RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry

ole32

CoCreateInstance CoInitializeEx CoUninitialize

crypt32

CryptUnprotectData CryptProtectData

kernel32

LoadLibraryExW VirtualProtect HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent WriteFile TerminateProcess IsProcessorFeaturePresent ReadFile WriteConsoleW GetFileType GetStdHandle FreeLibraryAndExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError ReadConsoleW IsValidCodePage GetACP GetOEMCP FlushFileBuffers GetConsoleOutputCP CompareStringW LCMapStringW GetLocaleInfoW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW ExitThread GetConsoleMode GetFileSizeEx SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA HeapReAlloc HeapSize SetEndOfFile LoadLibraryA GetFileAttributesA CloseHandle Sleep GetCurrentProcess ExitProcess CreateThread GetCurrentThread SetThreadPriority GetThreadContext GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource FindResourceW LocalAlloc LocalFree MoveFileA GetCurrentProcessId WideCharToMultiByte DeleteFileA DeleteFileW GetTempPathW WaitForSingleObject GetExitCodeProcess CreateProcessW CreateToolhelp32Snapshot Process32First Process32Next GetEnvironmentVariableA GetLastError MultiByteToWideChar GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary WakeAllConditionVariable GetLocaleInfoA Process32FirstW Process32NextW FormatMessageA GetLocaleInfoEx GetSystemTimePreciseAsFileTime WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared SleepConditionVariableSRW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 AreFileApisANSI GetModuleHandleW CopyFile2 GetFileInformationByHandleEx RtlPcToFileHeader RaiseException SetFilePointerEx

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

Name

.text

Size

881KB

Virtual Size

880KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

248KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

242KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

shrimpware.exe

d3d11

dwmapi

shell32

user32

gdi32

advapi32

winhttp

bcrypt

ntdll

ole32

crypt32

kernel32

imm32

d3dcompiler_47

generic