shinobi[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
shinobi.exe
Size 26.0MB
Sample261110-gepdbsdb78
SHA256 2279325d35cf3dc17d60f2ff33f492beace42b290063f36f20cdc08908186bbc
MD5 ec5a3384579775f84007516b45407186
SHA1 28579604a4455da019ce28c80afcba81cd02e3bc
SHA512 2f018bcd554eb0bad6e80c9cab6e48840cc91462e92b45e23af8c0ac41bf64e10ecd9a9306ca17cf5cbbd0908f53d7b1f785ce0f35bb385f858ed726f406a316
SSDEEP 393216:sGyCbzJI+iP3qLdyGIHshpoeBD9IstHJMVCE9GgWCMF0fYlRbKfN+IZ78pckDq:sknt8qoYpogD9HtH2mlBKfRfb
TLSH
T16B572347A8E552F4C3C38F4051CB12DEA3D1B1AF56DA591E26CA18032561E5BCB8FE3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
shinobi.exe

File Explorer

shinobi.exe

.exe 26.0MB

shinobi.exe

IMPHASH 958bdc3b7ee788507e0c83df50a1ab8a
SHA256 2279325d35cf3dc17d60f2ff33f492beace42b290063f36f20cdc08908186bbc
MD5 ec5a3384579775f84007516b45407186
SHA1 28579604a4455da019ce28c80afcba81cd02e3bc
SHA512 2f018bcd554eb0bad6e80c9cab6e48840cc91462e92b45e23af8c0ac41bf64e10ecd9a9306ca17cf5cbbd0908f53d7b1f785ce0f35bb385f858ed726f406a316
SSDEEP 393216:sGyCbzJI+iP3qLdyGIHshpoeBD9IstHJMVCE9GgWCMF0fYlRbKfN+IZ78pckDq:sknt8qoYpogD9HtH2mlBKfRfb
TLSH
T16B572347A8E552F4C3C38F4051CB12DEA3D1B1AF56DA591E26CA18032561E5BCB8FE3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33891826

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

Virtual Size

531KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

Virtual Size

200B

Characteristics

Name

.voltbl

Size

Virtual Size

48B

Characteristics

Name

_RDATA

Size

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.jR$

Size

Virtual Size

15.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.r)J

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.O{w

Size

26.0MB

Virtual Size

26.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

422B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

shinobi.exe

oleaut32

kernel32

ws2_32

advapi32

generic