The c shibie exe File Malware Analysis

Technical Analysis

File Name	c_shibie.exe
File Type	PE32 executable (console) Intel 80386, for MS Windows
Scanner Version	1.0.229.174
Database Version	2025-12-03 10:00:35 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	5af3b2056f4354251d6ce03ec5e15812
SHA1	a6bd4abaf6a9543043bc423c115fc6610c5fa2c1
SHA256	a4bad4856ae6c5cb45db607291b95f1092f9c48419726c0aa4bdf6a0f179d94a
SHA512	b4f5215935bf9fa5145c87651db3ea2a7433efb91e074317ba4a0287f715d219f4f60c067bcddc52707a5ae3955d35680b3121f5fb3ff462ece25bc1e21a2702
ImpHash	a74aba6c25b6ca64dd1e51a63a1ac274

PE Analysis

Basic Information

▼

Image Base	`0x00400000`
Entry Point	`0x0040b22e`
Compilation Time	2025-11-22 14:44:13
Checksum	0x00000000 (Actual: 0x00310294)
OS Version	6.0
PEiD Signatures	`PE32 executable (console) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	10 libraries SHELL32, KERNEL32, VCRUNTIME140, api-ms-win-crt-runtime-l1-1-0, api-ms-win-crt-heap-l1-1-0, api-ms-win-crt-convert-l1-1-0, api-ms-win-crt-stdio-l1-1-0, api-ms-win-crt-string-l1-1-0, api-ms-win-crt-math-l1-1-0, api-ms-win-crt-locale-l1-1-0
Exports	0 functions
Resources	2 Resources
Sections	5 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	44,279 bytes	44,544 bytes	6.50 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`AAEF39C873D4D6F077828C15AB6A2253`
`.rdata`	`0x0000c000`	18,166 bytes	18,432 bytes	6.90 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6D9CA0E4B2B33455A18DEFAC58C470A5`
`.data`	`0x00011000`	156,720 bytes	512 bytes	0.37 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`FA8ADD615B9FAEBE76B9217D8E0414A9`
`.rsrc`	`0x00038000`	3,113,740 bytes	3,113,984 bytes	8.00 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`168B37666A3E8F2A653A6F5C92E9D3A6`
`.reloc`	`0x00331000`	1,336 bytes	1,536 bytes	6.07 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`6EB1EBDB0A5E03381F80F51FFCA8AB90`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 2 (3,113,577 bytes)

Resource Type	Count	Total Size	Percentage
RT_RCDATA	1	3,112,312 bytes	100%
RT_MANIFEST	1	1,265 bytes	0%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The c_shibie.exe File Analysis