C:\Users\vladi\Downloads\44CALIBER-main\44CALIBER\obj\Release\Insidious.pdb
General
-
Target
Nursultan.exe
-
Size
274KB
-
MD5
67ae5d2bf3d99f6e8592fefffaf524ae
-
SHA1
d9c3dd4e558299843182782832423422675c2235
-
SHA256
677f8e8519faab71692b117ed2eb6c82ffb8f7b9417af6016829fe7dfb29f45b
-
SHA512
4c06524c96be918e1aaee3461c649c8020c5ef0502ee99ef030edf86f3a8ab98ed5e01f9960a467877fc3c01afdfab5110d225518b7cc3d8eb4d0705770c6e47
-
SSDEEP
6144:Nf+BLtABPDOkW20wV/UpYj1cHvbafTyTlI1D0ykK:okJcpYj1cxm1DKK
Score
10/10
Malware Config
Extracted
Family
44caliber
C2
https://discordapp.com/api/webhooks/1246910199382413466/oFEojaZRwArf4dduSdP55IH92toV8znUU8QkqoglvaUito0E-nKrlglMYpfPnnaQ_eGu
Signatures
-
44caliber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Nursultan.exe
Files
-
Nursultan.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 272KB - Virtual size: 271KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ