44caliber | WoksiMeneg[.]exe | Triage

Sharing

General

Target

WoksiMeneg.exe
Size

303KB
MD5

ee725ca0f25f388656a01de2d5f222b8
SHA1

d67fd88ffc308db1b7f2d60ce9299191cdfdcf48
SHA256

638d64d65efd9ad2661bb6f33677689fc17a8b370751e7bb8ae255bc0ebba282
SHA512

18f3de4ffdebd550bbb40547138da3f2ad905a35bb6af3d4e862de157cd9e090218cd4b1407c69a451e8ad18afa248220e8e5aa70623cd53ff01e9148f55c504
SSDEEP

6144:w1E0T6MDdbICydeB1MnyCvG/9GzC6LmA1D0XoO:w1z6yCvGFG+w1DPO

Score

10^/10

44caliber

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1282656223682105405/fZzk0Hd_vZyiyOmXb8Q0ODSwm2YlkGtfF7H4LgbvREcWNQZksDAPfCAcrAdCpAx0oVA1

Signatures

44caliber family
44caliber

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WoksiMeneg.exe

Files

WoksiMeneg.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\44CALIBER-main\44CALIBER\obj\Debug\Insidious.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 301KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ