- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- SHA256
d30a37489c64ada474d8d5aa5abb0778a6955d3ce6cdbb7c8c659e37b89d3da9- SHA1
1d27ae641ee1d075861161a3e65b3dc43021b1ff- MD5
ef6b844dc543365bd6825d37dbbc04da- Filename
- wf44s.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 284448
- Compile time
- 2022-10-29T11:36:08Z
- PE platform
- x64 64-bit
- PE sections
- 11
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
12 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context12 visible
Intelligence freshnessFresh
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
5shown
0%
zip
150158904 bytes
drops
Filename
GitPortable_2.41.0.zip
File type
zip
MIME
application/zip
Size
150158904
SHA1
931f94f87fbc64c232e201b8d7d5e873e6ff0aa6
11%
high
zip
138691262 bytes
drops
Filename
PS.zip
Family
penguish
Type
trojan
File type
zip
MIME
application/zip
0%
bat
2241 bytes
drops
Filename
Unigram-develop_Libraries_webrtc_acquire.cmd
File type
bat
MIME
text/plain
Size
2241
SHA1
cc567ff057cf61c03635327b19faa149e983fe59
5%
high
rar
4798945 bytes
contains
Filename
dicefolk.rar
Type
trojan
File type
rar
MIME
application/vnd.rar
Size
4798945
5%
low
zip
7002197 bytes
contains
Filename
Setup-EN-US_3264bit.zip
File type
zip
MIME
application/zip
Size
7002197
SHA1
ce715282fa16eb37934524d6e04e05f44f33c22c
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
33792 bytes
contains
Filename
.data
MIME
application/octet-stream
Size
33792
SHA1
2b9b1b2c187a95dd819184497e33811c59baee19
First seen
2024-03-28T20:19:27Z
0%
512 bytes
contains
Filename
.CRT
MIME
application/octet-stream
Size
512
SHA1
87e275654aa5d63573cc6c679857b558738f8338
First seen
2024-03-31T05:51:32Z
0%
6144 bytes
contains
Filename
.xdata
MIME
application/octet-stream
Size
6144
SHA1
9dac92e0b27bd3286b82fbfdfe72bc563750273c
First seen
2024-03-27T23:10:05Z
0%
1024 bytes
contains
Filename
.reloc
MIME
application/octet-stream
Size
1024
SHA1
c434b9a11f7ef9e3b3db521a3893736787ae0704
First seen
2024-03-31T05:24:09Z
0%
6144 bytes
contains
Filename
.pdata
MIME
application/octet-stream
Size
6144
SHA1
4b64c04b0a14ac761606d5c9ff3f46b057e6f062
First seen
2024-03-31T05:22:29Z
Related IPs
Network IPs associated with this indicator.
2shown
0%
US
communicates
CIDR
23.216.144.0/21
Network
23.192.0.0-23.223.255.255
First seen
2023-09-30T05:49:19Z
Last seen
2026-11-13T16:54:22Z
0%
US
communicates
CIDR
20.64.0.0/10
Network
20.33.0.0-20.128.255.255
First seen
2023-09-28T19:16:46Z
Last seen
2026-11-13T17:10:12Z
Analysis details
exefile-overlaydotnet64bit
Freshness: Fresh · Last seen 2 days ago.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
d30a37489c64ada474d8d5aa5abb0778a6955d3ce6cdbb7c8c659e37b89d3da9- SHA1
1d27ae641ee1d075861161a3e65b3dc43021b1ff- MD5
ef6b844dc543365bd6825d37dbbc04da- Filename
- wf44s.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- File size
- 284448
- Compile time
- 2022-10-29T11:36:08Z
- PE platform
- x64 64-bit
- PE sections
- 11
- Import libraries
- 2
- TLSH
T18C546D17D36370FCD55B82308257B372E832B42D9224B97F7258DF742D22E909B9AB19- SSDEEP
6144:K3PMeZQbOHty8dWvQiquJHPT+Z97aPswTP8/:CDE4dtu5r+nWkwTP8/- Imphash
c22c9dcf176fe67b322ce800006f10c7- First seen
- 2022-11-25T20:47:40Z
- Last seen
- 2026-11-11T11:19:47Z
- Filename variants
- 5 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
12 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
13 timestamped observations are arranged from 2022-10-29 to 2025-02-02. These are observation or metadata times, not execution order.
Infrastructure geography
2 infrastructure/location point(s) are visible on the map.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
3 relationship group(s) provide pivot and infrastructure context.
Last seen 2 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- wf44s.exe
- File type
- peexe
- MIME
- application/vnd.microsoft.portable-executable
- Size
- 284448
- Compile time
- 2022-10-29T11:36:08Z
- PE platform
- x64 64-bit
- Entry point
- 5328
- Sections
- 11
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity2
TCPports 443
- 2 outbound connections observed
- 0 domains, 2 IPs, 0 URLs
- Common ports: 443
- Protocols: TCP
View details · 2 shown
- IP
- 23.216.147.76
- Port
- 443
- Protocol
- TCP
- IP
- 20.99.133.109
- Port
- 443
- Protocol
- TCP
File structure
selected detailsSelected observations and details. Additional structured data are available through API and data access.
PE header1
platform x64 64-bit5+ sections
- Platform: x64 64-bit
- Sections: 5+
- Entry point: present
- Compile time: 2022-10-29T11:36:08Z
View details · 1 shown
- Platform
- x64 64-bit
- Entry point
- 5328
- Sections
- 11
- Compile time
- 2022-10-29T11:36:08Z
PE sections5+
5+ sections
- 5+ PE sections
- Common permissions: rw, r, rx
- 5+ unique section names
View details · 5 shown
- Name
- .text
- Virtual address
- 4096
- Virtual size
- 186952
- Raw size
- 187392
- Permissions
- rx
- Entropy
- 6.33
- Name
- .data
- Virtual address
- 192512
- Virtual size
- 33456
- Raw size
- 33792
- Permissions
- rw
- Entropy
- 4.28
- Name
- .rdata
- Virtual address
- 229376
- Virtual size
- 39088
- Raw size
- 39424
- Permissions
- r
- Entropy
- 5.95
- Name
- .pdata
- Virtual address
- 270336
- Virtual size
- 5928
- Raw size
- 6144
- Permissions
- r
- Entropy
- 5.21
- Name
- .xdata
- Virtual address
- 278528
- Virtual size
- 6064
- Raw size
- 6144
- Permissions
- r
- Entropy
- 4.4
5 shown
Imports2
2 DLL groups
- 2 import DLL groups
- 5+ imported functions summarized
View details · 2 shown
- Library
- KERNEL32.dll
- Functions
- DeleteCriticalSection, EnterCriticalSection, GetEnvironmentVariableW, GetLastError, GetModuleFileNameA, GetStartupInfoA, InitializeCriticalSection, IsDBCSLeadByteEx …
- Library
- msvcrt.dll
- Functions
- ___lc_codepage_func, ___mb_cur_max_func, __argv, __C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type …
Resources1
1 resources
- 1 resources
- Resource types: RT_MANIFEST
View details · 1 shown
- Type
- RT_MANIFEST
- Language
- NEUTRAL
Behavior details
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Contains .tls (Thread Local Storage) section
- SetUnhandledExceptionFilter detected (possible anti-debug)
- The PE file contains an overlay
- allocate or change RWX memory
- contain a thread local storage (.tls) section
5 shown
View MITRE ATT&CK details · 4 shown
View MBC details · 5 shown
- C0007 — Allocate MemoryObjectives: OC0002
- CommunicationObjectives: OC0006
- B0002 — Debugger EvasionObjectives: OB0001
- B0003 — Dynamic Analysis EvasionObjectives: OB0001
- B0046.001 — Enumerate PE SectionsObjectives: OB0007
5 shown