Static task
static1
Behavioral task
behavioral1
Sample
myHCMK7ruWH4kYF.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
myHCMK7ruWH4kYF.exe
Resource
win10v2004-20220414-en
General
-
Target
0f233dde08fb539a6840d5e8c1ddf936d2384d29e6c83ae3dfd36b3d333710ea
-
Size
381KB
-
MD5
49348f071922b7100f4b43bc7e817059
-
SHA1
98f71b22d43a2fb8b04c480c8b69754e20625c1a
-
SHA256
0f233dde08fb539a6840d5e8c1ddf936d2384d29e6c83ae3dfd36b3d333710ea
-
SHA512
dd01024ca782ae797d16290b14a8e2f1efc6dd59cab26784a5ff0e72559fc637378907216a8fd22e688710c57841ab48d2c5f0a6260b647b9a41d56d3bcbb5b3
-
SSDEEP
6144:jVdM9izSyxH58FwNf4rcGL1vjlqSCWhTwL3R3pTBVivktH1pMH4yo:ZOipxHuFUWpv4SCWhT+RXL
Malware Config
Signatures
-
CoreCCC Packer 1 IoCs
Detects CoreCCC packer used to load .NET malware.
Processes:
resource yara_rule static1/unpack001/myHCMK7ruWH4kYF.exe coreccc
Files
-
0f233dde08fb539a6840d5e8c1ddf936d2384d29e6c83ae3dfd36b3d333710ea.rar
-
myHCMK7ruWH4kYF.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 423KB - Virtual size: 422KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ