Static task
static1
Behavioral task
behavioral1
Sample
new order.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
new order.exe
Resource
win10v2004-20220414-en
General
-
Target
0885fa1c83a4149d56a78b83c82d158c3041c1d9f2a95df952ea1cc4253fb142
-
Size
618KB
-
MD5
87ff43cb8f524099f2ff09cfdbbb2600
-
SHA1
412883206657121cc43506aba23233ab3e7ba1c4
-
SHA256
0885fa1c83a4149d56a78b83c82d158c3041c1d9f2a95df952ea1cc4253fb142
-
SHA512
a8815410f39dcdee35cf4b48083e688842bd5cea56c6d44c985bb06720e075993df74c162919da08afc8ab432b4785313ac4b916511d463e3b62707669534db4
-
SSDEEP
12288:dTWTe5fDVgrrSAJMQux5s8hyYNI9BWaks4YPPnupJlEx7eJ8VByZ2jxGUj1n:dTWTe5fDenQQux5uXzWaks4YPCJ58LEg
Malware Config
Signatures
-
CoreCCC Packer 1 IoCs
Detects CoreCCC packer used to load .NET malware.
resource yara_rule static1/unpack001/new order coreccc
Files
-
0885fa1c83a4149d56a78b83c82d158c3041c1d9f2a95df952ea1cc4253fb142.zip
-
new order.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 650KB - Virtual size: 650KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ