WCCore[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WCCore.dll
Size

10.6MB
MD5

f8fd12d874d107e6c2f8cd16ed0d424c
SHA1

0ff19d456abcface783c9d251b8dc94ce855d829
SHA256

02078e78b22e7afe2bac13cced27a3e49b948f58f5791f8c64a2fb6c29fc0ea1
SHA512

19e68e6c3f7c45775a48f51ea0e2d86c7dc8ed9aecbff5e8ab5e6755348abb3a5c59592d4b294b4dd46252070df4de6e0496149f9734d5249a653fc8464cc9d3
SSDEEP

196608:qhr+NE/5QyR2KYTnVkAXvjjtTmGk1FCbvYJok9vb+0xx:3CQyR0Xbjt1i+v3ivd

Score

1^/10

Malware Config

Signatures

Files

WCCore.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

eb:ef:4d:fe:b2:63:8a:fa:82:5b:4d:39:53:70:87:05
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

07/04/2016, 00:00

Not After

07/04/2019, 23:59

Subject

CN=Freshideas.ie Ltd,O=Freshideas.ie Ltd,POSTALCODE=BT11 9AW,STREET=10 Stockmans Crescent,L=Belfast,ST=Antrim,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

eb:ef:4d:fe:b2:63:8a:fa:82:5b:4d:39:53:70:87:05
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

07/04/2016, 00:00

Not After

07/04/2019, 23:59

Subject

CN=Freshideas.ie Ltd,O=Freshideas.ie Ltd,POSTALCODE=BT11 9AW,STREET=10 Stockmans Crescent,L=Belfast,ST=Antrim,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

99:17:fd:1e:fd:8b:10:9d:28:82:67:71:18:10:55:b6:9c:29:1b:c7:1f:cc:f9:b3:fb:65:83:7b:ca:d7:ea:07
Signer

Actual PE Digest

99:17:fd:1e:fd:8b:10:9d:28:82:67:71:18:10:55:b6:9c:29:1b:c7:1f:cc:f9:b3:fb:65:83:7b:ca:d7:ea:07

Digest Algorithm

sha256

PE Digest Matches

true

ad:a3:58:26:34:49:15:6f:bf:e3:c6:76:f8:01:f9:e4:75:2a:b9:58
Signer

Actual PE Digest

ad:a3:58:26:34:49:15:6f:bf:e3:c6:76:f8:01:f9:e4:75:2a:b9:58

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WCCore.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Code Sign

eb:ef:4d:fe:b2:63:8a:fa:82:5b:4d:39:53:70:87:05Certificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

eb:ef:4d:fe:b2:63:8a:fa:82:5b:4d:39:53:70:87:05Certificate

Extended Key Usages

Key Usages

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18Certificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

99:17:fd:1e:fd:8b:10:9d:28:82:67:71:18:10:55:b6:9c:29:1b:c7:1f:cc:f9:b3:fb:65:83:7b:ca:d7:ea:07Signer

ad:a3:58:26:34:49:15:6f:bf:e3:c6:76:f8:01:f9:e4:75:2a:b9:58Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 10.4MB - Virtual size: 10.4MB

.sdata Size: 173KB - Virtual size: 172KB

.rsrc Size: 1024B - Virtual size: 860B

.reloc Size: 512B - Virtual size: 12B

eb:ef:4d:fe:b2:63:8a:fa:82:5b:4d:39:53:70:87:05
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

eb:ef:4d:fe:b2:63:8a:fa:82:5b:4d:39:53:70:87:05
Certificate

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

99:17:fd:1e:fd:8b:10:9d:28:82:67:71:18:10:55:b6:9c:29:1b:c7:1f:cc:f9:b3:fb:65:83:7b:ca:d7:ea:07
Signer

ad:a3:58:26:34:49:15:6f:bf:e3:c6:76:f8:01:f9:e4:75:2a:b9:58
Signer

.text
Size: 10.4MB - Virtual size: 10.4MB

.sdata
Size: 173KB - Virtual size: 172KB

.rsrc
Size: 1024B - Virtual size: 860B

.reloc
Size: 512B - Virtual size: 12B