FCore dll Trojan Wacatac File Malware Analysis: 5838c4fba691df3eab2dbdef6f4f6f41
Gridinsoft Logo
File Icon

FCore.dll Trojan Wacatac Analysis

Updated 3 months ago
Checked by Malware Check
FCore.dll

Technical Analysis

File Name FCore.dll
File Type
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Scanner Version 1.0.223.174
Database Version 2025-08-24 15:00:32 UTC
⚠

Trojan.Win64.Wacatac.cl

Malware family: Wacatac

Wacatac malware demonstrates multiple malicious capabilities including data theft, system compromise, and secondary payload deployment. It can download additional malware components including ransomware to extend attack impact.
N/A
Detection Rate
5,968,504
File Size (bytes)
2025-08-24
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
5838c4fba691df3eab2dbdef6f4f6f41
SHA1
9259ebb5564c01955f30d85e595e8e1d59e6fb7e
SHA256
1c95724de7e23a21c7317972099f08095993c62b0a40dedb10a62d67bdbedc39
SHA512
50d113b15403a5dbd361b1177bf4515ebef430223d5c88226e75b7cd6c718b6fec21b2aacc96bf1d3679ada8229a409839c82a9177eef580ee0ada3defd27868
ImpHash
d835f1955fd672930dc03eb3d6193408

PE Analysis

Basic Information

▼
Icon
Hash: a4c09c4859e5ebf0c25d5741e4dcf096
Fuzzy: f3a8cd694b22d7e9f267a395d00d9ba9
dHash: c69a727219ccb2b2
Image Base 0x180000000
Entry Point 0x181728838
Compilation Time 2025-01-10 11:36:45
Checksum 0x006569fc (Actual: 0x005b72fb)
OS Version 6.0
PEiD Signatures PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 35 libraries
Exports 4585 functions
Resources 12 Resources
Sections 9 Sections

Version Information

▼
CompanyName Wondershare
FileDescription FCore
FileVersion 14, 3, 2, 11147
InternalName FCore
LegalCopyright Copyright (c) 2020-2025 Wondershare. All rights reserved.
OriginalFilename FCore
ProductName FCore
ProductVersion 14.3.2.11147
Translation 0x0804 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 3,944,448 bytes 1,080,832 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE B8B39F01116C3D2DE7C5A47B4ABF67E0
0x003c4000 2,048,000 bytes 482,304 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5064ED883A352C661EC24A5DEE2B23FE
0x005b8000 126,976 bytes 21,504 bytes 7.99 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 71E210D590251D2F103E7AC79FDAF30E
0x005d7000 253,952 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x00615000 196,608 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x00645000 20,480 bytes 4,608 bytes 7.96 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE F1B6708C44006DC3A64E8EC717882870
.rsrc 0x0064a000 196,608 bytes 196,608 bytes 5.95 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 0D6B5A8DE64CB48251132305F7DA869B
0x0067a000 13,647,872 bytes 304,128 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 8165CAA3694413F973123CBF0408D9E6
0x0137e000 3,858,432 bytes 3,855,872 bytes 7.90 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 1AAAB5C381122E23AF943CF37D803625
Entropy Analysis Alert

6 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 12 (195,586 bytes)
Resource Type Count Total Size Percentage
RT_ICON 9 194,325 bytes
99.4%
RT_GROUP_ICON 1 132 bytes
0.1%
RT_VERSION 1 748 bytes
0.4%
RT_MANIFEST 1 381 bytes
0.2%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.Wacatac.cl Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Wacatac.cl without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware