FCore dll Trojan Packed File Malware Analysis: 8b6803ac827c7af69130f3379a669ca2

FCore.dll Trojan Packed Analysis

Updated 1 month ago

Checked by Malaware Check

FCore.dll

Hash Type	Value	Action
MD5	8b6803ac827c7af69130f3379a669ca2
SHA1	87807510e0b74480cb5ccec5252f3874d211d428
SHA256	9f02ede530a9abc779599937510921c4e43de7569080dc0570079203a1dc3b09
SHA512	642d50f0aee4a160be8279a1027d8f427776f760200ccd5f37dccd94cf09932b0e3a4ece721b03332519a6d8c67736e910c5374250d9fb522bbeddaa77a81c04
ImpHash	9ab1dbb59ca6a54c53955dfb6bff9aa0

Hash Type

Value

Action

MD5

8b6803ac827c7af69130f3379a669ca2

SHA1

87807510e0b74480cb5ccec5252f3874d211d428

SHA256

9f02ede530a9abc779599937510921c4e43de7569080dc0570079203a1dc3b09

SHA512

642d50f0aee4a160be8279a1027d8f427776f760200ccd5f37dccd94cf09932b0e3a4ece721b03332519a6d8c67736e910c5374250d9fb522bbeddaa77a81c04

ImpHash

9ab1dbb59ca6a54c53955dfb6bff9aa0

PE Analysis

Basic Information

▼

Icon	Hash: a4c09c4859e5ebf0c25d5741e4dcf096 Fuzzy: f3a8cd694b22d7e9f267a395d00d9ba9 dHash: c69a727219ccb2b2
Image Base	`0x180000000`
Entry Point	`0x1807f30b0`
Compilation Time	2023-12-20 11:03:10
Checksum	0x004f5d5d (Actual: 0x004f5d5d)
OS Version	6.0
PEiD Signatures	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	24 libraries
Exports	1268 functions
Resources	12 Resources
Sections	13 Sections

Version Information

▼

CompanyName	Wondershare
FileDescription	FCore
FileVersion	13, 0, 60, 5095
InternalName	FCore
LegalCopyright	Copyright (c) 2020-2023 Wondershare. All rights reserved.
OriginalFilename	FCore
ProductName	FCore
ProductVersion	13.0.60.5095
Translation	0x0804 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
	`0x00001000`	1,159,182 bytes	375,808 bytes	7.98 (Packed/Encrypted)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`202006BA65CAEF55B29F562877A9E948`
	`0x0011d000`	630,852 bytes	175,104 bytes	7.92 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`14F2509819F2B9A9B3BBD47FF0B9DA86`
	`0x001b8000`	31,936 bytes	6,144 bytes	7.88 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D79B2CB7A8415A01F3D7E31D17DFA758`
	`0x001c0000`	71,520 bytes	45,056 bytes	7.69 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BDA485A3C382A4BA61A940E9415928EC`
	`0x001d2000`	196,320 bytes	54,784 bytes	7.96 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3CAF42143CBD1D691835E166A0A101CD`
	`0x00202000`	5,476 bytes	2,560 bytes	7.60 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`30F249E3DE7B86EF7E332710CDA3BDF4`
`.edata`	`0x00204000`	75,776 bytes	75,776 bytes	5.83 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`530E173865A8FA47B0DE20D4356F862E`
`.idata`	`0x00217000`	4,096 bytes	2,560 bytes	3.89 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BD9357908913265065051AB461629767`
`.tls`	`0x00218000`	4,096 bytes	512 bytes	0.26 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`C0A4FE2EC2FD0A2D2AD76AA659DEB1D5`
`.rsrc`	`0x00219000`	196,608 bytes	196,608 bytes	5.95 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F8FA3C8CCD3607C14630E352F2B3200F`
`.themida`	`0x00249000`	5,939,200 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.boot`	`0x007f3000`	4,212,224 bytes	4,212,224 bytes	7.94 (Packed/Encrypted)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`DC49ACF975F52D0860DB5307A7AA38B0`
`.reloc`	`0x00bf8000`	4,096 bytes	16 bytes	2.47 (Normal)	`IMAGE_SCN_MEM_READ`	`236057039C7649461EFDC007D12D5192`

Entropy Analysis Alert

7 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼

Total Resources: 12 (195,586 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	9	194,325 bytes	99.4%
RT_GROUP_ICON	1	132 bytes	0.1%
RT_VERSION	1	748 bytes	0.4%
RT_MANIFEST	1	381 bytes	0.2%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	FCore.dll
File Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Scanner Version	1.0.215.174
Database Version	2025-04-23 01:03:30 UTC

FCore.dll Trojan Packed Analysis

Technical Analysis

Trojan.Win64.Packed.cl

Scan Another File

File Identification