Static task
static1
Behavioral task
behavioral1
Sample
GCFScape.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
GCFScape.exe
Resource
win10v2004-20230220-en
General
-
Target
GCFScape.exe
-
Size
268KB
-
MD5
13fd7a476e9301ea826fdfba5dc705ac
-
SHA1
b19083257851ebc036efd46ce9554b469f04cb47
-
SHA256
cf5806d43e1bfddae89978fb21310535818f3ae670c358e3e4e7b6a89f610c37
-
SHA512
057d73da8874be0a56e3e017c505eb6e37cde18d3e95033dee48e979806ea5128dc1f9ca15907a1abe589bf467db3ae42d9290a70d984f975e0b9f9182adeacd
-
SSDEEP
6144:i3BpD5/CUhEH/nWT/GbE7bBTG8+uSHec:i3N/CU+M1G80+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource GCFScape.exe
Files
-
GCFScape.exe.exe windows x86
c66130c3712c66522f5156f703688349
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
hllib
?GetPackageDescription@CWADFile@@UBEPBDXZ
?GetPackageExtension@CWADFile@@UBEPBDXZ
?GetPackageType@CWADFile@@UBEKXZ
?GetFileData@CWADFile@@UAEHPAVCDirectoryFile@@PAE@Z
?GetFileSizeOnDisk@CWADFile@@UAEHPAVCDirectoryFile@@AAK@Z
?GetFileSize@CWADFile@@UAEHPAVCDirectoryFile@@AAK@Z
?BuildRoot@CWADFile@@MAEPAVCDirectoryFolder@@XZ
?UnmapDataStructures@CWADFile@@MAEXXZ
?MapDataStructures@CWADFile@@MAEHXZ
?GetPackageDescription@CPAKFile@@UBEPBDXZ
?GetPackageExtension@CPAKFile@@UBEPBDXZ
?GetPackageType@CPAKFile@@UBEKXZ
?GetFileData@CPAKFile@@UAEHPAVCDirectoryFile@@PAE@Z
?GetFileSizeOnDisk@CPAKFile@@UAEHPAVCDirectoryFile@@AAK@Z
?GetFileSize@CPAKFile@@UAEHPAVCDirectoryFile@@AAK@Z
?BuildRoot@CPAKFile@@MAEPAVCDirectoryFolder@@XZ
?UnmapDataStructures@CPAKFile@@MAEXXZ
?MapDataStructures@CPAKFile@@MAEHXZ
?GetPackageDescription@CGCFFile@@UBEPBDXZ
?GetPackageExtension@CGCFFile@@UBEPBDXZ
?GetPackageType@CGCFFile@@UBEKXZ
?GetFileData@CGCFFile@@UAEHPAVCDirectoryFile@@PAE@Z
?GetFileSizeOnDisk@CGCFFile@@UAEHPAVCDirectoryFile@@AAK@Z
?GetFileSize@CGCFFile@@UAEHPAVCDirectoryFile@@AAK@Z
?BuildRoot@CGCFFile@@MAEPAVCDirectoryFolder@@XZ
?UnmapDataStructures@CGCFFile@@MAEXXZ
?MapDataStructures@CGCFFile@@MAEHXZ
?Open@CMappedPackage@@UAEHPBDHH@Z
?GetPackageSize@CMappedPackage@@UAEKXZ
?GetPackageDescription@CBSPFile@@UBEPBDXZ
?GetPackageExtension@CBSPFile@@UBEPBDXZ
?GetPackageType@CBSPFile@@UBEKXZ
?GetFileData@CBSPFile@@UAEHPAVCDirectoryFile@@PAE@Z
?GetFileSizeOnDisk@CBSPFile@@UAEHPAVCDirectoryFile@@AAK@Z
?GetFileSize@CBSPFile@@UAEHPAVCDirectoryFile@@AAK@Z
?BuildRoot@CBSPFile@@MAEPAVCDirectoryFolder@@XZ
?UnmapDataStructures@CBSPFile@@MAEXXZ
?MapDataStructures@CBSPFile@@MAEHXZ
?Close@CMappedPackage@@UAEXXZ
?Open@CMappedPackage@@UAEHPBD@Z
?Open@CMappedPackage@@UAEHPAXKPBD@Z
?Opened@CMappedPackage@@UAEHXZ
??1CBSPFile@@UAE@XZ
??1CGCFFile@@UAE@XZ
??1CPAKFile@@UAE@XZ
??1CWADFile@@UAE@XZ
??1CPackageUtility@@UAE@XZ
??0CBSPFile@@QAE@XZ
??0CGCFFile@@QAE@XZ
??0CPAKFile@@QAE@XZ
??0CWADFile@@QAE@XZ
??0CPackageUtility@@QAE@PAVCPackage@@@Z
?GetPackageVersion@CGCFFile@@QAEKXZ
?GetPackageBlockCount@CGCFFile@@QAEKXZ
?GetPackageUsedBlockCount@CGCFFile@@QAEKXZ
?GetFolderFileCount@CPackageUtility@@QAEKPAVCDirectoryFolder@@@Z
?GetFolderFolderCount@CPackageUtility@@QAEKPAVCDirectoryFolder@@@Z
?GetRoot@CPackage@@QAEPAVCDirectoryFolder@@XZ
?GetLastError@CError@@QBEPBDXZ
?GetDirectoryItemPath@CPackageUtility@@QAEXPAVCDirectoryItem@@PAD@Z
?GetPackageName@CPackage@@QBEPBDXZ
?GetDirectoryItemSize@CPackageUtility@@QAEKPAVCDirectoryItem@@@Z
?GetDirectoryItemSizeOnDisk@CPackageUtility@@QAEKPAVCDirectoryItem@@@Z
?GetName@CDirectoryItem@@QBEPBDXZ
?GetItemsFlags@CGCFFile@@QAEHPAVCDirectoryItem@@AAK@Z
?ItemCount@CDirectoryFolder@@QAEKXZ
?GetItem@CDirectoryFolder@@QAEPAVCDirectoryItem@@K@Z
?GetFileExists@CGCFFile@@QAEHPAVCDirectoryFile@@AAH@Z
?GetHLLibVersion@@YAKXZ
kernel32
TlsAlloc
SetLastError
GetCurrentThreadId
DeleteCriticalSection
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
HeapAlloc
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
IsBadWritePtr
RtlUnwind
InterlockedExchange
VirtualQuery
LCMapStringA
MultiByteToWideChar
LCMapStringW
SetConsoleCtrlHandler
HeapSize
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
VirtualProtect
GetSystemInfo
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
CreateFileA
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetLastError
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
GetStdHandle
WriteFile
GetCurrentProcess
TerminateProcess
ExitProcess
GetVersionExA
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
GetProcAddress
OutputDebugStringA
GetCurrentThread
GetTempPathA
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
CloseHandle
SetStdHandle
FlushFileBuffers
SetFilePointer
ReadFile
mscoree
_CorExeMain
Sections
.text Size: 96KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ