Z:\scvhost\Release\scvhost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
GJecwa34.cpl.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
GJecwa34.cpl.exe
Resource
win10v2004-20240802-en
General
-
Target
GJecwa34.cpl.exe
-
Size
873KB
-
MD5
5b2ac6ed9b0830ec7f1c9eb7deb38c66
-
SHA1
0f1011748dfff6a0d0f0c0b9b8bc045da54080a6
-
SHA256
92ac711db16da541e06c5195050f6fbd8915255c79ded58f70ba030d37135ceb
-
SHA512
d1509fbdf410c943b2df1f05f1ece680dbd45b6090b43985707f6ebccf940cf4d384a235838d75df8f72b688c41fbfc0ef41347dee869de2d7e3dd5aa1da68f8
-
SSDEEP
24576:QLVxajaoPDR60nXKJxrYUrG/fNfhgsqYREh3TR:Q/b3MNJgsqYRed
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource GJecwa34.cpl.exe
Files
-
GJecwa34.cpl.exe.exe windows:6 windows x86 arch:x86
186f047884470f4ec1376b4011746f13
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
InitializeCriticalSectionEx
FindClose
WaitForSingleObject
GetModuleHandleA
OpenProcess
HeapSize
CreateToolhelp32Snapshot
CreateEventW
Sleep
GetTempPathA
FormatMessageW
CopyFileA
GetLastError
Process32NextW
SetEvent
TerminateThread
TlsAlloc
Process32FirstW
HeapReAlloc
LeaveCriticalSection
RaiseException
ResetEvent
HeapAlloc
QueueUserAPC
DecodePointer
GetProcAddress
LocalFree
DeleteCriticalSection
GetProcessHeap
CreateProcessW
WideCharToMultiByte
SleepEx
TlsGetValue
TlsFree
FormatMessageA
IsDebuggerPresent
WriteConsoleW
CreateFileW
SetStdHandle
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
FindNextFileW
EnterCriticalSection
HeapFree
TlsSetValue
CloseHandle
FindFirstFileW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
ReadFile
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
GetCurrentThreadId
GetNativeSystemInfo
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
OutputDebugStringW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
RtlUnwind
InterlockedPushEntrySList
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
DeleteFileW
MoveFileExW
SetEndOfFile
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegGetValueA
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
RegCreateKeyW
RegQueryValueExW
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
ws2_32
WSAStartup
WSACleanup
bcrypt
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
Sections
.text Size: 552KB - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 170KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ