Win32:CVE-2020-1054-C [Expl] removal guide

The Win32:CVE-2020-1054-C [Expl] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:CVE-2020-1054-C [Expl] virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32:CVE-2020-1054-C [Expl]?


File Info:
name: 35C884271DEAB87921F7.mlw
path: /opt/CAPEv2/storage/binaries/c20b2c6b8a0d5e259cc02322f76f56098658b086a9618b69970bff0e9312ed2b
crc32: 057A2213
md5: 35c884271deab87921f743f767692ee6
sha1: 1aea00bf5bc098cf7ef824efa4f96f8b45f70c6a
sha256: c20b2c6b8a0d5e259cc02322f76f56098658b086a9618b69970bff0e9312ed2b
sha512: 286db2ebdb0b0c81e3b3de77122f93f6e1dbb2e20062ff910a14104aa1d1638150241d4377c5a0beef70f88107691e660a9fd04349e6efac4a0c1588d7e07de6
ssdeep: 6144:mJVFOb38/7jZ9oDrfxxPS1tDIJ/J/yN/oHQM:mq38/79ivxdSLI1Jaho
type: PE32+ executable (console) x86-64, for MS Windows
tlsh: T190C47CA57BA412D6D17B813DC6C65B5ADA727815133197CF01A803AE2F13AF86E3B720
sha3_384: 5c4ed47cfb3bfbd7672e6811720388f089ba74cfff221e0c9f004df4aa6dc647761a6b6286e368baee47613c40f1abc9
ep_bytes: e94f780000e9e2760300e991120500e9
timestamp: 2021-07-29 18:05:25

Version Info:
0: [No Data]

Win32:CVE-2020-1054-C [Expl] also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46723729
FireEye	Generic.mg.35c884271deab879
ALYac	Trojan.GenericKD.46723729
Cylance	Unsafe
Zillya	Exploit.CVE20188120.Win64.54
Sangfor	Exploit.Win64.CVE-2018-8120.gen
Alibaba	Exploit:Win64/CVE-2018-8120.b7ca6037
Symantec	Trojan.Gen.MBT
Kaspersky	HEUR:Exploit.Win64.CVE-2018-8120.gen
BitDefender	Trojan.GenericKD.46723729
Avast	Win32:CVE-2020-1054-C [Expl]
Tencent	Win64.Exploit.Cve-2018-8120.Llho
Ad-Aware	Trojan.GenericKD.46723729
Sophos	Generic Reputation PUA (PUA)
TrendMicro	TROJ_GEN.R002C0PH421
McAfee-GW-Edition	RDN/Generic Exploit
Emsisoft	Trojan.GenericKD.46723729 (B)
Ikarus	Exploit.CVE-2018-8120
GData	Trojan.GenericKD.46723729
Avira	EXP/CVE-2018-8120.thiwm
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 99)
AhnLab-V3	Trojan/Win.Generic.C4598506
McAfee	RDN/Generic Exploit
MAX	malware (ai score=89)
VBA32	Exploit.Win64.CVE-2018-8120
TrendMicro-HouseCall	TROJ_GEN.R002C0PH421
Fortinet	W64/CVE_2018_8120!exploit
AVG	Win32:CVE-2020-1054-C [Expl]
Panda	Trj/CI.A

How to remove Win32:CVE-2020-1054-C [Expl]?

Win32:CVE-2020-1054-C [Expl] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X