csc[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

csc.exe
Size

2.6MB
MD5

23ee3d381cfe3b9f6229483e2ce2f9e1
SHA1

93cf877f5627e55ec076a656e935042fac39950e
SHA256

4240a12e0b246c9d69af1f697488fe7da1b497df20f4a6f95135b4d5fe180a57
SHA512

d6d8ed12d8d53d24040f15a6d1651494fb12d0737771586b8cc3059b418dd5645ab962126fcc8641d8276b59da191efd8c1a18929d36afd3722eb19d964bc2bf
SSDEEP

49152:9MSyAKnixTRPjSI3TyYHTEtlC5nPebVm+PW/I8YfSkLd2OQFNcgcZ3Pi:fVxT+QoB8YfScnQFNXG3Pi

Score

1^/10

Malware Config

Signatures

Files

csc.exe
.exe windows:6 windows x64 arch:x64

Password: infected

40ab8070af4e36b5f1c3174ebecf6a1a

Code Sign

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:fd:c7:f0:c9:6a:69:a1:c8:4c:00:00:00:00:00:fd
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:20

Not After

23/11/2019, 20:20

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:0f:1f:8c:41:75:7e:44:97:3b:0e:29:67:30:94:32:77:96:3e:ba:60:b7:a9:59:72:ea:b3:8d:04:a8:31:ec
Signer

Actual PE Digest

19:0f:1f:8c:41:75:7e:44:97:3b:0e:29:67:30:94:32:77:96:3e:ba:60:b7:a9:59:72:ea:b3:8d:04:a8:31:ec

Digest Algorithm

sha256

PE Digest Matches

true

94:f9:db:49:f7:60:09:ec:62:7a:5f:08:48:12:4e:35:b4:73:6e:12
Signer

Actual PE Digest

94:f9:db:49:f7:60:09:ec:62:7a:5f:08:48:12:4e:35:b4:73:6e:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

csc.pdb

Imports

advapi32

CryptAcquireContextA
CryptReleaseContext
RegDeleteKeyA
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegQueryValueExW
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegQueryValueExA
RegOpenKeyExW

kernel32

GetConsoleCP
GetCurrentDirectoryW
FormatMessageW
HeapAlloc
GetProcessHeap
HeapFree
GetConsoleOutputCP
WideCharToMultiByte
GetConsoleScreenBufferInfo
GetStdHandle
GetModuleFileNameA
CreateFileW
GetVersionExA
MultiByteToWideChar
GetCommandLineW
CloseHandle
GetModuleFileNameW
IsValidCodePage
FindFirstFileW
FindNextFileW
FindClose
GetModuleHandleA
HeapSetInformation
QueryPerformanceFrequency
QueryPerformanceCounter
HeapDestroy
HeapSize
HeapReAlloc
lstrcmpiA
IsDBCSLeadByte
LeaveCriticalSection
RaiseException
EnterCriticalSection
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
InitializeCriticalSectionEx
DeleteCriticalSection
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
ReadProcessMemory
lstrlenW
GetExitCodeProcess
MapViewOfFile
GetSystemDirectoryW
OpenThread
GetSystemDefaultLangID
GetThreadLocale
GetUserDefaultLangID
GetLocaleInfoA
VirtualQuery
GetConsoleMode
GetFileType
GetProcAddress
GetLastError
LoadLibraryA
SwitchToThread
GlobalMemoryStatus
WriteFile
DeleteFileW
LoadLibraryW
lstrcmpW
GetEnvironmentVariableW
GetEnvironmentVariableA
GetCurrentDirectoryA
GetFileAttributesW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
CreateProcessW
DuplicateHandle
CreateMutexW
CreateFileMappingW
GetVersion
VirtualAlloc
VirtualFree
Sleep
GetSystemInfo
InitializeCriticalSection
FindResourceExW
FindResourceW
LockResource
TlsAlloc
TlsFree
LocalFree
ReadFile
GetACP
LoadLibraryExW
GetFileSize
GetFullPathNameW
GetShortPathNameA
GetShortPathNameW
SetLastError
VerifyVersionInfoW
VerSetConditionMask
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FreeLibrary
VirtualProtect

vcruntime140_clr0400

strrchr
__CxxFrameHandler3
wcsrchr
wcschr
memmove
__C_specific_handler
strstr
__vcrt_InitializeCriticalSectionEx
memset
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
wcsstr
_purecall
memcpy

ucrtbase_clr0400

__stdio_common_vswprintf_s
_setmode
__acrt_iob_func
_get_osfhandle
fwrite
fclose
fread
wcsncmp
_swab
wmemcpy_s
_set_new_mode
_access_s
_wsetlocale
calloc
_finite
wcstol
isdigit
wcsnlen
wcscspn
__stdio_common_vfwprintf
_resetstkoflw
_wfopen_s
btowc
iswdigit
_wtoi
_isnan
__stdio_common_vswprintf
_mbspbrk
__p__commode
_callnewh
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
wcspbrk
__stdio_common_vfprintf_s
__stdio_common_vfwprintf_s
_mbsinc
_fdopen
_itow_s
_open_osfhandle
_recalloc
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_fileno
wcsncpy_s
wcscpy_s
_localtime64_s
_time64
_wcsicmp
_errno
_invalid_parameter_noinfo
wcsftime
fgetws
fflush
iswspace
isxdigit
_wcsnicmp
__stdio_common_vswscanf
wcstok_s
wcstoul
_wsplitpath_s
bsearch
strncpy_s
malloc
qsort
free
__stdio_common_vsprintf
atoi
wcscat_s
_configthreadlocale
_waccess_s
fmod
sqrt
wcscmp

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateGuid
StringFromGUID2
CoCreateInstance

oleaut32

SysStringLen
SysFreeString
SysAllocStringLen
GetErrorInfo
VariantInit
VariantClear
VarUI4FromStr
SetErrorInfo
VarDecCmp
VarDecDiv
VarDecMul
VarDecSu
VarDecAdd
VarR8FromDec
VarR4FromDec
VarUI4FromDec
VarI4FromDec
SysAllocString
VarUI2FromDec
VarI2FromDec
VarUI1FromDec
VarI1FromDec
VarDecFix
VarDecFromR8
VarDecFromR4
VarDecFromUI4
VarDecFromI4
VarBstrCat
VariantChangeType
VarBstrFromDec
VarR8FromStr
SysStringByteLen
SysAllocStringByteLen
CreateErrorInfo

shlwapi

PathCommonPrefixW
PathAppendW
PathRemoveFileSpecW
PathCanonicalizeW
PathRemoveExtensionW
PathStripPathW
PathFindFileNameW
PathIsUNCW
PathIsURLW
PathRelativePathToW

user32

PeekMessageA
LoadStringW
CharNextA

psapi

GetModuleFileNameExW

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 494KB - Virtual size: 494KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

40ab8070af4e36b5f1c3174ebecf6a1a

Code Sign

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1Certificate

Extended Key Usages

33:00:00:00:fd:c7:f0:c9:6a:69:a1:c8:4c:00:00:00:00:00:fdCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

19:0f:1f:8c:41:75:7e:44:97:3b:0e:29:67:30:94:32:77:96:3e:ba:60:b7:a9:59:72:ea:b3:8d:04:a8:31:ecSigner

94:f9:db:49:f7:60:09:ec:62:7a:5f:08:48:12:4e:35:b4:73:6e:12Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

vcruntime140_clr0400

ucrtbase_clr0400

ole32

oleaut32

shlwapi

user32

psapi

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 494KB - Virtual size: 494KB

.data Size: 6KB - Virtual size: 22KB

.pdata Size: 97KB - Virtual size: 96KB

.didat Size: 512B - Virtual size: 128B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 21KB - Virtual size: 20KB

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

33:00:00:00:fd:c7:f0:c9:6a:69:a1:c8:4c:00:00:00:00:00:fd
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

19:0f:1f:8c:41:75:7e:44:97:3b:0e:29:67:30:94:32:77:96:3e:ba:60:b7:a9:59:72:ea:b3:8d:04:a8:31:ec
Signer

94:f9:db:49:f7:60:09:ec:62:7a:5f:08:48:12:4e:35:b4:73:6e:12
Signer

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 494KB - Virtual size: 494KB

.data
Size: 6KB - Virtual size: 22KB

.pdata
Size: 97KB - Virtual size: 96KB

.didat
Size: 512B - Virtual size: 128B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 21KB - Virtual size: 20KB