Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
csc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
csc.exe
Resource
win10v2004-20240419-en
Target
csc.exe
Size
2.6MB
MD5
23ee3d381cfe3b9f6229483e2ce2f9e1
SHA1
93cf877f5627e55ec076a656e935042fac39950e
SHA256
4240a12e0b246c9d69af1f697488fe7da1b497df20f4a6f95135b4d5fe180a57
SHA512
d6d8ed12d8d53d24040f15a6d1651494fb12d0737771586b8cc3059b418dd5645ab962126fcc8641d8276b59da191efd8c1a18929d36afd3722eb19d964bc2bf
SSDEEP
49152:9MSyAKnixTRPjSI3TyYHTEtlC5nPebVm+PW/I8YfSkLd2OQFNcgcZ3Pi:fVxT+QoB8YfScnQFNXG3Pi
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
csc.pdb
CryptAcquireContextA
CryptReleaseContext
RegDeleteKeyA
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegQueryValueExW
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegQueryValueExA
RegOpenKeyExW
GetConsoleCP
GetCurrentDirectoryW
FormatMessageW
HeapAlloc
GetProcessHeap
HeapFree
GetConsoleOutputCP
WideCharToMultiByte
GetConsoleScreenBufferInfo
GetStdHandle
GetModuleFileNameA
CreateFileW
GetVersionExA
MultiByteToWideChar
GetCommandLineW
CloseHandle
GetModuleFileNameW
IsValidCodePage
FindFirstFileW
FindNextFileW
FindClose
GetModuleHandleA
HeapSetInformation
QueryPerformanceFrequency
QueryPerformanceCounter
HeapDestroy
HeapSize
HeapReAlloc
lstrcmpiA
IsDBCSLeadByte
LeaveCriticalSection
RaiseException
EnterCriticalSection
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
InitializeCriticalSectionEx
DeleteCriticalSection
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
ReadProcessMemory
lstrlenW
GetExitCodeProcess
MapViewOfFile
GetSystemDirectoryW
OpenThread
GetSystemDefaultLangID
GetThreadLocale
GetUserDefaultLangID
GetLocaleInfoA
VirtualQuery
GetConsoleMode
GetFileType
GetProcAddress
GetLastError
LoadLibraryA
SwitchToThread
GlobalMemoryStatus
WriteFile
DeleteFileW
LoadLibraryW
lstrcmpW
GetEnvironmentVariableW
GetEnvironmentVariableA
GetCurrentDirectoryA
GetFileAttributesW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
CreateProcessW
DuplicateHandle
CreateMutexW
CreateFileMappingW
GetVersion
VirtualAlloc
VirtualFree
Sleep
GetSystemInfo
InitializeCriticalSection
FindResourceExW
FindResourceW
LockResource
TlsAlloc
TlsFree
LocalFree
ReadFile
GetACP
LoadLibraryExW
GetFileSize
GetFullPathNameW
GetShortPathNameA
GetShortPathNameW
SetLastError
VerifyVersionInfoW
VerSetConditionMask
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FreeLibrary
VirtualProtect
strrchr
__CxxFrameHandler3
wcsrchr
wcschr
memmove
__C_specific_handler
strstr
__vcrt_InitializeCriticalSectionEx
memset
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
wcsstr
_purecall
memcpy
__stdio_common_vswprintf_s
_setmode
__acrt_iob_func
_get_osfhandle
fwrite
fclose
fread
wcsncmp
_swab
wmemcpy_s
_set_new_mode
_access_s
_wsetlocale
calloc
_finite
wcstol
isdigit
wcsnlen
wcscspn
__stdio_common_vfwprintf
_resetstkoflw
_wfopen_s
btowc
iswdigit
_wtoi
_isnan
__stdio_common_vswprintf
_mbspbrk
__p__commode
_callnewh
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
wcspbrk
__stdio_common_vfprintf_s
__stdio_common_vfwprintf_s
_mbsinc
_fdopen
_itow_s
_open_osfhandle
_recalloc
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_fileno
wcsncpy_s
wcscpy_s
_localtime64_s
_time64
_wcsicmp
_errno
_invalid_parameter_noinfo
wcsftime
fgetws
fflush
iswspace
isxdigit
_wcsnicmp
__stdio_common_vswscanf
wcstok_s
wcstoul
_wsplitpath_s
bsearch
strncpy_s
malloc
qsort
free
__stdio_common_vsprintf
atoi
wcscat_s
_configthreadlocale
_waccess_s
fmod
sqrt
wcscmp
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateGuid
StringFromGUID2
CoCreateInstance
SysStringLen
SysFreeString
SysAllocStringLen
GetErrorInfo
VariantInit
VariantClear
VarUI4FromStr
SetErrorInfo
VarDecCmp
VarDecDiv
VarDecMul
VarDecSu
VarDecAdd
VarR8FromDec
VarR4FromDec
VarUI4FromDec
VarI4FromDec
SysAllocString
VarUI2FromDec
VarI2FromDec
VarUI1FromDec
VarI1FromDec
VarDecFix
VarDecFromR8
VarDecFromR4
VarDecFromUI4
VarDecFromI4
VarBstrCat
VariantChangeType
VarBstrFromDec
VarR8FromStr
SysStringByteLen
SysAllocStringByteLen
CreateErrorInfo
PathCommonPrefixW
PathAppendW
PathRemoveFileSpecW
PathCanonicalizeW
PathRemoveExtensionW
PathStripPathW
PathFindFileNameW
PathIsUNCW
PathIsURLW
PathRelativePathToW
PeekMessageA
LoadStringW
CharNextA
GetModuleFileNameExW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ