Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
CT.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
CT.exe
Resource
win10v2004-20240419-en
Target
CT.exe
Size
5.6MB
MD5
1c047866f3e979995494256af90a16e9
SHA1
8b19ccf0af29cb5f196be47ae36664036e2c4922
SHA256
b4bcc8b71aa0be4856eeb1c029c9582ddf8d8a7d04e3f09dba3b2f5583b17ebb
SHA512
4274d00224fc0244496a54cb2a7b16db936ffeec1c2a1ce579a09901d740d31dab6efb1e6e567a743dd4a7b59cd0531f2295d62631af396d7884962ccebeffc0
SSDEEP
98304:bK54QylvLYREbFnnrg668ZOr41aYaHY4fsygfMkfcV9:bK54QylvLPbFnn68qYaOUVL
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
C:\Basis\Projects\CyberTriage\CyberTriageTool\Release_NoLibs\CyberTriageCLI.pdb
setsockopt
closesocket
freeaddrinfo
shutdown
gethostbyname
getnameinfo
WSAStringToAddressW
htons
sendto
inet_pton
ioctlsocket
WSAAddressToStringA
send
recv
inet_ntoa
getsockname
WSAGetLastError
connect
socket
getaddrinfo
WSAStartup
WSACleanup
GetModuleFileNameExW
FindNextFileW
FindClose
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameW
GetVersionExW
GetTempPathW
RemoveDirectoryW
LocalFree
ReadFile
FormatMessageW
GetComputerNameExW
InterlockedDecrement
GetModuleHandleW
FormatMessageA
FreeLibrary
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
WaitForSingleObject
CreateProcessW
GetExitCodeProcess
LocalAlloc
GlobalAlloc
GlobalFree
LoadLibraryExW
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
GetProcessTimes
Process32NextW
DeleteFileW
GetSystemInfo
GetModuleHandleA
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetFullPathNameW
DeviceIoControl
GetFileSize
ReadConsoleW
GetConsoleMode
GetConsoleCP
WriteFile
CreateFileW
LoadLibraryW
GetProcAddress
CreateDirectoryW
GetCommandLineW
ExpandEnvironmentStringsA
CloseHandle
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
DecodePointer
GetLastError
RaiseException
SetStdHandle
HeapAlloc
HeapReAlloc
HeapFree
GetModuleFileNameA
GetStdHandle
GetCommandLineA
GetACP
GetDateFormatW
GetTimeFormatW
SetFilePointerEx
FindFirstFileW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
ExitThread
GetModuleHandleExW
ExitProcess
RtlUnwind
SetEnvironmentVariableA
FreeEnvironmentStringsW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
IsValidLocale
GetUserDefaultLCID
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
VirtualFree
VirtualAlloc
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SwitchToThread
GetTimeZoneInformation
SignalObjectAndWait
CreateTimerQueue
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
HeapSize
GetProcessHeap
WriteConsoleW
GetStartupInfoW
SetEndOfFile
GetCurrentDirectoryW
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
ResetEvent
SetEvent
OutputDebugStringW
IsDebuggerPresent
GetTickCount
GetSystemTimeAsFileTime
CreateEventW
SetLastError
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
GetExitCodeThread
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
TryEnterCriticalSection
GetStringTypeW
EncodePointer
Sleep
SetUnhandledExceptionFilter
SetConsoleCtrlHandler
GetCurrentProcessId
FileTimeToSystemTime
GetCurrentThreadId
EnumSystemLocalesW
FlushFileBuffers
GetUserObjectSecurity
wsprintfW
ReadEventLogW
GetTokenInformation
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
LsaNtStatusToWinError
IsValidSid
GetSecurityDescriptorOwner
AdjustTokenPrivileges
LookupPrivilegeValueW
CloseServiceHandle
EnumServicesStatusExW
OpenSCManagerW
ConvertSidToStringSidW
ConvertStringSidToSidA
CloseEventLog
OpenEventLogW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
LookupAccountSidW
OpenProcessToken
CommandLineToArgvW
SHGetPathFromIDListW
SHGetFolderPathW
ord17
CoTaskMemAlloc
CoTaskMemFree
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
VariantClear
SysAllocString
SysFreeString
CertGetNameStringW
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
ExpandEnvironmentStringsForUserW
GetUserProfileDirectoryW
BCryptGenRandom
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptDestroyKey
BCryptImportKey
BCryptExportKey
BCryptDecrypt
BCryptEncrypt
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptCreateHash
InternetOpenW
InternetOpenUrlW
InternetCloseHandle
InternetReadFile
InternetOpenA
InternetWriteFile
InternetConnectA
HttpQueryInfoA
HttpSendRequestExA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetSetOptionA
HttpEndRequestA
WinHttpConnect
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpReadData
WinHttpOpen
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetOption
WinHttpWriteData
LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer
DnsQuery_W
DnsFree
GetAdaptersAddresses
GetUdpTable
GetIpNetTable
GetIpForwardTable
GetTcpTable
PathFileExistsW
CryptCATCatalogInfoFromContext
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
CryptCATOpen
CryptCATAdminEnumCatalogFromHash
CryptCATGetMemberInfo
CryptCATClose
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ