cs2-dumper[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

cs2-dumper.zip
Size

1.0MB
MD5

0f297556ce7184a83f63e2aa012fcf26
SHA1

cf3ac013b8617c6b1b9fc6b4b7e90b0b0d290834
SHA256

d57368dad18cbd055398e3ad970999d2f13ad19bc966c6d3ab7e082ec9e6392b
SHA512

aafdaac4531d80cb2e7c31e7442c7746dc0b38ffb0480c9ac5323e1ffaa0245760dbd5740f943f7a75645363e2a68c559b44b6f3a34211c10f07a35db30a6529
SSDEEP

24576:l1bF//VD4HDofXdfZ7I+eh66P1We9AfojX61d6RM:zbxV4HUfXdAhf8ejju

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cs2-dumper.exe

Files

cs2-dumper.zip
.zip
config.json
cs2-dumper.exe
.exe windows:6 windows x64

e92c97c602cb80f5e6a4bb908b3c4bf6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentProcess
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
ReleaseMutex
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
QueryPerformanceCounter
GetCommandLineW
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetCurrentThreadId
SetConsoleMode
GetConsoleMode
GetStdHandle
GetCurrentProcessId
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
AcquireSRWLockShared
QueryPerformanceFrequency
ReleaseSRWLockShared
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
AcquireSRWLockExclusive
CreateDirectoryW
FindFirstFileW
GetFileType
WaitForSingleObject
GetModuleHandleW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
FormatMessageW
InitializeSListHead
MultiByteToWideChar
WriteConsoleW
GetSystemTimeAsFileTime
RtlVirtualUnwind
IsDebuggerPresent
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExA
GetProcessHeap
HeapFree
Module32Next
Module32First
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
ReadProcessMemory
CloseHandle
IsProcessorFeaturePresent

oleaut32

SysStringLen
GetErrorInfo
SysFreeString

advapi32

SystemFunction036

ntdll

RtlNtStatusToDosError
NtReadFile
NtWriteFile

bcrypt

BCryptGenRandom

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memset
memcmp
memcpy
memmove
__CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_get_initial_narrow_environment
exit
_initialize_narrow_environment
_seh_filter_exe
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_set_app_type
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_exit
_crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 862KB - Virtual size: 862KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e92c97c602cb80f5e6a4bb908b3c4bf6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

oleaut32

advapi32

ntdll

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 862KB - Virtual size: 862KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 65KB - Virtual size: 65KB

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 862KB - Virtual size: 862KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 65KB - Virtual size: 65KB

.reloc
Size: 28KB - Virtual size: 27KB