CS2 DMA[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

CS2 DMA.exe
Size

284KB
MD5

d73e6284f0634f87488fb03cedf35e64
SHA1

61f4eedf76a17b8110f3099294b99ee88beec326
SHA256

533f9d372a8ae71bf229c7dafffa848f58a6c41747ef7ee006c7c212f3a9238f
SHA512

06ab3a2e7b01c87383421e2641334f9f60e15a28b45fdd884ba3a7531d7406cd4c446ed01bd97ce274d422fe1ab2626a340c7f8ff0b86d9519f8a62ff06016c7
SSDEEP

6144:S57RB9JXRVRLR1RVRDRgRjRfBqA5RpXzVTDM70KNILnlxo98I+n8Ks2gMHPaskLc:SfBgFXwvNIlxK+n8KsKH4X6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CS2 DMA.exe

Files

CS2 DMA.exe
.exe windows:6 windows x64 arch:x64

c6b577d3353a5b37caa64bebb8447403

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GlobalFree
GlobalAlloc
GetModuleHandleA
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
Sleep
GetLocaleInfoA
GlobalUnlock
WideCharToMultiByte
TerminateProcess
GlobalLock
IsDebuggerPresent
IsProcessorFeaturePresent

user32

SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
SetClipboardData
SetCapture
EmptyClipboard
CloseClipboard
DefWindowProcW
DispatchMessageA
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
ShowWindow
TranslateMessage
PeekMessageA
PostQuitMessage
UpdateWindow
GetKeyState
OpenClipboard
GetClipboardData
GetMessageExtraInfo
LoadCursorA
GetForegroundWindow

d3dx11_43

D3DX11CreateShaderResourceViewFromFileA

leechcore

LcCreate
LcCommand
LcClose

vmm

VMMDLL_Scatter_Initialize
VMMDLL_Scatter_Clear
VMMDLL_ConfigGet
VMMDLL_Scatter_ExecuteRead
VMMDLL_Initialize
VMMDLL_Scatter_CloseHandle
VMMDLL_PidGetFromName
VMMDLL_Map_GetModuleFromNameU
VMMDLL_MemFree
VMMDLL_MemReadEx
VMMDLL_ProcessGetInformation
VMMDLL_Scatter_PrepareEx
VMMDLL_Close

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
_Xtime_get_ticks
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
_Thrd_sleep
?_Xlength_error@std@@YAXPEBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
_Query_perf_counter
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
_Query_perf_frequency
?good@ios_base@std@@QEBA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ

imm32

ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
_CxxThrowException
memcmp
memchr
memset
memmove
__current_exception
__std_terminate
strstr
__std_exception_destroy
__std_exception_copy
__C_specific_handler
__current_exception_context

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
_callnewh
malloc

api-ms-win-crt-stdio-l1-1-0

fclose
_set_fmode
fflush
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
ftell
_wfopen
__stdio_common_vfprintf
fwrite
__p__commode
__acrt_iob_func
fseek

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-string-l1-1-0

strcpy_s
strcmp
_strdup

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_seh_filter_exe
_set_app_type
_register_onexit_function
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_initialize_onexit_table
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_configure_narrow_argv
_cexit
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

sqrtf
cosf
sinf
__setusermatherr
acosf
ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 220KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6b577d3353a5b37caa64bebb8447403

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

kernel32

user32

d3dx11_43

leechcore

vmm

msvcp140

imm32

d3dcompiler_47

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 220KB - Virtual size: 220KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 524B

.text
Size: 220KB - Virtual size: 220KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 524B