CS2_DMA[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

CS2_DMA.exe
Size

286KB
MD5

af34c5456f037851d8541ef6f588f2d0
SHA1

d791c36660009e0604c685cf7dfe94193cc145f1
SHA256

9da73f440498cb43936a0d1e9f4340a3f6b415edb118ee2689c9b19c4a46765a
SHA512

f05ae87736ecbc0b52c65750b37c7ce948855a84e36374f7fbfe06029bce56caa70b988aae68768b1849f011237c2eed39b24bc09332d136d1a6285cb70ead88
SSDEEP

6144:BuhJaRnRSR7RERaR1RTR/BvnjWKwzmvZwWN0KTqTnWYRJlUNS+nTjaaAX:Cbr0KTKWgHB+nu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CS2_DMA.exe

Files

CS2_DMA.exe
.exe windows:6 windows x64 arch:x64

c6b577d3353a5b37caa64bebb8447403

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GlobalFree
GlobalAlloc
GetModuleHandleA
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
Sleep
GetLocaleInfoA
GlobalUnlock
WideCharToMultiByte
TerminateProcess
GlobalLock
IsDebuggerPresent
IsProcessorFeaturePresent

user32

SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
SetClipboardData
SetCapture
EmptyClipboard
CloseClipboard
DefWindowProcW
DispatchMessageA
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
ShowWindow
TranslateMessage
PeekMessageA
PostQuitMessage
UpdateWindow
GetKeyState
OpenClipboard
GetClipboardData
GetMessageExtraInfo
LoadCursorA
GetForegroundWindow

d3dx11_43

D3DX11CreateShaderResourceViewFromFileA

leechcore

LcCreate
LcCommand
LcClose

vmm

VMMDLL_Scatter_Initialize
VMMDLL_Scatter_Clear
VMMDLL_ConfigGet
VMMDLL_Scatter_ExecuteRead
VMMDLL_Initialize
VMMDLL_Scatter_CloseHandle
VMMDLL_PidGetFromName
VMMDLL_Map_GetModuleFromNameU
VMMDLL_MemFree
VMMDLL_MemReadEx
VMMDLL_ProcessGetInformation
VMMDLL_Scatter_PrepareEx
VMMDLL_Close

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
_Xtime_get_ticks
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
_Thrd_sleep
?_Xlength_error@std@@YAXPEBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
_Query_perf_counter
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
_Query_perf_frequency
?good@ios_base@std@@QEBA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ

imm32

ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
_CxxThrowException
memcmp
memchr
memset
memmove
__current_exception
__std_terminate
strstr
__std_exception_destroy
__std_exception_copy
__C_specific_handler
__current_exception_context

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
_callnewh
malloc

api-ms-win-crt-stdio-l1-1-0

fclose
_set_fmode
fflush
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
ftell
_wfopen
__stdio_common_vfprintf
fwrite
__p__commode
__acrt_iob_func
fseek

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-string-l1-1-0

strcpy_s
strcmp
_strdup

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_seh_filter_exe
_set_app_type
_register_onexit_function
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_initialize_onexit_table
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_configure_narrow_argv
_cexit
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

sqrtf
cosf
sinf
__setusermatherr
acosf
ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c6b577d3353a5b37caa64bebb8447403

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

kernel32

user32

d3dx11_43

leechcore

vmm

msvcp140

imm32

d3dcompiler_47

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 221KB - Virtual size: 220KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 10KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 524B

.text
Size: 221KB - Virtual size: 220KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 524B