Vortex_CS2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Vortex_CS2.exe
Size

360KB
MD5

d32c005180b01b8ff8547cce7f10fc3f
SHA1

31987487dbcce43b7f80f1d810d00fc103b04272
SHA256

34704e0dc63d472ff52176dd26381961323015adda3f58eaf7e49a2f0c317d2c
SHA512

ac502edbd2fc4bd3945763f6ae42b4eba83590cabdcfb85e14b7bbada1a97f91f7dd48556671b935008ff8a12341bbe0a5089d885e82f7202c598b47c07d7a60
SSDEEP

6144:Cid70ftvEAdFhzGowaGfAph5YUToleJ8XPq28ItokU4eWbLn9D0eWrvgeNxMPTAd:t7euhrgkRW80LUnqD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Vortex_CS2.exe

Files

Vortex_CS2.exe
.exe windows:6 windows x64 arch:x64

56513b036bb4bc872303c5f4499e1e04

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\chris\Desktop\Vortex_CS2\x64\Release\Vortex_CS2.pdb

Imports

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
Module32Next
OpenProcess
CreateToolhelp32Snapshot
Sleep
Process32Next
CloseHandle
ReadProcessMemory
GetConsoleWindow
GetLocaleInfoA
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
LoadLibraryA
InitializeSListHead

user32

TrackMouseEvent
DispatchMessageA
GetWindowRect
DestroyWindow
ShowWindow
SetWindowLongA
ScreenToClient
GetCapture
ClientToScreen
SetWindowDisplayAffinity
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
PeekMessageA
UnregisterClassA
PostQuitMessage
RegisterClassExA
UpdateWindow
SetForegroundWindow
GetSystemMetrics
GetAsyncKeyState
SendInput
GetKeyState
GetMessageExtraInfo
LoadCursorA
ReleaseCapture
GetKeyboardLayout
SetCursorPos
IsWindowUnicode
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetForegroundWindow
SetCapture
GetClipboardData
GetClientRect
SetClipboardData
SetCursor

imm32

ImmGetContext
ImmSetCandidateWindow
ImmReleaseContext
ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_Query_perf_counter
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
_Query_perf_frequency
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp
memcpy
memmove
memset
__current_exception_context
__current_exception
__C_specific_handler
strstr
__std_terminate
memchr

api-ms-win-crt-stdio-l1-1-0

fwrite
__p__commode
ftell
__acrt_iob_func
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
_set_fmode
fclose
__stdio_common_vfprintf
fseek
fflush

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp
strcmp
strncpy

api-ms-win-crt-heap-l1-1-0

free
malloc
_set_new_mode

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_c_exit
terminate
_configure_narrow_argv
__p___argv
__p___argc
_initialize_onexit_table
_exit
_register_onexit_function
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

acosf
__setusermatherr
powf
sinf
sqrtf
fmodf
ceilf
cosf
atan2f

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 290KB - Virtual size: 289KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56513b036bb4bc872303c5f4499e1e04

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d11

kernel32

user32

imm32

d3dcompiler_47

dwmapi

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 290KB - Virtual size: 289KB

.rdata Size: 55KB - Virtual size: 54KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 12KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 544B

.text
Size: 290KB - Virtual size: 289KB

.rdata
Size: 55KB - Virtual size: 54KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 544B