cs2_external_1[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

cs2_external_1.exe
Size

721KB
MD5

0ae0ec68bf6f1262e7128e8ba1298cac
SHA1

5115bf458f33fc010d8b08a898afb5bef41017a6
SHA256

9b31fe99b296d175f4f5b2cdaab9c1fe0340cc0a84d407b76454fa4973a1610e
SHA512

7bd9ad4710345d19ff2b102c098f1ed747e37dab840a4e24ec4917d3aeb50864f55098b6e35a1ec77f4ac0ff4227b573047564791f6ac8c53122bf17b459363a
SSDEEP

12288:C8Ak2oMnCva8MMt0njbVrl+NOgtUXQcmYtBTeyEaDsm:C82oMnoaA0n/9l+gtQcmY3Tp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cs2_external_1.exe

Files

cs2_external_1.exe
.exe windows:6 windows x64 arch:x64

Password: infected

5ebc6913eca7e4e0fbeee24c49d1e2c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Phillip\Desktop\cs2 external\x64\Release\cs2 external.pdb

Imports

kernel32

GlobalLock
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
OpenProcess
Process32NextW
Process32FirstW
VirtualQueryEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GlobalFree
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReadProcessMemory
GlobalAlloc
MultiByteToWideChar
Module32NextW
WideCharToMultiByte
Module32FirstW
CloseHandle
CreateToolhelp32Snapshot
GetCurrentProcessId

user32

SetWindowLongW
FindWindowW
LoadIconW
GetClientRect
DefWindowProcW
GetWindow
GetWindowRect
DestroyWindow
SetWindowPos
CreateWindowExW
UnregisterClassW
RegisterClassExW
ShowWindow
GetAsyncKeyState
DispatchMessageW
PeekMessageW
PostQuitMessage
UpdateWindow
GetKeyState
ScreenToClient
ReleaseCapture
SetCursorPos
GetCapture
GetCursorPos
OpenClipboard
ClientToScreen
TrackMouseEvent
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
SetCapture
TranslateMessage
LoadCursorW
GetForegroundWindow
SetCursor

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
_Query_perf_counter
?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Xbad_function_call@std@@YAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

winmm

PlaySoundA

d3d9

Direct3DCreate9Ex

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset
_CxxThrowException
__std_exception_destroy
__current_exception_context
__current_exception
memmove
memcpy
memcmp
memchr
strstr
__std_terminate
__std_exception_copy
__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
exit
_errno
terminate
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_exit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

fwrite
__p__commode
_set_fmode
__acrt_iob_func
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
ftell
fflush
__stdio_common_vfprintf
fseek
fclose

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp
strcmp
strncpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
_callnewh

api-ms-win-crt-convert-l1-1-0

atof
strtol

api-ms-win-crt-math-l1-1-0

acosf
atan2f
ceilf
fmodf
sinf
cosf
__setusermatherr
floorf
sqrtf
powf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 341KB - Virtual size: 340KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 299KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

5ebc6913eca7e4e0fbeee24c49d1e2c7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

imm32

dwmapi

winmm

d3d9

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 341KB - Virtual size: 340KB

.rdata Size: 63KB - Virtual size: 63KB

.data Size: 299KB - Virtual size: 302KB

.pdata Size: 15KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 872B

.text
Size: 341KB - Virtual size: 340KB

.rdata
Size: 63KB - Virtual size: 63KB

.data
Size: 299KB - Virtual size: 302KB

.pdata
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 872B