C:\Users\poken\source\repos\Cs2VACisAzz\x64\Release\External Cheat cs2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
External Cheat cs2.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
External Cheat cs2.exe
Resource
win10v2004-20240802-en
General
-
Target
External Cheat cs2.exe
-
Size
492KB
-
MD5
eb2f03896ea85ae466a175c6df7e3a00
-
SHA1
e1874afa48e06593399a3d6efa706328397c50e6
-
SHA256
750e872bcfab0e47403fc99c3dcee8eda3336ca21f8e523ec2632785b6fd1ad7
-
SHA512
63980ba1e392f8313e4fce381417d16f06299e28306b2b9e3068be3a7a4dab760f39b13a836a4d4aed9c9125583bbb685d8cad6c082518aca888287a8e8770af
-
SSDEEP
6144:OmnQGvTzeAMOFEnyvBW7mlsv+bUXcAy2YKdch/4EtS9hQEmUF9st5p0IZurLmWnF:OEk6W7fnYKHFsjSIZ1WnpF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource External Cheat cs2.exe
Files
-
External Cheat cs2.exe.exe windows:6 windows x64 arch:x64
e4563d87ebf436bcd72d69ed948a45d3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
Module32NextW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
GetProcAddress
GetLocaleInfoA
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
WriteProcessMemory
CloseHandle
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ReadProcessMemory
Sleep
Module32FirstW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
RtlLookupFunctionEntry
RtlCaptureContext
OpenProcess
user32
DispatchMessageA
GetWindowRect
DestroyWindow
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
SetWindowLongA
GetWindowTextA
GetWindowLongA
DefWindowProcA
SetLayeredWindowAttributes
SendInput
TranslateMessage
PeekMessageA
PostQuitMessage
UpdateWindow
SetForegroundWindow
GetKeyState
GetMessageExtraInfo
GetClipboardData
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetAsyncKeyState
SetClipboardData
GetKeyboardLayout
EmptyClipboard
CloseClipboard
OpenClipboard
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
msvcp140
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__std_exception_destroy
__current_exception_context
__current_exception
__C_specific_handler
strstr
__std_terminate
__std_exception_copy
memmove
memcpy
memcmp
memchr
memset
api-ms-win-crt-runtime-l1-1-0
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
terminate
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_cexit
_errno
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initialize_narrow_environment
_crt_atexit
_set_app_type
_register_onexit_function
_initialize_onexit_table
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
ftell
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
__p__commode
_set_fmode
fgetc
__acrt_iob_func
fputc
fflush
fclose
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
fseek
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
strcmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoull
strtoll
atof
strtod
api-ms-win-crt-math-l1-1-0
ceilf
atan2f
pow
powf
_dsign
cosf
sqrt
tan
sqrtf
acosf
_hypotf
fmodf
sinf
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
Sections
.text Size: 390KB - Virtual size: 389KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 740B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ