C:\Users\zenith\Downloads\Zenith-CS2-Cheat-main\Zenith-CS2-Cheat-main\x64\Release\counter_strike_2_legit_cheat.pdb
Static task
static1
Behavioral task
behavioral1
Sample
zenith.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
zenith.exe
Resource
win10v2004-20240802-en
General
-
Target
zenith.exe
-
Size
752KB
-
MD5
e6566f6fefbcbc393ffd953fcf54c320
-
SHA1
0924d0884504b9343a10afa4db354081a6947d18
-
SHA256
b8cbc16c3aca5a57b7ec71a29b4844650244efa3c1a271e0af9e835fc6d697ee
-
SHA512
62a6027d054e25f6e1d9a28de28c16bad27fa6c3a71f2377c3f53abdaa6f24b7c2a24c331097bf973d020ace88052a869cdf490a48748f35bcf916708561c067
-
SSDEEP
12288:URQNyI9tVa1MyPB4j6WL9I7PlhKy1CnM:OI9XyPCjVLEKy1CnM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource zenith.exe
Files
-
zenith.exe.exe windows:6 windows x64 arch:x64
86ba8b986e43f29fae4985192f0d5e1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
Module32NextW
GetModuleHandleW
GetFileInformationByHandleEx
AreFileApisANSI
OpenProcess
ReadProcessMemory
Module32FirstW
SetThreadExecutionState
QueryPerformanceCounter
CloseHandle
InitializeCriticalSection
EnterCriticalSection
Sleep
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
VerSetConditionMask
GetLastError
GetModuleHandleExW
FormatMessageW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
QueryPerformanceFrequency
GetConsoleWindow
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
WriteProcessMemory
GetSystemTimeAsFileTime
FreeLibrary
GetProcAddress
InitializeSListHead
LoadLibraryA
GlobalUnlock
LocalFree
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
LeaveCriticalSection
MultiByteToWideChar
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetStartupInfoW
user32
PtInRect
OffsetRect
SetRect
ClipCursor
WindowFromPoint
ScreenToClient
SetWindowPlacement
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
AdjustWindowRectEx
GetWindowRect
GetClientRect
SetWindowTextW
RemovePropW
GetPropW
SetPropW
ReleaseDC
SetForegroundWindow
GetSystemMetrics
GetWindowPlacement
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
MapVirtualKeyW
GetKeyState
GetActiveWindow
SetFocus
SetWindowPos
IsZoomed
MoveWindow
BringWindowToTop
IsIconic
SetWindowLongW
GetClassLongPtrW
LoadCursorW
FlashWindow
SetLayeredWindowAttributes
DestroyIcon
LoadImageW
CreateIconIndirect
SystemParametersInfoW
GetLayeredWindowAttributes
MonitorFromWindow
GetMonitorInfoW
DestroyWindow
GetRawInputData
RegisterRawInputDevices
RegisterDeviceNotificationW
UnregisterDeviceNotification
UnregisterClassW
ToUnicode
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplaySettingsExW
EnumDisplayDevicesW
CreateWindowExW
EnumDisplayMonitors
GetRawInputDeviceInfoA
IsWindowVisible
RegisterClassExW
GetRawInputDeviceList
DefWindowProcW
WaitMessage
PostMessageW
SendMessageW
GetMessageTime
PeekMessageW
GetWindowLongW
DispatchMessageW
TranslateMessage
TrackMouseEvent
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetWindowLongPtrW
SetWindowLongPtrW
CallWindowProcW
GetMessageExtraInfo
GetAsyncKeyState
ShowWindow
GetDC
gdi32
SwapBuffers
DescribePixelFormat
ChoosePixelFormat
SetDeviceGammaRamp
GetDeviceGammaRamp
GetDeviceCaps
DeleteDC
CreateDCW
CreateDIBSection
CreateRectRgn
CreateBitmap
SetPixelFormat
SelectObject
CreateFontW
DeleteObject
opengl32
glPopMatrix
glViewport
glClear
glPushAttrib
glDisable
glListBase
glRasterPos2f
glVertex2f
glBegin
glBlendFunc
glColor3f
glCallLists
glGenLists
glEnd
glEnable
glPopAttrib
wglUseFontBitmapsW
glOrtho
glPushMatrix
glColor4f
glLoadIdentity
glLineWidth
glMatrixMode
glew32
glewInit
imm32
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Thrd_yield
_Query_perf_frequency
_Query_perf_counter
?_Throw_Cpp_error@std@@YAXH@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Mtx_lock
_Thrd_detach
_Mtx_unlock
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
memcmp
__std_terminate
strstr
strchr
__std_exception_destroy
__std_exception_copy
memcpy
memset
memmove
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
fgetpos
fgetc
setvbuf
fputc
__p__commode
_set_fmode
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
_fseeki64
fsetpos
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
ftell
ungetc
_get_stream_buffer_pointers
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
_wcsicmp
strcspn
strspn
strcmp
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
realloc
api-ms-win-crt-convert-l1-1-0
mbstowcs_s
strtoull
atof
strtod
strtoll
strtoul
api-ms-win-crt-math-l1-1-0
sin
acosf
pow
sinf
sqrt
atan2f
sqrtf
ceilf
cosf
fmod
fmaxf
fminf
powf
fmodf
__setusermatherr
_dsign
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
localeconv
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
terminate
_beginthreadex
_c_exit
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
abort
_seh_filter_exe
_cexit
_errno
shell32
DragFinish
DragQueryPoint
DragQueryFileW
DragAcceptFiles
Sections
.text Size: 508KB - Virtual size: 508KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 210KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ