CS2[.]Glow[.]v[.]2[.]3[.]1[.]exe

Target
CS2.Glow.v.2.3.1.exe
Size 1.3MB
Sample260510-zycsraex2w
SHA256 7b89ead97294a3085ad7c5d31c645dc0cf14461d12d0c767c71fbcaa56995c05
MD5 e416f2df3c58b4c4f61cde99d8170de9
SHA1 efd91b5f4453bc8f7b0f1fc5977965180d46559e
SHA512 2297ccaf46a1a2ea15d09f67f4004499594a5ab64e48b7b4068c381660e2828ee11cb3bf754a8852f5435645245c5a62327fbdbbf07447d4bc20bd2733a1d034
SSDEEP 24576:1sLNR3FtNCP60qOinonKtseEMheZGvLo/Eyu40UcwrfDpe4sc8HCshKqxv7xp8jh:g6Egc
TLSH
T1A05549C9029C94FCE352C674624A97CBF7F2BF8D9664EFB82BE10D80191F480B536569
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
CS2.Glow.v.2.3.1.exe

File Explorer

CS2.Glow.v.2.3.1.exe

.exe 1.3MB

CS2.Glow.v.2.3.1.exe

IMPHASH 3953bb798b620160819be342852871d8
SHA256 7b89ead97294a3085ad7c5d31c645dc0cf14461d12d0c767c71fbcaa56995c05
MD5 e416f2df3c58b4c4f61cde99d8170de9
SHA1 efd91b5f4453bc8f7b0f1fc5977965180d46559e
SHA512 2297ccaf46a1a2ea15d09f67f4004499594a5ab64e48b7b4068c381660e2828ee11cb3bf754a8852f5435645245c5a62327fbdbbf07447d4bc20bd2733a1d034
SSDEEP 24576:1sLNR3FtNCP60qOinonKtseEMheZGvLo/Eyu40UcwrfDpe4sc8HCshKqxv7xp8jh:g6Egc
TLSH
T1A05549C9029C94FCE352C674624A97CBF7F2BF8D9664EFB82BE10D80191F480B536569
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1368992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Z:\Projects\injector_cs\x64\Release\EZinjector Reborn.pdb

kernel32

GetModuleFileNameA Process32First WriteProcessMemory SetConsoleTitleA OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA K32GetProcessMemoryInfo TerminateThread LoadLibraryA DeleteFileA Process32Next CloseHandle CreateThread GetProcAddress VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx GetExitCodeProcess RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext

shell32

ShellExecuteA

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?uncaught_exception@std@@YA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

wininet

InternetReadFile InternetOpenA InternetOpenUrlA DeleteUrlCacheEntryA InternetCloseHandle

urlmon

URLDownloadToFileA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler _CxxThrowException __current_exception memset __std_terminate __std_exception_copy __std_exception_destroy memcmp memcpy __current_exception_context memmove

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_narrow_environment _crt_atexit _invoke_watson _cexit _seh_filter_exe _initialize_onexit_table _get_initial_narrow_environment _initterm _initterm_e _exit exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _set_app_type _configure_narrow_argv terminate

api-ms-win-crt-stdio-l1-1-0

fclose fgetc __p__commode _set_fmode __stdio_common_vfprintf _get_stream_buffer_pointers fwrite _fseeki64 fread fsetpos __acrt_iob_func fgetpos fputc setvbuf ungetc fflush

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

strcat_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Resubmissions

Sharing

General