csgo[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
csgo.dll
Size 16.9MB
Sample260701-vrftlsaz8q
SHA256 c15fed194b70a8f482cdef6909052a1647cdff655a0bef7dc03ee8b572a468db
MD5 31958ed0cffc24a5f8175e9c232ee7e4
SHA1 e8cc70ceebc3b243a3f872649e850e1e07281f4c
SHA512 2e835d86215f94250c51741c03c53c12c0f3c515b57700db9900908747158f7c5f3c5bec00b8346711d7d1a04cedab899f954198411c54bd3d18fe9c43013acb
SSDEEP 393216:WltaiN1rAydh9t45QR0hGohz6ehP0Osm5D9:Wlok1kydAIaGg5h8Wh9
TLSH
T1CE071242F3E38526EF492AB0953DA7BF032478312B3505CBBBDA5C98DA615D12E74F06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
csgo.dll

File Explorer

csgo.dll

.dll 16.9MB

csgo.dll

IMPHASH f7a7e7e3beff3500e3c038c1959f7950
SHA256 c15fed194b70a8f482cdef6909052a1647cdff655a0bef7dc03ee8b572a468db
MD5 31958ed0cffc24a5f8175e9c232ee7e4
SHA1 e8cc70ceebc3b243a3f872649e850e1e07281f4c
SHA512 2e835d86215f94250c51741c03c53c12c0f3c515b57700db9900908747158f7c5f3c5bec00b8346711d7d1a04cedab899f954198411c54bd3d18fe9c43013acb
SSDEEP 393216:WltaiN1rAydh9t45QR0hGohz6ehP0Osm5D9:Wlok1kydAIaGg5h8Wh9
TLSH
T1CE071242F3E38526EF492AB0953DA7BF032478312B3505CBBBDA5C98DA615D12E74F06
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1841144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\x\like\wowia\release\csgo.pdb

advapi32

GetCurrentHwProfileA

kernel32

LoadLibraryExA FreeLibrary GetSystemInfo RaiseException HeapFree CreateFileMappingA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter VirtualFree VirtualAlloc VirtualQuery HeapCreate VirtualProtect MapViewOfFile GetCurrentProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot Sleep GetLastError HeapReAlloc CloseHandle HeapAlloc HeapDestroy GetThreadContext GetProcAddress GetCurrentProcessId GetModuleHandleW FlushInstructionCache SetThreadContext OpenThread ReadFile WriteFile CreateFileA GetModuleFileNameA GetModuleHandleA GetTickCount64 K32GetModuleInformation GetTickCount WaitNamedPipeA PeekNamedPipe K32EnumProcessModules FreeLibraryAndExitThread DisableThreadLibraryCalls CreateThread SetUnhandledExceptionFilter GetFileSizeEx UnmapViewOfFile

user32

GetAsyncKeyState GetKeyState LoadCursorA ScreenToClient GetCapture ClientToScreen IsChild GetForegroundWindow SetCapture MessageBoxA SetCursor GetClientRect ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData CallWindowProcW SetWindowLongW

ole32

CreateStreamOnHGlobal

msvcp140

?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?_Syserror_map@std@@YAPBDH@Z ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Xout_of_range@std@@YAXPBD@Z ?id@?$numpunct@D@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ??1facet@locale@std@@MAE@XZ ??0facet@locale@std@@IAE@I@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ ??Bid@locale@std@@QAEIXZ ?_Gettrue@_Locinfo@std@@QBEPBDXZ ?_Getfalse@_Locinfo@std@@QBEPBDXZ ??1_Locinfo@std@@QAE@XZ ??0_Locinfo@std@@QAE@PBD@Z _Strxfrm _Query_perf_frequency ?_Xinvalid_argument@std@@YAXPBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll _Query_perf_counter ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z ?tolower@?$ctype@D@std@@QBEDD@Z ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z

d3dx9_43

D3DXCreateTextureFromFileExA D3DXCreateTextureFromFileInMemory D3DXCreateTextureFromFileA

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW WakeAllConditionVariable

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx FormatMessageA

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW

api-ms-win-core-file-l1-1-0

CreateFileW FindClose FindFirstFileW CreateDirectoryW FindNextFileW GetFileAttributesExW SetFileInformationByHandle FindFirstFileExW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

MoveFileExW GetFileInformationByHandleEx

winmm

mciSendStringW

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate strstr __CxxFrameHandler3 strchr __std_type_info_compare strrchr longjmp memcpy __RTDynamicCast memmove memset memchr _setjmp3 __current_exception __std_type_info_destroy_list _CxxThrowException _except_handler4_common __current_exception_context

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fclose __stdio_common_vswprintf_s fwrite __stdio_common_vsprintf_s _wfopen fflush __stdio_common_vsprintf __stdio_common_vsnprintf_s fread __acrt_iob_func __stdio_common_vsscanf ftell _get_stream_buffer_pointers fgetpos fsetpos ungetc fseek fputc fgetc _fseeki64 setvbuf

api-ms-win-crt-runtime-l1-1-0

terminate abort _errno system _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit _invalid_parameter_noinfo_noreturn _initterm _initterm_e

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

strncpy_s toupper strncmp isdigit isspace strncpy strcpy_s tolower

api-ms-win-crt-heap-l1-1-0

realloc free malloc _callnewh calloc

api-ms-win-crt-convert-l1-1-0

strtoull strtoul strtoll strtod strtol atof

api-ms-win-crt-math-l1-1-0

_libm_sse2_atan_precise _ldsign _libm_sse2_cos_precise _libm_sse2_exp_precise _libm_sse2_acos_precise _fdsign remainderf _libm_sse2_sin_precise _libm_sse2_sqrt_precise _hypotf ceil _fdclass _dsign _libm_sse2_pow_precise _ldclass _dclass fmaf _CIfmod roundf _CIatan2 remainder fminf _libm_sse2_log_precise floor

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv

api-ms-win-crt-time-l1-1-0

strftime _time64 _localtime64_s