cs2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cs2.exe
Size 8.6MB
Sample260702-w455psht2l
SHA256 6d598e2c66c34d462b1b4ed3a7772150c7e01104c6a24e3547bd71ff1ce36c1d
MD5 2e8be3edfd9fe60e0676929ee07df1b5
SHA1 09becee1f366994fb4976c8608f259f358486bf8
SHA512 3a65bf02d201c27cde51963f1d5d2697738b5959ba4482dc03e0417c4e1d3cfe55996a915e96ce831a68cb544f4bfcce54d73da9a3949cc903eea6a7b56b7ba3
SSDEEP 98304:oe9nlVpLnC/mnxXvUIiqD536ehZtPh+r5Li7Nr+Jw4aeaeaeaeaeaea:JnNxcYdxbPhyw4aeaeaeaeaeaea
TLSH
T1D296BF11BA828072E6D111B08EAEE77F87396E2807F584D3B3D43AF75A305D13B36665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cs2.exe

File Explorer

cs2.exe

.exe 8.6MB

cs2.exe

IMPHASH 4c9bdca9226829923ca40d64a6d6cb73
SHA256 6d598e2c66c34d462b1b4ed3a7772150c7e01104c6a24e3547bd71ff1ce36c1d
MD5 2e8be3edfd9fe60e0676929ee07df1b5
SHA1 09becee1f366994fb4976c8608f259f358486bf8
SHA512 3a65bf02d201c27cde51963f1d5d2697738b5959ba4482dc03e0417c4e1d3cfe55996a915e96ce831a68cb544f4bfcce54d73da9a3949cc903eea6a7b56b7ba3
SSDEEP 98304:oe9nlVpLnC/mnxXvUIiqD536ehZtPh+r5Li7Nr+Jw4aeaeaeaeaeaea:JnNxcYdxbPhyw4aeaeaeaeaeaea
TLSH
T1D296BF11BA828072E6D111B08EAEE77F87396E2807F584D3B3D43AF75A305D13B36665
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3130016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx CreateTimerQueue FindResourceW LoadResource LockResource FreeResource CreateTimerQueueTimer GetModuleFileNameA GetCurrentProcessId GetCurrentDirectoryW lstrcatW WriteConsoleW GetTimeZoneInformation GetFileAttributesExW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo CloseHandle CreateEventW FindClose FindNextFileW GetOEMCP IsValidCodePage GetLogicalProcessorInformation SignalObjectAndWait SwitchToThread TryEnterCriticalSection SizeofResource LoadLibraryExA FindNextFileA FindFirstFileExA GetConsoleCP FlushFileBuffers SetStdHandle GetStringTypeW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW SetConsoleMode ReadConsoleInputA SetConsoleCtrlHandler ReadConsoleW GetConsoleMode GetACP SystemTimeToTzSpecificLocalTime VirtualProtect GetModuleHandleExW FreeLibraryAndExitThread ExitThread VirtualQuery LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer InterlockedFlushSList InterlockedPushEntrySList RtlUnwind ExitProcess GetProcessHeap SetEndOfFile FindFirstFileW lstrlenW lstrcpyW FreeLibrary GetProcAddress LoadLibraryA GetCurrentDirectoryA GetModuleFileNameW GlobalMemoryStatusEx GetCurrentProcess GetSystemInfo lstrcmpW GetModuleHandleW GetPrivateProfileStringW QueryPerformanceCounter QueryPerformanceFrequency GetVersionExW WriteFile SetFilePointer GetLocalTime CreateFileW DeleteFileW GetLastError GetExitCodeThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObject WaitForMultipleObjects Sleep LoadLibraryW lstrcmpiW SetErrorMode GetFileSize ReadFile GetFileTime SetFileTime CompareFileTime SetFileAttributesW GetFileAttributesW CopyFileW MoveFileW SetFilePointerEx GetTickCount GetVolumeInformationW SetThreadPriority ResumeThread GlobalAlloc GlobalLock GlobalUnlock SetCurrentDirectoryW MultiByteToWideChar WideCharToMultiByte InterlockedIncrement InterlockedDecrement HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize lstrcpyA lstrcatA lstrlenA CreateDirectoryW GetFullPathNameW LocalFree GetCurrentThread GetTempPathW GetWindowsDirectoryW MulDiv VirtualAlloc VirtualFree GetCurrentThreadId ReleaseSemaphore DuplicateHandle lstrcpynW CreateSemaphoreW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount CreateThread GetThreadPriority GetUserDefaultUILanguage FileTimeToLocalFileTime FileTimeToSystemTime SetCurrentDirectoryA GetFileAttributesA CreateFileA CreateMutexW WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead GetLogicalDrives GetDriveTypeW GetDiskFreeSpaceW GetDiskFreeSpaceExW OpenProcess ReadProcessMemory WriteProcessMemory GetSystemDirectoryW OutputDebugStringW OutputDebugStringA GlobalFree InitializeCriticalSectionEx SleepEx VerSetConditionMask GetSystemDirectoryA GetModuleHandleA VerifyVersionInfoA ExpandEnvironmentStringsA GetStdHandle GetFileType PeekNamedPipe SetLastError FormatMessageA GlobalMemoryStatus FlushConsoleInputBuffer GetSystemTime SystemTimeToFileTime

user32

EnableMenuItem GetWindowLongW CallWindowProcW PostMessageW GetWindowRect EndDialog SetDlgItemTextW SendDlgItemMessageW LoadCursorW SetDlgItemTextA SetCursor EnableWindow SetRectEmpty InvalidateRect UpdateWindow GetDesktopWindow CheckDlgButton KillTimer IsDlgButtonChecked GetDlgItemTextW SetWindowTextA GetWindowTextA SetTimer GetDlgItemTextA SetClassLongW wsprintfW ShowWindow SendMessageW FillRect CheckRadioButton SetWindowPos GetWindowTextW SetWindowTextW InsertMenuW LoadIconW CreateAcceleratorTableW GetMessageW TranslateMessage DispatchMessageW IsWindow CreateDialogParamW TranslateAcceleratorW SetActiveWindow MessageBoxA IsDialogMessageW DefWindowProcW UnregisterClassW CreateWindowExW AdjustWindowRect IsIconic SetFocus GetForegroundWindow IsRectEmpty OpenClipboard CloseClipboard SetClipboardData EmptyClipboard SetWindowLongW UnionRect EqualRect OffsetRect AttachThreadInput GetMenuItemCount SetForegroundWindow AdjustWindowRectEx ClientToScreen GetWindowThreadProcessId SystemParametersInfoW MoveWindow GetWindow PeekMessageW PostThreadMessageW GetQueueStatus RegisterWindowMessageW MsgWaitForMultipleObjects SetMenu RedrawWindow LoadMenuW DestroyMenu RegisterClassExW GetClassNameW IsChild SetCapture ReleaseCapture ShowCursor ScreenToClient WindowFromPoint FindWindowW wsprintfA EnumWindows ChangeDisplaySettingsW ChangeDisplaySettingsExW EnumDisplaySettingsW EnumChildWindows GetMenuItemInfoW GetDlgCtrlID LoadStringW DdeInitializeW DdeConnect DdeDisconnect DdeNameService DdeClientTransaction DdeCreateDataHandle DdeGetData DdeFreeDataHandle DdeGetLastError DdeCreateStringHandleW DdeQueryStringW DestroyAcceleratorTable DdeCmpStringHandles DdeFreeStringHandle GetUserObjectInformationW SetMenuItemInfoW DestroyIcon CopyAcceleratorTableW GetSubMenu LoadAcceleratorsW DeleteMenu ModifyMenuW ReleaseDC GetDC DialogBoxParamW GetSystemMetrics GetCursorPos PtInRect EnumDisplayMonitors EndPaint BeginPaint MessageBoxW GetDlgItem GetParent LoadImageW IntersectRect GetProcessWindowStation SetCursorPos DestroyWindow GetClientRect GetClassLongW PostQuitMessage LoadCursorFromFileW

gdi32

SetTextAlign SetMapMode SetBkColor GetTextExtentPoint32W GetTextExtentPoint32A GetGlyphOutlineW GetGlyphOutlineA GetTextMetricsW StretchBlt SelectObject DeleteDC CreateCompatibleDC StretchDIBits GetStockObject EnumFontFamiliesExW CreateFontIndirectW AddFontResourceA GetDeviceCaps CreateDIBSection SetTextColor DeleteObject CreateSolidBrush SetBkMode

advapi32

RegQueryValueExW RegQueryValueExA RegOpenKeyA CryptSignHashA CryptDestroyHash RegOpenKeyExW RegEnumKeyExW DeregisterEventSource RegisterEventSourceA ReportEventA CryptAcquireContextA CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash RegSetValueExW RegCloseKey RegCreateKeyExW CryptEnumProvidersA

shell32

SHGetFolderPathW SHGetSpecialFolderPathW ShellExecuteA ShellExecuteExW ExtractIconExW SHGetFileInfoW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteW

ole32

CoUninitialize CoCreateInstance CoTaskMemFree CoFreeUnusedLibraries CoTaskMemAlloc CreateStreamOnHGlobal CoInitialize

winmm

waveOutOpen waveOutClose waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveOutPause waveOutRestart waveOutReset mciSendCommandW mciGetErrorStringW timeGetDevCaps timeBeginPeriod waveOutGetNumDevs timeEndPeriod timeKillEvent waveOutGetDevCapsW timeGetTime timeSetEvent joyGetNumDevs joyGetDevCapsW joyGetPosEx joyReleaseCapture joySetCapture

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

comctl32

PropertySheetW ord17 CreatePropertySheetPageW

imm32

ImmGetStatusWindowPos ImmSetOpenStatus ImmGetOpenStatus ImmReleaseContext ImmGetContext ImmSetStatusWindowPos

ws2_32

getsockname WSAIoctl getaddrinfo freeaddrinfo accept listen getpeername bind htonl shutdown getsockopt closesocket connect htons WSASetLastError select ntohs recv send socket gethostbyname getservbyname WSAStartup WSACleanup WSAGetLastError setsockopt __WSAFDIsSet gethostname recvfrom sendto ioctlsocket

wldap32

ord60 ord211 ord46 ord217 ord143 ord41 ord22 ord26 ord27 ord32 ord33 ord30 ord79 ord50 ord301 ord35 ord200

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

msvfw32

ICInstall ICRemove

comdlg32

GetSaveFileNameW GetOpenFileNameW

oleaut32

SysStringLen VariantClear VariantInit

gdiplus

GdipGetImageWidth GdiplusStartup GdipGetImageHeight GdipCloneImage GdipCreateBitmapFromStream GdipAlloc GdipDisposeImage GdipFree GdipBitmapGetPixel GdiplusShutdown

generic

count=52, id=241, version=40116,

count=196, id=243, version=40116,

count=42, id=242, version=40116,

count=16, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=6, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=54, productName=Unmarked objects (old),

count=93, id=260, version=27034,

count=1, id=224, productName=VS2013 UPD3 build 30723, version=30723,

count=143, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=9, id=199, version=41118,

count=40, id=259, version=26706,

count=608, id=260, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=260, version=27045,

count=1, id=261, productName=VS2017 v15.9.7 build 27027, version=27027,

count=1, id=225, productName=VS2013 UPD3 build 30723, version=30723,

count=40, id=260, version=26706,

count=102, id=261, version=27034,

count=325, id=261, version=27045,

count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=607, id=1, productName=Unmarked objects,

count=133, id=261, version=26706,

count=146, id=265, version=27045,

count=1, id=256, version=27045,

count=1, id=255, version=27045,

count=3, id=151,

count=1, id=258, version=27045,