cs2_overlay[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cs2_overlay.exe
Size 15.6MB
Sample260711-jm9eksd13q
SHA256 952c8271ecf13f4a220d7fe7490975de27772edbac2d0fe47b46c5a0224d293b
MD5 fd1588619883f8c461b90cf9a9fc8e20
SHA1 25c5bd2f8fbd0dfba1319747d7103134623ceaa1
SHA512 31b8d567cd20025c7f03070cbdee1ed4cad1ff22e4d63824939445a9dac115623e0b15d50c8a51b949d14c6d5567601e60ed64f91a1c0459970dfafafa5813eb
SSDEEP 196608:LQKQjkGyc7iEp2yRSAVjEiaqXFSHi5iBknbXHH6zV:0jrjHHC
TLSH
T1DCF6194BA67DD8C0C561DD7C88009165F36AB06CC6109AE2BAF9FC950BD2C329B5E7F4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cs2_overlay.exe

File Explorer

cs2_overlay.exe

.exe 15.6MB

cs2_overlay.exe

IMPHASH b805653933989be70eab5569c7f5adf2
SHA256 952c8271ecf13f4a220d7fe7490975de27772edbac2d0fe47b46c5a0224d293b
MD5 fd1588619883f8c461b90cf9a9fc8e20
SHA1 25c5bd2f8fbd0dfba1319747d7103134623ceaa1
SHA512 31b8d567cd20025c7f03070cbdee1ed4cad1ff22e4d63824939445a9dac115623e0b15d50c8a51b949d14c6d5567601e60ed64f91a1c0459970dfafafa5813eb
SSDEEP 196608:LQKQjkGyc7iEp2yRSAVjEiaqXFSHi5iBknbXHH6zV:0jrjHHC
TLSH
T1DCF6194BA67DD8C0C561DD7C88009165F36AB06CC6109AE2BAF9FC950BD2C329B5E7F4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3003980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

controller.pdb

ntdll

NtReadFile RtlPcToFileHeader RtlGetVersion NtWriteFile RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile RtlUnwindEx

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

kernel32

IsValidCodePage GetFileSizeEx ReadConsoleW FlushFileBuffers LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx GetCurrentThreadId FlsFree FlsSetValue FlsGetValue GetConsoleProcessList FlsAlloc OutputDebugStringW GetCommandLineW GetStdHandle GetCommandLineA WriteFile ReadFile AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread FreeLibrary FindClose FindFirstFileExW SetThreadErrorMode LoadLibraryExW GetProcAddress GetSystemTimePreciseAsFileTime GetModuleHandleExW LoadLibraryW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetLastError CreateThread CloseHandle SetStdHandle EnterCriticalSection RaiseException EncodePointer GetConsoleMode GetFileType GetFileInformationByHandleEx GetQueuedCompletionStatusEx GetACP TerminateProcess GetStringTypeW HeapSize HeapReAlloc IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent SwitchToThread HeapFree InitializeSListHead GetSystemTimeAsFileTime GlobalLock GlobalSize WideCharToMultiByte GlobalUnlock MultiByteToWideChar GlobalAlloc GlobalFree GetProcessHeap Sleep GetModuleHandleA SetEndOfFile GetOEMCP GetCPInfo SetLastError GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex GetConsoleOutputCP WaitForSingleObject WriteConsoleW HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter GetFullPathNameW CreateFileW SetFileTime GetEnvironmentStringsW GetFileInformationByHandle CreateDirectoryW ExitProcess GetModuleFileNameW SetFilePointerEx SetConsoleMode PostQueuedCompletionStatus CreateIoCompletionPort FindNextFileW SetConsoleTextAttribute GetConsoleScreenBufferInfo FreeEnvironmentStringsW SetEnvironmentVariableW LeaveCriticalSection SetFileInformationByHandle

ole32

CoCreateInstance RevokeDragDrop CoInitializeEx CoTaskMemFree CoUninitialize RegisterDragDrop OleInitialize

user32

SystemParametersInfoA ToUnicodeEx DestroyCursor DestroyIcon GetSystemMenu EnableMenuItem SetWindowLongW GetActiveWindow GetClipCursor ClipCursor ShowCursor GetWindowLongW AdjustWindowRectEx SetCapture ReleaseCapture GetKeyboardLayout SetWindowPlacement GetKeyState ValidateRect MonitorFromRect GetRawInputData ChangeDisplaySettingsExW GetKeyboardState MapVirtualKeyExW TrackMouseEvent IsProcessDPIAware GetTouchInputInfo RegisterWindowMessageA GetMonitorInfoW SetForegroundWindow MonitorFromWindow SendInput EmptyClipboard CloseClipboard GetClipboardData OpenClipboard GetWindowRect GetWindowThreadProcessId FindWindowExA FindWindowW ReleaseDC SetWindowLongA RegisterRawInputDevices SetWindowLongPtrW CloseTouchInputHandle RegisterTouchWindow GetSystemMetrics GetDC CreateWindowExW RegisterClassExW DefWindowProcW GetClassInfoExW GetClassNameW GetWindowPlacement GetMenu SetWindowDisplayAffinity MessageBoxA SendMessageW GetWindowLongPtrW InvalidateRgn SetWindowPos MessageBoxW ShowWindow SetCursor LoadCursorW SetCursorPos SendMessageA MoveWindow GetFocus ClientToScreen GetClientRect SetActiveWindow SetWindowLongPtrA GetWindowLongPtrA GetAsyncKeyState ScreenToClient GetCursorPos RedrawWindow PostMessageW DestroyWindow TranslateMessage KillTimer SetTimer GetMessageW DispatchMessageW PeekMessageW SetClipboardData MapVirtualKeyW

shell32

IsUserAnAdmin SHCreateItemFromParsingName DragFinish DragQueryFileW

opengl32

wglMakeCurrent wglDeleteContext wglCreateContext wglGetProcAddress

gdi32

GetDeviceCaps DeleteObject SwapBuffers SetPixelFormat DescribePixelFormat ChoosePixelFormat CreateRectRgn

dwmapi

DwmIsCompositionEnabled DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

oleaut32

SysFreeString SysStringLen GetErrorInfo

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmAssociateContextEx

uxtheme

SetWindowTheme

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.4MB

Virtual Size

12.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cs2_overlay.exe

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ole32

user32

shell32

opengl32

gdi32

dwmapi

d3d11

d3dcompiler_47

bcrypt

advapi32

oleaut32

imm32

uxtheme

generic