cs2-external-esp[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
cs2-external-esp.exe
Size 1.6MB
Sample260720-b8b27sev5x
SHA256 9ae5424774ed606c5fb0f1aaeb281ffeab1fcf8d8f171b325ca193b0535bfcd6
MD5 3fc81f19dca608313c2185841f52a0a5
SHA1 3cc70269fc46d7d8397d2f21d9bb4e0885c3d3fa
SHA512 1af3a6c51ce24ab2d5e5cef41c0b4ef64a130285ade2a2f7a6ebd9f6c18b48b7392470d588bef88e678717d8d7b401e549807d690b77aef258cfc11b744c7d00
SSDEEP 24576:k4Da5FcBNFxIAi9bomVde+qySjUg8Gh0lhSMXlTPtiKnqKGpOKY55RbUA:k/uIAipo+j+jMD8KnqKG
TLSH
T17375BF47B3E801E9C0ABD179C5429617EA7230540F24ABDF13E48EA82F73AE15B7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cs2-external-esp.exe

File Explorer

cs2-external-esp.exe

.exe 1.6MB

cs2-external-esp.exe

IMPHASH 382b3aef8a0f532ff14c9a7514fdfbb8
SHA256 9ae5424774ed606c5fb0f1aaeb281ffeab1fcf8d8f171b325ca193b0535bfcd6
MD5 3fc81f19dca608313c2185841f52a0a5
SHA1 3cc70269fc46d7d8397d2f21d9bb4e0885c3d3fa
SHA512 1af3a6c51ce24ab2d5e5cef41c0b4ef64a130285ade2a2f7a6ebd9f6c18b48b7392470d588bef88e678717d8d7b401e549807d690b77aef258cfc11b744c7d00
SSDEEP 24576:k4Da5FcBNFxIAi9bomVde+qySjUg8Gh0lhSMXlTPtiKnqKGpOKY55RbUA:k/uIAipo+j+jMD8KnqKG
TLSH
T17375BF47B3E801E9C0ABD179C5429617EA7230540F24ABDF13E48EA82F73AE15B7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

726460

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\cs2-external-esp\cs2-external-esp\x64\Release\cs2-external-esp.pdb

kernel32

SleepConditionVariableSRW Sleep GetCurrentThreadId CreateFileW FindClose FindFirstFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW MoveFileExW GetFileInformationByHandleEx WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemDirectoryW LoadLibraryW SetLastError FormatMessageW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx VerifyVersionInfoW GetFileSizeEx GetCurrentProcess SetPriorityClass AddVectoredExceptionHandler VirtualQuery GlobalLock VerSetConditionMask FreeLibrary LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA VirtualQueryEx Module32NextW K32GetModuleInformation K32EnumProcessModulesEx OpenProcess CloseHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot MultiByteToWideChar SetConsoleMode GetConsoleMode SetConsoleOutputCP AcquireSRWLockExclusive GlobalFree GlobalAlloc IsProcessorFeaturePresent GlobalUnlock SetConsoleTitleA GetStdHandle GetModuleHandleA GetProcAddress ReleaseSRWLockExclusive

user32

GetWindowThreadProcessId FindWindowExA GetWindowTextA IsWindowVisible GetKeyboardLayout SetPropA SetCursor LoadCursorA GetKeyState GetCursorPos GetForegroundWindow IsChild ClientToScreen SetCursorPos ScreenToClient WindowFromPoint GetMonitorInfoA EnumDisplayMonitors GetClientRect GetMessageExtraInfo TrackMouseEvent GetCapture SetCapture ReleaseCapture IsWindowUnicode SetWindowPos GetDC ReleaseDC MonitorFromWindow AdjustWindowRectEx CreateWindowExW DestroyWindow SetWindowLongPtrA ShowWindow SetWindowLongA GetWindowLongW BringWindowToTop SetForegroundWindow SetFocus IsIconic DefWindowProcW SetWindowLongW SetLayeredWindowAttributes GetPropA DefWindowProcA RegisterClassExW UnregisterClassW OpenClipboard GetClipboardData CloseClipboard EmptyClipboard SetClipboardData GetAsyncKeyState SetProcessDPIAware IsWindow MessageBoxA SetWindowDisplayAffinity GetWindowLongPtrA DispatchMessageA TranslateMessage PeekMessageA UnregisterClassA UpdateWindow CreateWindowExA GetSystemMetrics RegisterClassExA GetWindowRect

gdi32

GetDeviceCaps

shell32

ShellExecuteW

msvcp140

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_function_call@std@@YAXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Winerror_map@std@@YAHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?classic@locale@std@@SAAEBV12@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??Bios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Xtime_get_ticks _Thrd_join _Thrd_id _Cnd_wait _Cnd_signal ??7ios_base@std@@QEBA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Lockit@std@@QEAA@XZ ??1_Locinfo@std@@QEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Xbad_alloc@std@@YAXXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3d11

D3D11CreateDeviceAndSwapChain

ws2_32

getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs WSASetLastError inet_ntop WSAStartup WSACleanup inet_pton setsockopt gethostname ioctlsocket getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind WSAIoctl select __WSAFDIsSet socket htons accept

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertCloseStore CertOpenStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate __std_exception_copy wcschr memmove strrchr _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcpy memcmp memchr strstr strchr __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

free malloc calloc _set_new_mode realloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_initterm _set_app_type _seh_filter_exe _cexit _initterm_e _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv exit abort _exit _invoke_watson __p___argc __sys_errlist __sys_nerr _errno _get_initial_narrow_environment terminate _beginthreadex __p___argv _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_wfopen __p__commode __acrt_iob_func _close fputs ftell _fileno _read fseek _lseeki64 __stdio_common_vsprintf fgets __stdio_common_vsscanf _write fgetc ungetc fread _fseeki64 fgetpos fsetpos setvbuf fflush _wopen fputc fwrite fclose _get_stream_buffer_pointers _set_fmode __stdio_common_vfprintf feof

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _lock_file _unlock_file _unlink _fstat64 _waccess

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

acosf _ldclass _fdclass _dclass _dsign floorf _ldsign fmodf logf cosf atan2f powf _fdopen sinf _fdsign ceilf sqrtf __setusermatherr

api-ms-win-crt-convert-l1-1-0

atof strtoll strtod atoi strtol wcstombs strtoul strtoull

api-ms-win-crt-time-l1-1-0

_gmtime64 strftime _time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp strspn wcspbrk wcsncmp strpbrk wcsncpy _strdup _wcsdup strncpy strncmp strcspn

bcrypt

BCryptGenRandom

advapi32

CryptAcquireContextW CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam