release[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
release.zip
Size 4.4MB
Sample260804-t53d4avepg
SHA256 0b029235ac44bd6788465d4ee41f8cf71a14187a8ca04a17feb98f28ed125060
MD5 0c71f84838b2505e80d1bd45e5d71570
SHA1 db523dcc7862de14359bc66aac89818d3a4bb79b
SHA512 3dcfb887e711d76c9b9baaab87f2848dd42bd5c365eebe2a46e185cb255234ef257b103c087bdbaa840403de3a14aad3a4721f31b73d7d364ae6552ad531407f
SSDEEP 98304:88FeinU6qzzLiI10OaV5wvO0PuWqfoXnhjo9bhvGPSGARX04/fNLJ:86UhfmCy/vWqQXtSh2yRX0qfNLJ
TLSH
T1C326339994E0F92CE0EF86366993C09217AED2F043E5DF56D06D4928C32F38F875D54A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cs2-external-esp.exe

File Explorer

release.zip

.zip 4.4MB
LICENSE

19KB
README.md

4KB
cs2-external-esp.exe

.exe 1.6MB
cs2-external-esp.pdb

13.5MB

release.zip

SHA256 0b029235ac44bd6788465d4ee41f8cf71a14187a8ca04a17feb98f28ed125060
MD5 0c71f84838b2505e80d1bd45e5d71570
SHA1 db523dcc7862de14359bc66aac89818d3a4bb79b
SHA512 3dcfb887e711d76c9b9baaab87f2848dd42bd5c365eebe2a46e185cb255234ef257b103c087bdbaa840403de3a14aad3a4721f31b73d7d364ae6552ad531407f
SSDEEP 98304:88FeinU6qzzLiI10OaV5wvO0PuWqfoXnhjo9bhvGPSGARX04/fNLJ:86UhfmCy/vWqQXtSh2yRX0qfNLJ
TLSH
T1C326339994E0F92CE0EF86366993C09217AED2F043E5DF56D06D4928C32F38F875D54A
MD5 SHA1 SHA512 SSDEEP TLSH

cs2-external-esp.exe

IMPHASH 382b3aef8a0f532ff14c9a7514fdfbb8
SHA256 3a2ff72c5dc391d6214fbd73d07ac2526d764af82cefbee84d46e753e10d2f56
MD5 bc310dac94f963a0a08471c9a5f5e65a
SHA1 8ec82141dea5cf41a5602c9e29468f0bbee803e8
SHA512 947e5385457a65c9366f94a06cab30930477a0b64c55333632c57511c41eec69a64db74ce37d1e4a6b04ab748f3eff93d9596629ce80b4dbf139dd75d38eac78
SSDEEP 24576:suPI2eK+zOWNr76ws0bOba2ba6Hmfir39ZDBGeh0lhSMXl3jfiKneeVYa:sZxF7Fs0bAaohm69ajKKne
TLSH
T1F175BF47B3E801E9C06BD179C943A617EAB270540F2067DF13E48AA82F636E15B7F752
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

729244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\cs2-external-esp\cs2-external-esp\x64\Release\cs2-external-esp.pdb

kernel32

SleepConditionVariableSRW Sleep GetCurrentThreadId CreateFileW FindClose FindFirstFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW MoveFileExW GetFileInformationByHandleEx WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemDirectoryW LoadLibraryW SetLastError FormatMessageW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx VerifyVersionInfoW GetFileSizeEx GetCurrentProcess SetPriorityClass AddVectoredExceptionHandler VirtualQuery GlobalLock VerSetConditionMask FreeLibrary LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA VirtualQueryEx Module32NextW K32GetModuleInformation K32EnumProcessModulesEx OpenProcess CloseHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot MultiByteToWideChar SetConsoleMode GetConsoleMode SetConsoleOutputCP AcquireSRWLockExclusive GlobalFree GlobalAlloc IsProcessorFeaturePresent GlobalUnlock SetConsoleTitleA GetStdHandle GetModuleHandleA GetProcAddress ReleaseSRWLockExclusive

user32

GetWindowThreadProcessId FindWindowExA GetWindowTextA IsWindowVisible GetKeyboardLayout SetPropA SetCursor LoadCursorA GetKeyState GetCursorPos GetForegroundWindow IsChild ClientToScreen SetCursorPos ScreenToClient WindowFromPoint GetMonitorInfoA EnumDisplayMonitors GetClientRect GetMessageExtraInfo TrackMouseEvent GetCapture SetCapture ReleaseCapture IsWindowUnicode SetWindowPos GetDC ReleaseDC MonitorFromWindow AdjustWindowRectEx CreateWindowExW DestroyWindow SetWindowLongPtrA ShowWindow SetWindowLongA GetWindowLongW BringWindowToTop SetForegroundWindow SetFocus IsIconic DefWindowProcW SetWindowLongW SetLayeredWindowAttributes GetPropA DefWindowProcA RegisterClassExW UnregisterClassW OpenClipboard GetClipboardData CloseClipboard EmptyClipboard SetClipboardData GetAsyncKeyState SetProcessDPIAware IsWindow MessageBoxA SetWindowDisplayAffinity GetWindowLongPtrA DispatchMessageA TranslateMessage PeekMessageA UnregisterClassA UpdateWindow CreateWindowExA GetSystemMetrics RegisterClassExA GetWindowRect

gdi32

GetDeviceCaps

shell32

ShellExecuteW

msvcp140

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_function_call@std@@YAXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Winerror_map@std@@YAHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?classic@locale@std@@SAAEBV12@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??Bios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Xtime_get_ticks _Thrd_join _Thrd_id _Cnd_wait _Cnd_signal ??7ios_base@std@@QEBA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Lockit@std@@QEAA@XZ ??1_Locinfo@std@@QEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Xbad_alloc@std@@YAXXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3d11

D3D11CreateDeviceAndSwapChain

ws2_32

getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs WSASetLastError inet_ntop WSAStartup WSACleanup inet_pton setsockopt gethostname ioctlsocket getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind WSAIoctl select __WSAFDIsSet socket htons accept

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertCloseStore CertOpenStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate __std_exception_copy wcschr memmove strrchr _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcpy memcmp memchr strstr strchr __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

free malloc calloc _set_new_mode realloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_initterm _set_app_type _seh_filter_exe _cexit _initterm_e _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv exit abort _exit _invoke_watson __p___argc __sys_errlist __sys_nerr _errno _get_initial_narrow_environment terminate _beginthreadex __p___argv _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_wfopen __p__commode __acrt_iob_func _close fputs ftell _fileno _read fseek _lseeki64 __stdio_common_vsprintf fgets __stdio_common_vsscanf _write fgetc ungetc fread _fseeki64 fgetpos fsetpos setvbuf fflush _wopen fputc fwrite fclose _get_stream_buffer_pointers _set_fmode __stdio_common_vfprintf feof

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _lock_file _unlock_file _unlink _fstat64 _waccess

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

acosf _ldclass _fdclass _dclass _dsign floorf _ldsign fmodf logf cosf atan2f powf _fdopen sinf _fdsign ceilf sqrtf __setusermatherr

api-ms-win-crt-convert-l1-1-0

atof strtoll strtod atoi strtol wcstombs strtoul strtoull

api-ms-win-crt-time-l1-1-0

_gmtime64 strftime _time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp strspn wcspbrk wcsncmp strpbrk wcsncpy _strdup _wcsdup strncpy strncmp strcspn

bcrypt

BCryptGenRandom

advapi32

CryptAcquireContextW CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam