cs2[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cs2.dll
Size 4.7MB
Sample260804-y7jf8adq21
SHA256 4683fbf97c008f8d08d72dbe8233018f24b9d35ce65761facf854d1fe0de950a
MD5 244e17cd89df94f00de8991cd9b51835
SHA1 feb9bded593937256cf09aceab1b51d6dc5278de
SHA512 0a3f78f8057bddf9d3d0bd90db0c352d95d1af01e6464d31371aa09669fcb2a63abedaa093e3465cd635cf87323c31704f3bd028c4b85651a9eb98f2aacaa444
SSDEEP 98304:5p/+iTzTRn3XXMKi17WUuBXOyPtyTjg83j/:1XXMKiYbO6tKjLz/
TLSH
T10A36BE13F74151AEC52AD43886AB93227331B8465B2257CB76482F35ADD73E02F3ABC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cs2.dll

File Explorer

cs2.dll

.dll 4.7MB

cs2.dll

IMPHASH bcf417eddcae66572c8b748db1d7b48b
SHA256 4683fbf97c008f8d08d72dbe8233018f24b9d35ce65761facf854d1fe0de950a
MD5 244e17cd89df94f00de8991cd9b51835
SHA1 feb9bded593937256cf09aceab1b51d6dc5278de
SHA512 0a3f78f8057bddf9d3d0bd90db0c352d95d1af01e6464d31371aa09669fcb2a63abedaa093e3465cd635cf87323c31704f3bd028c4b85651a9eb98f2aacaa444
SSDEEP 98304:5p/+iTzTRn3XXMKi17WUuBXOyPtyTjg83j/:1XXMKiYbO6tKjLz/
TLSH
T10A36BE13F74151AEC52AD43886AB93227331B8465B2257CB76482F35ADD73E02F3ABC5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1029728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AreFileApisANSI CloseHandle CreateDirectoryW CreateFile2 CreateFileA CreateFileMappingA CreateFileW CreateThread DisableThreadLibraryCalls FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetLastError GetLocalTime GetLocaleInfoEx GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleW GetProcAddress GetProcessHeap GetTickCount64 GlobalAlloc GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeSListHead LoadLibraryW LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW UnmapViewOfFile WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteFile

shell32

SHGetFolderPathW

user32

CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow EmptyClipboard GetAsyncKeyState GetClipboardData GetCursorPos GetSystemMetrics GetWindowLongPtrW LoadCursorW MapVirtualKeyW MessageBoxA OpenClipboard RegisterClassExA SetClipboardData SetCursor SetCursorPos UnregisterClassA

advapi32

RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

ole32

CoCreateInstance CoInitializeEx CreateStreamOnHGlobal

api-ms-win-core-synch-l1-2-0

WaitOnAddress

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??0_Lockit@std@@QEAA@H@Z ??0facet@locale@std@@IEAA@_K@Z ??0ios_base@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Locinfo@std@@QEAA@XZ ??1_Lockit@std@@QEAA@XZ ??1facet@locale@std@@MEAA@XZ ??1ios_base@std@@UEAA@XZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Incref@facet@locale@std@@UEAAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$numpunct@D@std@@2V0locale@2@A ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Mtx_lock _Mtx_unlock _Query_perf_counter _Query_perf_frequency _Thrd_hardware_concurrency

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140

_CxxThrowException __C_specific_handler __RTDynamicCast __intrinsic_setjmp __std_exception_copy __std_exception_destroy __std_type_info_destroy_list _purecall longjmp memchr memcmp memcpy memmove memset strrchr strstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _fseeki64 _get_stream_buffer_pointers fclose fflush fgetc fgetpos fputc fread fsetpos fwrite setvbuf ungetc

api-ms-win-crt-math-l1-1-0

_dsign _fdsign _ldsign acosf asinf atan2f atanf cosf expf fmodf ilogbf ldexp logf modff nextafterf pow powf remainderf scalbnf sin sinf sqrt sqrtf tanf

api-ms-win-crt-runtime-l1-1-0

_cexit _configure_narrow_argv _crt_atexit _errno _execute_onexit_table _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function abort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

_stricmp _strnicmp isalnum strcmp strcpy strlen strncmp strncpy strncpy_s tolower toupper wcslen

api-ms-win-crt-heap-l1-1-0

calloc free malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

strtod strtol strtoll strtoul strtoull

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

890KB

Virtual Size

890KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.0MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_addr

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cs2.dll

kernel32

shell32

user32

advapi32

ole32

api-ms-win-core-synch-l1-2-0

msvcp140

d3d11

vcruntime140

vcruntime140_1

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic