cs2[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cs2.dll
Size 5.0MB
Sample260809-sdapbsgq7z
SHA256 20d4ed3ef0c5e2067ba70b85e399ebfc1e1820287a02c6cffa0fd21b7a0af42a
MD5 3eb3390eb8a10a72a60364b0c2b78fe5
SHA1 fbcfeb80c3703842ceccb8f2cb5f29652082774e
SHA512 52b2bb2c5ab18b11e3a0d3171704a6a487eac47a1b6339979c63a4c792f101d1c540671463ee17431458ed82cc12c5ed7998724abeda5e9154dfb2a40358cf01
SSDEEP 49152:hVvUVNTxBE2N7KB9nMflVH+f8IGzTfQ1Srtp4YuBXowuxhLzkTO2CEmLg1pk3njn:/vUVNTxi56DHC6UQPuBXoxRoTkg83j/
TLSH
T1D436BF13F74251ADC52AD53886AB9322B331B8059B3257CB66482F35ADD33E01F3ABD5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cs2.dll

File Explorer

cs2.dll

.dll 5.0MB

cs2.dll

IMPHASH eef7dbf6f9129e7cdcc4a04160bb7e51
SHA256 20d4ed3ef0c5e2067ba70b85e399ebfc1e1820287a02c6cffa0fd21b7a0af42a
MD5 3eb3390eb8a10a72a60364b0c2b78fe5
SHA1 fbcfeb80c3703842ceccb8f2cb5f29652082774e
SHA512 52b2bb2c5ab18b11e3a0d3171704a6a487eac47a1b6339979c63a4c792f101d1c540671463ee17431458ed82cc12c5ed7998724abeda5e9154dfb2a40358cf01
SSDEEP 49152:hVvUVNTxBE2N7KB9nMflVH+f8IGzTfQ1Srtp4YuBXowuxhLzkTO2CEmLg1pk3njn:/vUVNTxi56DHC6UQPuBXoxRoTkg83j/
TLSH
T1D436BF13F74251ADC52AD53886AB9322B331B8059B3257CB66482F35ADD33E01F3ABD5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1047808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\velocity-main\cs2\velocity-cs2\..\bin\cs2.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AreFileApisANSI CloseHandle CompareStringW CreateDirectoryW CreateFile2 CreateFileA CreateFileMappingA CreateFileW CreateThread DecodePointer DeleteCriticalSection DisableThreadLibraryCalls EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetTickCount64 GetUserDefaultLCID GlobalAlloc GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess UnhandledExceptionFilter UnmapViewOfFile VirtualProtect WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

shell32

SHGetFolderPathW

user32

CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow EmptyClipboard GetAsyncKeyState GetClipboardData GetCursorPos GetSystemMetrics GetWindowLongPtrW LoadCursorW MapVirtualKeyW MessageBoxA OpenClipboard RegisterClassExA SetClipboardData SetCursor SetCursorPos UnregisterClassA

advapi32

RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

ole32

CoCreateInstance CoInitializeEx CreateStreamOnHGlobal

api-ms-win-core-synch-l1-2-0

WaitOnAddress

d3d11

D3D11CreateDeviceAndSwapChain

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

965KB

Virtual Size

965KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.0MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_addr

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cs2.dll

kernel32

shell32

user32

advapi32

ole32

api-ms-win-core-synch-l1-2-0

d3d11

generic