cs2[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cs2.dll
Size 7.5MB
Sample260822-cc4ysazfpd
SHA256 006c942b5d7f8816e42d35ce169ea54deee221419a975d07ae15054715ac852f
MD5 f998889fdb0d2db1cc20c4d08b2b3de1
SHA1 ec801797e973bb13a224d6a55aed2c7268130a5c
SHA512 4c9d6a116819c66b4e4a020da0f71c8f2f7a7bb35d43284ddedc5fb5bd12b34edef59cd2bfef82e2b9f27d24a9084453880f81eb9a411f2c2ffc5c765eed8666
SSDEEP 98304:0yfxqJy3fCSp1fefMXblAw/hSdhf892d8puBXeWTGg83j/s:o3fvhAUe+GLz/
TLSH
T11386D013F743691EC51AD434C2A78723623174969F3296DF61885A39AEEB3F02F39784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cs2.dll

File Explorer

cs2.dll

.dll 7.5MB

cs2.dll

IMPHASH 5ce439f5b45d319f68c31d469c63ee9a
SHA256 006c942b5d7f8816e42d35ce169ea54deee221419a975d07ae15054715ac852f
MD5 f998889fdb0d2db1cc20c4d08b2b3de1
SHA1 ec801797e973bb13a224d6a55aed2c7268130a5c
SHA512 4c9d6a116819c66b4e4a020da0f71c8f2f7a7bb35d43284ddedc5fb5bd12b34edef59cd2bfef82e2b9f27d24a9084453880f81eb9a411f2c2ffc5c765eed8666
SSDEEP 98304:0yfxqJy3fCSp1fefMXblAw/hSdhf892d8puBXeWTGg83j/s:o3fvhAUe+GLz/
TLSH
T11386D013F743691EC51AD434C2A78723623174969F3296DF61885A39AEEB3F02F39784
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1105248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls FreeLibrary FreeLibraryAndExitThread GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetProcAddress LoadLibraryExW

shell32

SHGetFolderPathW ShellExecuteW

api-ms-win-core-file-l1-1-0

CreateDirectoryW CreateFileA CreateFileW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesExW GetFileSizeEx GetFileType ReadFile SetEndOfFile SetFilePointerEx WriteFile

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA LoadLibraryW

user32

ClientToScreen CloseClipboard CreateWindowExA DefWindowProcA DefWindowProcW DestroyWindow EmptyClipboard GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorPos GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetWindowLongPtrW IsWindowUnicode LoadCursorW MapVirtualKeyW MessageBoxA OpenClipboard RegisterClassExA ReleaseCapture ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos TrackMouseEvent UnregisterClassA

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetSystemTimeAsFileTime GetTickCount64

api-ms-win-core-processthreads-l1-1-0

CreateThread ExitProcess ExitThread GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetExitCodeThread GetStartupInfoW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringA

api-ms-win-core-string-l1-1-0

CompareStringW GetStringTypeW MultiByteToWideChar WideCharToMultiByte

api-ms-win-core-registry-l1-1-0

RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock

api-ms-win-core-heap-l2-1-0

GlobalAlloc GlobalFree LocalFree

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

GetLastError RaiseException SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx MoveFileExW

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler

d3dcompiler_47

D3DCompile

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-localization-l1-2-0

EnumSystemLocalesW FormatMessageA GetACP GetCPInfo GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetOEMCP GetUserDefaultLCID IsDBCSLeadByte IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind

crypt32

CryptUnprotectData

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive AcquireSRWLockShared CreateEventW DeleteCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx LeaveCriticalSection ReleaseSRWLockExclusive ReleaseSRWLockShared SetEvent TryAcquireSRWLockExclusive WaitForSingleObject WaitForSingleObjectEx

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize InitOnceComplete Sleep SleepConditionVariableSRW WaitOnAddress WakeAllConditionVariable WakeConditionVariable

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3d11

D3D11CreateDeviceAndSwapChain

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize

api-ms-win-core-memory-l1-1-0

MapViewOfFile UnmapViewOfFile VirtualProtect

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsFree FlsGetValue FlsSetValue

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW GetCommandLineA GetCommandLineW GetEnvironmentStringsW GetStdHandle SetEnvironmentVariableW SetStdHandle

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-console-l1-1-0

GetConsoleMode GetConsoleOutputCP ReadConsoleW WriteConsoleW

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.0MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

97KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

200B

Characteristics

Name

.tls

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_addr

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cs2.dll

api-ms-win-core-libraryloader-l1-2-0

shell32

api-ms-win-core-file-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

user32

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

d3dcompiler_47

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

crypt32

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

imm32

d3d11

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-heap-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-console-l1-1-0

oleaut32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

generic