f2e15c991a9fe9bfa2f22266f43b9838e2796bc88c99f6c49636b1b8f7e28716

Sharing

Copy URL Twitter E-mail

General

Target
f2e15c991a9fe9bfa2f22266f43b9838e2796bc88c99f6c49636b1b8f7e28716
Size 2.8MB
Sample260905-m9fbssdd73
SHA256 f2e15c991a9fe9bfa2f22266f43b9838e2796bc88c99f6c49636b1b8f7e28716
MD5 1c55a79767f1017da1e998732b5055dd
SHA1 d7e34224e22a22a0326e458a51c8e5e52b573a88
SHA512 dec7f6ad1067d01947b6e070491732bb86c1341974d4170590a071cc94e6ff02ed00e8cc1dbbdd205ebba9def00be8e190ac52db2b1db8b81f4eb4f7fbd94b6c
SSDEEP 49152:4o7Auu1FKnAFSwKZsb8SzNK/Q/NZFCih3q0dHmcaTypJtq4MIl0iZFZaSc:17GKnmKZsb8bMFCih1G74Jtq4LCZSc
TLSH
T15CD5338F9EB7AADDFB785408BE276059CAF8D286C3D0CDA3D314D3F88938640665194D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CS2 Nexoria透视自喵换肤暴力多功能免费辅助CS2 Nexoria透视自喵换肤暴力多功能免费辅助/nexoriabeta/Injector.exe
unpack001/CS2 Nexoria透视自喵换肤暴力多功能免费辅助CS2 Nexoria透视自喵换肤暴力多功能免费辅助/nexoriabeta/nexoriabeta.dll

File Explorer

f2e15c991a9fe9bfa2f22266f43b9838e2796bc88c99f6c49636b1b8f7e28716

.zip 2.8MB
CS2 Nexoria透视自喵换肤暴力多功能免费辅助CS2 Nexoria透视自喵换肤暴力多功能免费辅助/nexoriabeta/Injector.exe

.exe 78KB
CS2 Nexoria透视自喵换肤暴力多功能免费辅助CS2 Nexoria透视自喵换肤暴力多功能免费辅助/nexoriabeta/nexoriabeta.dll

.dll 5.9MB

f2e15c991a9fe9bfa2f22266f43b9838e2796bc88c99f6c49636b1b8f7e28716

SHA256 f2e15c991a9fe9bfa2f22266f43b9838e2796bc88c99f6c49636b1b8f7e28716
MD5 1c55a79767f1017da1e998732b5055dd
SHA1 d7e34224e22a22a0326e458a51c8e5e52b573a88
SHA512 dec7f6ad1067d01947b6e070491732bb86c1341974d4170590a071cc94e6ff02ed00e8cc1dbbdd205ebba9def00be8e190ac52db2b1db8b81f4eb4f7fbd94b6c
SSDEEP 49152:4o7Auu1FKnAFSwKZsb8SzNK/Q/NZFCih3q0dHmcaTypJtq4MIl0iZFZaSc:17GKnmKZsb8bMFCih1G74Jtq4LCZSc
TLSH
T15CD5338F9EB7AADDFB785408BE276059CAF8D286C3D0CDA3D314D3F88938640665194D
MD5 SHA1 SHA512 SSDEEP TLSH

CS2 Nexoria透视自喵换肤暴力多功能免费辅助CS2 Nexoria透视自喵换肤暴力多功能免费辅助/nexoriabeta/Injector.exe

IMPHASH 9f45c6eee0dca030863ee0f8aa4906c4
SHA256 9be09eaa36161d26bd844539983f33c08c5f25e5c3896ac61af74c983ff2761f
MD5 bfec88bb585017b0f924da24960d2183
SHA1 5c9781b297908f775b7f42d33a67ac56b527d218
SHA512 f9312d8d8a1f15a2778f99a1980d8de467f0082f11b8b3275cfb97574b3e467490c2d3cfbe80b3958769a0909a29c42556af73fc715d86a6bcb24e2a96b64cd6
SSDEEP 768:toDlSfqA0CDnOifCzpXldVD7jpsgknerq+10DUB+ZD1NYIjsSKq1H+06iNc:GDAXbGpX/VD7j+nyq+imopNYIjsSKqE
TLSH
T177732A1AE86940BEC26AC9B8C6534D05DB73FC8A47D163CF93508DEA0F655C5AF3EA01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\-\Pictures\REVERSE\zethels\x64\Release\bebra_x64.pdb

kernel32

GetCurrentProcess GetStdHandle WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread GetLastError Process32NextW LoadLibraryA SetConsoleTitleA CloseHandle LoadLibraryW GetProcAddress VirtualAllocEx ReadProcessMemory GetModuleHandleW CreateRemoteThread VirtualFreeEx SetUnhandledExceptionFilter SetConsoleTextAttribute Process32FirstW WriteProcessMemory GetCurrentThreadId Sleep WideCharToMultiByte MultiByteToWideChar GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetFullPathNameW GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA LocalFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead

advapi32

GetTokenInformation OpenProcessToken

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Query_perf_counter ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy _CxxThrowException __std_terminate __C_specific_handler __current_exception_context __current_exception memcmp memset memmove memcpy

api-ms-win-crt-stdio-l1-1-0

fflush fclose fgetc fwrite fgetpos setvbuf ungetc fsetpos fread _fseeki64 fputc __p__commode _set_fmode _get_stream_buffer_pointers

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-string-l1-1-0

isdigit _wcsicmp strlen wcslen

api-ms-win-crt-runtime-l1-1-0

abort _configure_narrow_argv _initterm _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit exit _initterm_e _errno _initialize_narrow_environment _get_initial_narrow_environment terminate system _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

CS2 Nexoria透视自喵换肤暴力多功能免费辅助CS2 Nexoria透视自喵换肤暴力多功能免费辅助/nexoriabeta/nexoriabeta.dll

IMPHASH d8b69e29a6461a39724ba6aed33909f0
SHA256 473dea50d1b9918326e6a795ebb18a089977a5054903ca16eec73fea794194e4
MD5 c039500f17bd06a9e0351817ded5ff63
SHA1 2e94973dcc29eded2f4fcf1403bac4779972d552
SHA512 443663f9d689645db6928e4aa52cd50b4d7b47a906a0697940fabcacb94dfae7a4dcaacfb53fde32f53b574249005208940879efdc7134677b65cf9c71513e9d
SSDEEP 98304:1Dkf3pIQ64JQiyF14L54gouBXTF8gTE7y83j/:1K8EQiyF1ITF84Ez/
TLSH
T14856BF17F742157EC50AC838829787637231749A2F32A5DF61886A356EB73F01F3AB94
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1509840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\zethe\Downloads\nexoriabeta\nexoriabeta\nexoriabeta\nexoriabeta\..\bin\cs2.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AreFileApisANSI CloseHandle CompareStringW CreateDirectoryW CreateEventW CreateFile2 CreateFileA CreateFileMappingA CreateFileW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetTickCount64 GetUserDefaultLCID GlobalAlloc GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess UnhandledExceptionFilter UnmapViewOfFile VirtualProtect WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

shell32

SHGetFolderPathW

user32

CloseClipboard CreateWindowExA DefWindowProcA DestroyWindow EmptyClipboard FindWindowA FlashWindowEx GetAsyncKeyState GetClipboardData GetCursorPos GetSystemMetrics GetWindowLongPtrW LoadCursorW MapVirtualKeyW MessageBoxA OpenClipboard RegisterClassExA SetClipboardData SetCursor SetCursorPos UnregisterClassA

ole32

CoCreateInstance CoInitializeEx CreateStreamOnHGlobal

api-ms-win-core-synch-l1-2-0

WaitOnAddress

d3d11

D3D11CreateDeviceAndSwapChain

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.1MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_addr

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

232B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

f2e15c991a9fe9bfa2f22266f43b9838e2796bc88c99f6c49636b1b8f7e28716

CS2 Nexoria透视自喵换肤暴力多功能免费辅助CS2 Nexoria透视自喵换肤暴力多功能免费辅助/nexoriabeta/Injector.exe

kernel32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic

CS2 Nexoria透视自喵换肤暴力多功能免费辅助CS2 Nexoria透视自喵换肤暴力多功能免费辅助/nexoriabeta/nexoriabeta.dll

kernel32

shell32

user32

ole32

api-ms-win-core-synch-l1-2-0

d3d11

generic