cs2[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cs2.exe
Size 22KB
Sample261102-eyjwvaea82
SHA256 f2f08108994585761e5f73cbc2df6763e90d18b87160eb926d5e3c90be8c7a2f
MD5 56b57dbd2c61f86b2bc552d2fce51d2c
SHA1 f7fd13e5771089f086701430a5d729e9c7ddd463
SHA512 3ab8d51217f1661148530d51734e2c9db47978d9ae3286da33db67aec0fdb1ad409665be1ec00c4de168bd6afc5a19055385b76ccc43dad2e368449a12ade3e7
SSDEEP 384:wTC3ly15r4AhfgtnF/YT9QwD822yPuc4V+3Oke38h8:j05hfgtnF/YaI82d4D3Q8
TLSH
T176A24B27B75A0EEAE57AD07DC9A23517E2B1B90A5721D3CF0781861E0F732C16C3EA41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cs2.exe

File Explorer

cs2.exe

.exe 22KB

cs2.exe

IMPHASH 24f6ff54d9a21abc2c002de950d05b53
SHA256 f2f08108994585761e5f73cbc2df6763e90d18b87160eb926d5e3c90be8c7a2f
MD5 56b57dbd2c61f86b2bc552d2fce51d2c
SHA1 f7fd13e5771089f086701430a5d729e9c7ddd463
SHA512 3ab8d51217f1661148530d51734e2c9db47978d9ae3286da33db67aec0fdb1ad409665be1ec00c4de168bd6afc5a19055385b76ccc43dad2e368449a12ade3e7
SSDEEP 384:wTC3ly15r4AhfgtnF/YT9QwD822yPuc4V+3Oke38h8:j05hfgtnF/YaI82d4D3Q8
TLSH
T176A24B27B75A0EEAE57AD07DC9A23517E2B1B90A5721D3CF0781861E0F732C16C3EA41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\shane\source\repos\cs2\x64\Release\cs2.pdb

kernel32

Sleep GetCurrentThreadId RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent Module32NextW GetModuleHandleW ReadProcessMemory Module32FirstW CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot RtlLookupFunctionEntry OpenProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

user32

ReleaseDC PostQuitMessage TranslateMessage SetLayeredWindowAttributes PeekMessageW DispatchMessageW GetAsyncKeyState ShowWindow RegisterClassExW DefWindowProcW DestroyWindow GetDC FillRect CreateWindowExW GetSystemMetrics

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject DeleteDC SetTextColor TextOutA SetBkMode CreatePen Rectangle DeleteObject

msvcp140

?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ _Query_perf_frequency ?uncaught_exception@std@@YA_NXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler _CxxThrowException memset __current_exception_context __current_exception memcpy

api-ms-win-crt-runtime-l1-1-0

terminate _invoke_watson _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv _crt_atexit _register_onexit_function _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe __p___argc

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf_s _set_fmode

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale