cs2-external-esp[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
cs2-external-esp.exe
Size 1.6MB
Sample261110-e4pz2sch26
SHA256 2c41b9e5fb452676a87fee14ee2f8fbe35552aa5e5747317c97ac67223c72c14
MD5 a0405c299732b66305cdb88dacb0927f
SHA1 eb6f3ee23a28fd442165b91663848bd7ececdc0d
SHA512 fc90c98de0bd02fc808e03fe39706d39a106d78c0a07941fd77c7b21f5639e2213d7f205b58b2c0000d25967b555a2e3d3489a86f8499885ccebebf5323645f5
SSDEEP 24576:pxrMr0OsTm3nlCY0mf7iqp4tu2Tg+WZaah0lhSMXlgz/siKnPnaY:pxPSlC/M7N+jgU3ARKnPn
TLSH
T1E175BF47B3E800E9C0ABD179C9439617EA7270540F2167DF13E48EA82F636E15B7B762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cs2-external-esp.exe

File Explorer

cs2-external-esp.exe

.exe 1.6MB

cs2-external-esp.exe

IMPHASH 382b3aef8a0f532ff14c9a7514fdfbb8
SHA256 2c41b9e5fb452676a87fee14ee2f8fbe35552aa5e5747317c97ac67223c72c14
MD5 a0405c299732b66305cdb88dacb0927f
SHA1 eb6f3ee23a28fd442165b91663848bd7ececdc0d
SHA512 fc90c98de0bd02fc808e03fe39706d39a106d78c0a07941fd77c7b21f5639e2213d7f205b58b2c0000d25967b555a2e3d3489a86f8499885ccebebf5323645f5
SSDEEP 24576:pxrMr0OsTm3nlCY0mf7iqp4tu2Tg+WZaah0lhSMXlgz/siKnPnaY:pxPSlC/M7N+jgU3ARKnPn
TLSH
T1E175BF47B3E800E9C0ABD179C9439617EA7270540F2167DF13E48EA82F636E15B7B762
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

729964

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\cs2-external-esp\cs2-external-esp\x64\Release\cs2-external-esp.pdb

kernel32

SleepConditionVariableSRW Sleep GetCurrentThreadId CreateFileW FindClose FindFirstFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW MoveFileExW GetFileInformationByHandleEx WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemDirectoryW LoadLibraryW SetLastError FormatMessageW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects SleepEx VerifyVersionInfoW GetFileSizeEx GetCurrentProcess SetPriorityClass AddVectoredExceptionHandler VirtualQuery GlobalLock VerSetConditionMask FreeLibrary LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA VirtualQueryEx Module32NextW K32GetModuleInformation K32EnumProcessModulesEx OpenProcess CloseHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot MultiByteToWideChar SetConsoleMode GetConsoleMode SetConsoleOutputCP AcquireSRWLockExclusive GlobalFree GlobalAlloc IsProcessorFeaturePresent GlobalUnlock SetConsoleTitleA GetStdHandle GetModuleHandleA GetProcAddress ReleaseSRWLockExclusive

user32

GetWindowThreadProcessId FindWindowExA GetWindowTextA IsWindowVisible GetKeyboardLayout SetPropA SetCursor LoadCursorA GetKeyState GetCursorPos GetForegroundWindow IsChild ClientToScreen SetCursorPos ScreenToClient WindowFromPoint GetMonitorInfoA EnumDisplayMonitors GetClientRect GetMessageExtraInfo TrackMouseEvent GetCapture SetCapture ReleaseCapture IsWindowUnicode SetWindowPos GetDC ReleaseDC MonitorFromWindow AdjustWindowRectEx CreateWindowExW DestroyWindow SetWindowLongPtrA ShowWindow SetWindowLongA GetWindowLongW BringWindowToTop SetForegroundWindow SetFocus IsIconic DefWindowProcW SetWindowLongW SetLayeredWindowAttributes GetPropA DefWindowProcA RegisterClassExW UnregisterClassW OpenClipboard GetClipboardData CloseClipboard EmptyClipboard SetClipboardData GetAsyncKeyState SetProcessDPIAware IsWindow MessageBoxA SetWindowDisplayAffinity GetWindowLongPtrA DispatchMessageA TranslateMessage PeekMessageA UnregisterClassA UpdateWindow CreateWindowExA GetSystemMetrics RegisterClassExA GetWindowRect

gdi32

GetDeviceCaps

shell32

ShellExecuteW

msvcp140

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Xout_of_range@std@@YAXPEBD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_function_call@std@@YAXXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Winerror_map@std@@YAHH@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?classic@locale@std@@SAAEBV12@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??Bios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Xtime_get_ticks _Thrd_join _Thrd_id _Cnd_wait _Cnd_signal ??7ios_base@std@@QEBA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ??0_Lockit@std@@QEAA@H@Z ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Lockit@std@@QEAA@XZ ??1_Locinfo@std@@QEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Xbad_alloc@std@@YAXXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3d11

D3D11CreateDeviceAndSwapChain

ws2_32

getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs WSASetLastError inet_ntop WSAStartup WSACleanup inet_pton setsockopt gethostname ioctlsocket getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind WSAIoctl select __WSAFDIsSet socket htons accept

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertCloseStore CertOpenStore CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFreeCertificateContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate __std_exception_copy wcschr memmove strrchr _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcpy memcmp memchr strstr strchr __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

free malloc calloc _set_new_mode realloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_initterm _set_app_type _seh_filter_exe _cexit _initterm_e _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv exit abort _exit _invoke_watson __p___argc __sys_errlist __sys_nerr _errno _get_initial_narrow_environment terminate _beginthreadex __p___argv _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_wfopen __p__commode __acrt_iob_func _close fputs ftell _fileno _read fseek _lseeki64 __stdio_common_vsprintf fgets __stdio_common_vsscanf _write fgetc ungetc fread _fseeki64 fgetpos fsetpos setvbuf fflush _wopen fputc fwrite fclose _get_stream_buffer_pointers _set_fmode __stdio_common_vfprintf feof

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _lock_file _unlock_file _unlink _fstat64 _waccess

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

acosf _ldclass _fdclass _dclass _dsign floorf _ldsign fmodf logf cosf atan2f powf _fdopen sinf _fdsign ceilf sqrtf __setusermatherr

api-ms-win-crt-convert-l1-1-0

atof strtoll strtod atoi strtol wcstombs strtoul strtoull

api-ms-win-crt-time-l1-1-0

_gmtime64 strftime _time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strcmp strspn wcspbrk wcsncmp strpbrk wcsncpy _strdup _wcsdup strncpy strncmp strcspn

bcrypt

BCryptGenRandom

advapi32

CryptAcquireContextW CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam