ssfn_private[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

ssfn_private.zip
Size

263KB
MD5

564752d7dd82404fc516bfe6f8a3a07d
SHA1

ba5fe743ce3b3f566d9aedb34019fe0e3f300363
SHA256

69400260409131f57f0a4c3422912c15d76427f3ed5a819d8349d27d394c30b3
SHA512

a9701d376478ee64b74b01a5699568dd2c70cb9f26b3d9a825024784bcf05978b1addec57655f4399ed6cabdeb41fb440ce9e96cfcd853e5edf052e0b135c2d7
SSDEEP

6144:QAFsX7KdA0g1suHJCJHmAcRKAywnW9T2dyxyF:XFWWdNg1supQcRnW9TtU

Score

1^/10

Malware Config

Signatures

Files

ssfn_private.zip
.zip
ssfn_gfk.bat
ssfn_gfk.zip
.zip
B
D
E
F
G
H
I
SteamLibrary/GFK/appmanifest_223240.acf
SteamLibrary/libraryfolder.vdf
SteamLibrary/steam.dll
.dll windows x86

08e3311c74e5fb994f626e583ddc586e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07/10/2021, 00:00

Not After

09/10/2024, 23:59

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8d:1e:f7:5d:ae:d7:51:8a:5e:30:3b:d1:5a:2c:d3:d9:06:69:dd:8c:20:5b:9d:35:60:82:11:af:05:54:5d:1c
Signer

Actual PE Digest

8d:1e:f7:5d:ae:d7:51:8a:5e:30:3b:d1:5a:2c:d3:d9:06:69:dd:8c:20:5b:9d:35:60:82:11:af:05:54:5d:1c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

17/11/2022, 02:43
Valid: true

Chain 1

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

CommandLineToArgvW
ShellExecuteW

kernel32

DeleteCriticalSection
GetExitCodeProcess
OpenProcess
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetProcAddress
LoadLibraryExA
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
FindClose
DeviceIoControl
GetLastError
VerSetConditionMask
CreateDirectoryW
CreateFileA
DeleteFileW
GetFullPathNameW
WriteFile
SetLastError
Sleep
GetCurrentProcess
InitializeCriticalSection
GetVersionExA
LoadLibraryA
GlobalAlloc
GlobalUnlock
GlobalLock
LocalFree
MoveFileExW
VerifyVersionInfoW
SetEnvironmentVariableW
CloseHandle
WriteConsoleW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
DecodePointer
HeapReAlloc
GetTimeZoneInformation
SetStdHandle
GetFileAttributesW
GetCurrentDirectoryW
GetCommandLineW
GetCommandLineA
FreeLibrary
GetEnvironmentVariableA
OutputDebugStringA
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetSystemInfo
GetProcessAffinityMask
DebugBreak
GetProcessHeaps
SetUnhandledExceptionFilter
GetCurrentProcessId
SetProcessAffinityMask
LCMapStringW
CompareStringW
GetConsoleOutputCP
HeapAlloc
GetStdHandle
SetFilePointerEx
ReadConsoleW
GetConsoleMode
LocalAlloc
SetThreadAffinityMask
HeapFree
ExitProcess
HeapValidate
HeapSize
TlsFree
TlsSetValue
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
VirtualQuery
EncodePointer
InterlockedFlushSList
RtlUnwind
InitializeSListHead
TlsGetValue
GetStartupInfoW
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
TlsAlloc
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDiskFreeSpaceA
GetDriveTypeW
GetFileInformationByHandle
GetFileSizeEx
ReadFile
SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFileTime
GetTempPathW
SleepEx
GetSystemTimeAsFileTime
GetTempPathA
RaiseException
GetModuleFileNameA
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessHeap
HeapSetInformation
HeapLock
HeapUnlock
HeapWalk
HeapQueryInformation
TerminateProcess
GlobalMemoryStatusEx
VirtualAlloc
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
CreateThread
GetCurrentThread
OpenThread
TerminateThread
GetExitCodeThread

user32

GetDlgItemInt
SetDlgItemInt
GetDlgItem
EndDialog
DialogBoxParamA
SetWindowPos
wsprintfA
IsWindowVisible
GetWindowRect
EnumWindows
GetWindowThreadProcessId
OpenClipboard
GetDesktopWindow
MessageBoxA
GetWindowTextLengthA
EmptyClipboard
SetClipboardData
CloseClipboard
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

oleaut32

VariantClear

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

ws2_32

htonl
htons
ntohl
ntohs
send
freeaddrinfo
closesocket
connect
recv
socket
__WSAFDIsSet
bind
recvfrom
select
sendto
getaddrinfo

Exports

Exports

SteamAbortCall
SteamAbortOngoingUserIDTicketValidation
SteamAckSubscriptionReceipt
SteamBlockingCall
SteamChangeAccountName
SteamChangeEmailAddress
SteamChangeForgottenPassword
SteamChangeOfflineStatus
SteamChangePassword
SteamChangePersonalQA
SteamCheckAppOwnership
SteamCleanup
SteamClearError
SteamCloseFile
SteamCreateAccount
SteamCreateCachePreloaders
SteamCreateLogContext
SteamDefragCaches
SteamDeleteAccount
SteamEnumerateApp
SteamEnumerateAppDependency
SteamEnumerateAppIcon
SteamEnumerateAppLaunchOption
SteamEnumerateAppVersion
SteamEnumerateSubscription
SteamEnumerateSubscriptionDiscount
SteamEnumerateSubscriptionDiscountQualifier
SteamFindApp
SteamFindClose
SteamFindFirst
SteamFindFirst64
SteamFindNext
SteamFindNext64
SteamFindServersGetErrorString
SteamFindServersIterateServer
SteamFindServersNumServers
SteamFlushCache
SteamFlushFile
SteamForceCellId
SteamForgetAllHints
SteamGenerateSuggestedAccountNames
SteamGetAccountStatus
SteamGetAppCacheSize
SteamGetAppDLCStatus
SteamGetAppDependencies
SteamGetAppDir
SteamGetAppIds
SteamGetAppPurchaseCountry
SteamGetAppStats
SteamGetAppUpdateStats
SteamGetAppUserDefinedInfo
SteamGetAppUserDefinedRecord
SteamGetCacheDecryptionKey
SteamGetCacheDefaultDirectory
SteamGetCacheFilePath
SteamGetCachePercentFragmentation
SteamGetContentServerInfo
SteamGetCurrentAppId
SteamGetCurrentCellID
SteamGetCurrentEmailAddress
SteamGetDepotParent
SteamGetEncryptedUserIDTicket
SteamGetEncryptionKeyToSendToNewClient
SteamGetFileAttributeFlags
SteamGetLocalClientVersion
SteamGetLocalFileCopy
SteamGetNumAccountsWithEmailAddress
SteamGetOfflineStatus
SteamGetSponsorUrl
SteamGetSubscriptionExtendedInfo
SteamGetSubscriptionIds
SteamGetSubscriptionPurchaseCountry
SteamGetSubscriptionReceipt
SteamGetSubscriptionStats
SteamGetTotalUpdateStats
SteamGetUser
SteamGetUserType
SteamGetVersion
SteamGetc
SteamHintResourceNeed
SteamInitializeUserIDTicketValidator
SteamInsertAppDependency
SteamIsAccountNameInUse
SteamIsAppSubscribed
SteamIsCacheLoadingEnabled
SteamIsFileImmediatelyAvailable
SteamIsFileNeededByApp
SteamIsFileNeededByCache
SteamIsLoggedIn
SteamIsSecureComputer
SteamIsSubscribed
SteamIsUsingSdkContentServer
SteamLaunchApp
SteamLoadCacheFromDir
SteamLoadFileToApp
SteamLoadFileToCache
SteamLog
SteamLogResourceLoadFinished
SteamLogResourceLoadStarted
SteamLogin
SteamLogout
SteamMiniDumpInit
SteamMountAppFilesystem
SteamMountFilesystem
SteamMoveApp
SteamNumAppsRunning
SteamOpenFile
SteamOpenFile64
SteamOpenFileEx
SteamOpenTmpFile
SteamOptionalCleanUpAfterClientHasDisconnected
SteamPauseCachePreloading
SteamPrintFile
SteamProcessCall
SteamProcessOngoingUserIDTicketValidation
SteamPutc
SteamReadFile
SteamRefreshAccountInfo
SteamRefreshAccountInfo2
SteamRefreshAccountInfoEx
SteamRefreshLogin
SteamReleaseCacheFiles
SteamRemoveAppDependency
SteamRepairOrDecryptCaches
SteamRequestAccountsByCdKeyEmail
SteamRequestAccountsByEmailAddressEmail
SteamRequestEmailAddressVerificationEmail
SteamRequestForgottenPasswordEmail
SteamResumeCachePreloading
SteamSeekFile
SteamSeekFile64
SteamSetAppCacheSize
SteamSetAppVersion
SteamSetCacheDefaultDirectory
SteamSetMaxStallCount
SteamSetNotificationCallback
SteamSetUser
SteamSetUser2
SteamSetvBuf
SteamShutdownEngine
SteamShutdownSteamBridgeInterface
SteamShutdownUserIDTicketValidator
SteamSizeFile
SteamSizeFile64
SteamStartEngine
SteamStartEngineEx
SteamStartLoadingCache
SteamStartValidatingNewValveCDKey
SteamStartValidatingUserIDTicket
SteamStartup
SteamStat
SteamStat64
SteamStopLoadingCache
SteamSubscribe
SteamTellFile
SteamTellFile64
SteamUninstall
SteamUnmountAppFilesystem
SteamUnmountFilesystem
SteamUnsubscribe
SteamUpdateAccountBillingInfo
SteamUpdateSubscriptionBillingInfo
SteamVerifyEmailAddress
SteamVerifyPassword
SteamWaitForAppReadyToLaunch
SteamWaitForAppResources
SteamWaitForResources
SteamWasBlobRegistryDeleted
SteamWriteFile
SteamWriteMiniDumpFromAssert
SteamWriteMiniDumpSetComment
SteamWriteMiniDumpUsingExceptionInfo
SteamWriteMiniDumpUsingExceptionInfoWithBuildId
SteamWriteMiniDumpWithAppID
_f
g_dwDllEntryThreadId

Sections

.text
Size: 339KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 510KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ssfn_letsbypass.bat

Sharing

General

Malware Config

Signatures

Files

08e3311c74e5fb994f626e583ddc586e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4Certificate

Extended Key Usages

Key Usages

8d:1e:f7:5d:ae:d7:51:8a:5e:30:3b:d1:5a:2c:d3:d9:06:69:dd:8c:20:5b:9d:35:60:82:11:af:05:54:5d:1cSigner

Signature Validations

Verification

17/11/2022, 02:43 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

shell32

kernel32

user32

advapi32

oleaut32

psapi

ws2_32

Exports

Exports

Sections

.text Size: 339KB - Virtual size: 338KB

.rdata Size: 113KB - Virtual size: 113KB

.data Size: 7KB - Virtual size: 510KB

.reloc Size: 20KB - Virtual size: 19KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

8d:1e:f7:5d:ae:d7:51:8a:5e:30:3b:d1:5a:2c:d3:d9:06:69:dd:8c:20:5b:9d:35:60:82:11:af:05:54:5d:1c
Signer

17/11/2022, 02:43
Valid: true

.text
Size: 339KB - Virtual size: 338KB

.rdata
Size: 113KB - Virtual size: 113KB

.data
Size: 7KB - Virtual size: 510KB

.reloc
Size: 20KB - Virtual size: 19KB