SteamSetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SteamSetup.exe
Size

1.1MB
MD5

c6bce0532378620674e053ecf9b8f319
SHA1

7a53591181da342f08aafbf307d07aba688ada43
SHA256

bd7f885f48c066cdef799aa4a4e271eae3ff5cbe21d092aa1cfa921ea0a4534c
SHA512

2ae02491ce86200d53bf8f51cec618408ad4378691ec9bb93b605183532bddb4ff231f9c177b434e638df967cd48ea1a77f3ce77b93e8da6447b895415398ecb
SSDEEP

12288:8EgYKwIPOWGaVNOTPZczrSpaRbCRPy8GumbRb8q6ZNohP+Pmm5aYvtPZDVb/mCSY:8fvw2hVWPCOpiCt8b98rvPrdDXEhzg3n

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

Files

SteamSetup.exe
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/09/2012, 00:00

Not After

23/11/2015, 23:59

Subject

CN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ec:8f:6a:8e:92:83:0b:02:b8:32:6c:28:c8:28:7e:54:79:19:42:ce
Signer

Actual PE Digest

ec:8f:6a:8e:92:83:0b:02:b8:32:6c:28:c8:28:7e:54:79:19:42:ce

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/StdUtils.dll
.dll windows:5 windows x86 arch:x86

6e63471b3d7c59cf9b8572bf93e2cf35

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_snprintf
swscanf
_snwprintf
rand
srand
time
_wcsicmp
??2@YAPAXI@Z
wcsncpy
??3@YAXPAX@Z
wcschr
_beginthreadex
memset

shlwapi

ord176

kernel32

LeaveCriticalSection
lstrcpynW
GlobalFree
MultiByteToWideChar
EnterCriticalSection
GetProcAddress
GetSystemTime
SystemTimeToFileTime
InitializeCriticalSection
DeleteCriticalSection
GetCommandLineW
GetVersionExW
WaitForSingleObject
CloseHandle
Sleep
CreateEventW
GetTickCount
FreeLibrary
LoadLibraryW
GetModuleHandleW
TerminateThread
GlobalAlloc

user32

MessageBoxA
LoadStringW
MessageBoxW
wsprintfW
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW

shell32

ShellExecuteExW
SHFileOperationW
ShellExecuteW

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

Exports

Exports

DisableVerboseMode
Dummy
EnableVerboseMode
ExecShellAsUser
ExecShellWait
FormatStr
FormatStr2
FormatStr3
GetAllParameters
GetDays
GetHours
GetMinutes
GetParameter
InvokeShellVerb
Rand
RandList
RandMax
RandMinMax
RevStr
SHFileCopy
SHFileMove
ScanStr
ScanStr2
ScanStr3
Time
TrimStr
TrimStrLeft
TrimStrRight
WaitForProc

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:5 windows x86 arch:x86

8700d0ebbb41c81ea52718af1ab70a93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
MultiByteToWideChar
lstrlenA
lstrcmpiW
lstrlenW
ExitProcess
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrcpynW
GetCommandLineW
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
GetModuleHandleW
GetTickCount
GetStartupInfoW
CreatePipe
GetVersionExW
GlobalLock
DeleteFileW
lstrcatW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetProcAddress
PeekNamedPipe
GetCurrentProcess

user32

CharPrevW
CharNextW
SendMessageW
FindWindowExW
wsprintfW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 454B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Steam.exe
.exe windows:5 windows x86 arch:x86

b3b4c245f825100b5f35f5261e1fbd10

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/09/2012, 00:00

Not After

23/11/2015, 23:59

Subject

CN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

db:53:da:35:c7:eb:c3:d8:1b:38:39:a6:aa:b4:c7:72:72:14:6d:09
Signer

Actual PE Digest

db:53:da:35:c7:eb:c3:d8:1b:38:39:a6:aa:b4:c7:72:72:14:6d:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\buildslave\steam_main_win32\build\src\steamexe\Release\steamexe.pdb

Imports

ws2_32

select
__WSAFDIsSet
WSASendTo
WSARecvFrom
closesocket
shutdown
WSASocketA
accept
WSAGetLastError
bind
WSAIoctl
ioctlsocket
gethostbyname
ntohl
ntohs
htons
htonl
recv
send
connect
setsockopt
WSACleanup
getsockname
WSAStartup

comctl32

InitCommonControlsEx

kernel32

GetModuleFileNameA
RemoveDirectoryW
GetFullPathNameW
GlobalUnlock
GlobalAlloc
GlobalLock
InterlockedIncrement
InterlockedDecrement
GetFileSize
FindClose
GetDriveTypeA
DeviceIoControl
UnhandledExceptionFilter
IsProcessorFeaturePresent
SetEnvironmentVariableW
HeapReAlloc
HeapCreate
GetStartupInfoW
HeapSetInformation
ExitProcess
FindFirstFileExA
FileTimeToLocalFileTime
MoveFileA
RtlUnwind
GetFullPathNameA
PostQueuedCompletionStatus
CreateIoCompletionPort
GetVersion
GlobalFree
GetLocalTime
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
SetProcessAffinityMask
GetProcessAffinityMask
GetSystemInfo
HeapAlloc
HeapFree
HeapSize
InterlockedExchangeAdd
HeapValidate
DeleteFileA
SetLastError
GetFileAttributesA
SetFileAttributesA
GetFileAttributesW
LocalFree
GetCurrentProcess
FreeLibrary
LoadLibraryA
Sleep
InterlockedCompareExchange
InterlockedExchange
GetTickCount
CopyFileA
MoveFileExW
SetErrorMode
SetEnvironmentVariableA
GetLastError
WriteFile
ReadFile
CreateFileA
WideCharToMultiByte
InitializeCriticalSection
CreateEventA
CreateThread
GetVersionExA
GetCurrentThreadId
ResetEvent
SetEvent
DeleteCriticalSection
CloseHandle
MultiByteToWideChar
OutputDebugStringA
GetCurrentDirectoryA
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
DebugBreak
GetProcessHeaps
HeapQueryInformation
SetUnhandledExceptionFilter
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleFileNameW
VirtualFree
VirtualProtect
OpenEventA
GetModuleHandleA
ResumeThread
SuspendThread
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
CreateMutexA
GetCurrentProcessId
RaiseException
GetCPInfo
SetThreadAffinityMask
TerminateThread
GetThreadPriority
OpenThread
WriteConsoleW
SetStdHandle
CompareStringW
VirtualQuery
GetTimeZoneInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
PeekNamedPipe
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetExitCodeThread
GetCurrentThread
GetSystemTimeAsFileTime
GetProcAddress
CreateProcessA
QueryPerformanceFrequency
QueryPerformanceCounter
IsDebuggerPresent
GetCommandLineA
LCMapStringW
LoadLibraryExA
LoadLibraryW
LoadLibraryExW
GetModuleHandleW
SetFilePointer
GetFileSizeEx
SetEndOfFile
FlushFileBuffers
GetFileInformationByHandle
FindNextFileW
SleepEx
CreateFileW
CreateDirectoryW
SetFilePointerEx
SetFileAttributesW
SetFileTime
GetFileTime
DeleteFileW
GetDiskFreeSpaceA
GetDiskFreeSpaceExW
GetDriveTypeW
FindFirstFileW
WriteFileEx
VirtualAlloc
GetProcessHeap
HeapUnlock
HeapWalk
HeapLock
TerminateProcess

user32

wsprintfA
SetClipboardData
CloseClipboard
GetWindowTextLengthA
EmptyClipboard
OpenClipboard
SetDlgItemInt
GetWindowRect
GetDesktopWindow
SetWindowPos
EndDialog
DialogBoxParamA
IsWindowVisible
GetDlgItemInt
MessageBoxA
GetDlgItem
EnumWindows
GetWindowThreadProcessId
LoadIconA
RegisterClassExA
MsgWaitForMultipleObjects
LoadCursorA
SetClassLongA
KillTimer
CreateWindowExA
SetTimer
DefWindowProcA
BeginPaint
EndPaint
SetWindowTextW
RedrawWindow
GetWindowLongA
SetWindowLongA
SendMessageA
TranslateMessage
DispatchMessageA
PeekMessageA
MessageBoxW
PostMessageA
MonitorFromWindow
GetMonitorInfoA
MoveWindow
ShowWindow
UpdateWindow
DestroyWindow
GetMessageA
GetDC
ReleaseDC
SetDlgItemTextA

gdi32

ChoosePixelFormat
SetBkColor
AddFontMemResourceEx
TextOutW
GetTextExtentPoint32W
RemoveFontMemResourceEx
CreateFontA
CreateICA
CreateCompatibleDC
SwapBuffers
SetTextColor
CreateDIBSection
DeleteDC
DeleteObject
SetBkMode
GetStockObject
SelectObject
SetPixelFormat

advapi32

CryptGenRandom
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExA
RegOpenKeyA
RegSetValueExA
RegQueryValueExA
RegCloseKey

shell32

ord680
SHGetFileInfoW

oleaut32

VariantClear

Exports

Exports

CanSetClientBeta
ClientUpdateRunFrame
CreateInterface
GetBaseUserContentDir
GetBaseUserContentDirUTF8
GetBaseUserDir
GetBaseUserDirUTF8
GetBootstrapperVersion
GetClientUpdateBytesDownloaded
GetClientUpdateBytesToDownload
GetCurrentClientBeta
GetEUniverse
GetSteamExePath
GetSteamExePathUTF8
GetSteamInstallDir
GetSteamInstallDirUTF8
IsCheckingForUpdates
IsClientUpdateAvailable
PermitDownloadClientUpdates
SetClientBeta
StartCheckingForUpdates
g_dwDllEntryThreadId

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 298KB - Virtual size: 298KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 565KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/SteamService.exe
.exe windows:5 windows x86 arch:x86

b9543d7ba421c0959192e23cbc30b756

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/09/2012, 00:00

Not After

23/11/2015, 23:59

Subject

CN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

de:05:5b:32:36:87:f4:48:b5:36:ec:ab:c1:14:8a:b3:7d:de:e8:20
Signer

Actual PE Digest

de:05:5b:32:36:87:f4:48:b5:36:ec:ab:c1:14:8a:b3:7d:de:e8:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\buildslave\steam_main_win32\build\src\SteamServiceHost\Release\SteamServiceHost.pdb

Imports

shlwapi

SHDeleteKeyA
SHDeleteKeyW
SHStrDupW

shell32

SHGetFolderPathA
ShellExecuteA
SHGetMalloc
SHGetSpecialFolderPathA

kernel32

SetFileAttributesA
GetFileAttributesA
SetLastError
MoveFileExA
CopyFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetFullPathNameW
GlobalUnlock
GlobalAlloc
GlobalLock
InterlockedIncrement
ExpandEnvironmentStringsA
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
WriteFile
GetFileSize
CreateFileA
FindClose
FindNextFileA
DeviceIoControl
ReadFile
CreateFileW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
VirtualQuery
GetCurrentDirectoryW
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
IsValidCodePage
MultiByteToWideChar
GetFileAttributesW
GetCurrentProcess
GetVersionExA
InterlockedDecrement
GetTickCount
LocalFree
Sleep
OpenProcess
TerminateProcess
SetConsoleCtrlHandler
LoadLibraryA
FreeLibrary
SetConsoleTitleA
GetConsoleWindow
GetCommandLineA
GetFileAttributesExA
lstrlenA
DeleteFileA
RemoveDirectoryA
CreateDirectoryA
GetModuleFileNameA
OutputDebugStringA
GetLastError
GetEnvironmentStrings
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetCurrentDirectoryA
SetCurrentDirectoryA
SetEnvironmentVariableA
GetModuleHandleA
GetProcAddress
RtlUnwind
GetConsoleCP
GetConsoleMode
SetStdHandle
CompareStringW
WriteConsoleW
GetProcessAffinityMask
SetProcessAffinityMask
FindFirstFileA
GetOEMCP
GetACP
ExitProcess
UnhandledExceptionFilter
GetModuleHandleW
GetStdHandle
IsProcessorFeaturePresent
GetCPInfo
HeapReAlloc
HeapCreate
GetSystemInfo
HeapAlloc
HeapFree
HeapSize
InterlockedExchangeAdd
HeapValidate
GetProcessHeaps
HeapQueryInformation
InterlockedCompareExchange
HeapSetInformation
GetLocalTime
LCMapStringW
WideCharToMultiByte
SetFilePointer
SetEndOfFile
FlushFileBuffers
GetCurrentThreadId
CreateDirectoryW
GetDriveTypeW
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
VirtualAlloc
VirtualProtect
VirtualFree
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
HeapUnlock
HeapWalk
HeapLock
GetExitCodeThread
OpenThread
GetThreadPriority
SetThreadAffinityMask
RaiseException
SetEvent
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LoadLibraryExA
LoadLibraryW
LoadLibraryExW
SetUnhandledExceptionFilter
InterlockedExchange
DebugBreak

user32

EnumWindows
GetWindowThreadProcessId
ShowWindow
MessageBoxA
DialogBoxParamA
IsWindowVisible
GetDlgItemInt
EndDialog
OpenClipboard
EmptyClipboard
GetDlgItem
GetWindowTextLengthA
SetClipboardData
CloseClipboard
SetWindowPos
GetDesktopWindow
GetWindowRect
SetDlgItemInt
SetDlgItemTextA
wsprintfA

advapi32

AdjustTokenPrivileges
RegOpenKeyA
RegOpenKeyExW
RegEnumKeyExW
DuplicateTokenEx
CreateProcessAsUserA
SetNamedSecurityInfoA
OpenProcessToken
LookupPrivilegeValueA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
StartServiceA
SetServiceStatus
DeleteService
QueryServiceObjectSecurity
GetSecurityDescriptorDacl
ConvertStringSidToSidA
SetEntriesInAclA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetServiceObjectSecurity
CreateServiceA
ChangeServiceConfigA
ChangeServiceConfig2A
QueryServiceStatus
ControlService
QueryServiceStatusEx
OpenServiceA
OpenSCManagerA
CloseServiceHandle
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

CoInitialize
PropVariantClear
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

Exports

Exports

g_dwDllEntryThreadId

Sections

.text
Size: 354KB - Virtual size: 354KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 454KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
public/steambootstrapper_brazilian.txt
public/steambootstrapper_czech.txt
public/steambootstrapper_danish.txt
public/steambootstrapper_dutch.txt
public/steambootstrapper_english.txt
public/steambootstrapper_finnish.txt
public/steambootstrapper_french.txt
public/steambootstrapper_german.txt
public/steambootstrapper_greek.txt
public/steambootstrapper_hungarian.txt
public/steambootstrapper_italian.txt
public/steambootstrapper_japanese.txt
public/steambootstrapper_korean.txt
public/steambootstrapper_koreana.txt
public/steambootstrapper_norwegian.txt
public/steambootstrapper_polish.txt
public/steambootstrapper_portuguese.txt
public/steambootstrapper_romanian.txt
public/steambootstrapper_russian.txt
public/steambootstrapper_schinese.txt
public/steambootstrapper_spanish.txt
public/steambootstrapper_swedish.txt
public/steambootstrapper_tchinese.txt
public/steambootstrapper_thai.txt
public/steambootstrapper_turkish.txt
uninstall.exe.nsis

Sharing

General

Malware Config

Signatures

Files

32f3282581436269b3a75b6675fe3e08

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

ec:8f:6a:8e:92:83:0b:02:b8:32:6c:28:c8:28:7e:54:79:19:42:ceSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 1.7MB

.rsrc Size: 125KB - Virtual size: 125KB

.reloc Size: 4KB - Virtual size: 3KB

6e63471b3d7c59cf9b8572bf93e2cf35

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

shlwapi

kernel32

user32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 68B

.rsrc Size: 1024B - Virtual size: 904B

.reloc Size: 1KB - Virtual size: 1KB

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 963B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 588B

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

ec:8f:6a:8e:92:83:0b:02:b8:32:6c:28:c8:28:7e:54:79:19:42:ce
Signer

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 1.7MB

.rsrc
Size: 125KB - Virtual size: 125KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 68B

.rsrc
Size: 1024B - Virtual size: 904B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 454B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

db:53:da:35:c7:eb:c3:d8:1b:38:39:a6:aa:b4:c7:72:72:14:6d:09
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 298KB - Virtual size: 298KB

.data
Size: 59KB - Virtual size: 565KB

.rsrc
Size: 105KB - Virtual size: 105KB

.reloc
Size: 139KB - Virtual size: 139KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate