vstdlib_s[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

vstdlib_s.dll
Size

312KB
MD5

20c62369a1608efa5352d82a3fe5d1b9
SHA1

46ec514941a819cc5593216a81bb8c897344166c
SHA256

6fedc71c90dbb0b0637b7024aa9e15e3a45ee809116de75e8ff6ffef83ef7f25
SHA512

b1e6255f0c95e3e9c0853334e229bbc9e322ca99c0fbfb9475e77dbfc2eff858131eb42afa8e1ff5e37e467b0f353376522118f4c147a66eb7d98a12c74c5cb6
SSDEEP

6144:m1CS1zFl3IOgTpDjDqw3hvwOu16rQnxBdlTux2ISmQpLR3dphVKL8+t:m1NIOgVDaWwOu1EyxrNOH8fp+L8+t

Score

1^/10

Malware Config

Signatures

Files

vstdlib_s.dll
.dll windows:5 windows x86 arch:x86

a3cfb6f9bfd71231efd298d766c11dd0

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/10/2018, 00:00

Not After

07/10/2021, 12:00

Subject

CN=Valve,O=Valve,L=Bellevue,ST=WA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9d:b4:20:7f:df:ee:3a:37:c3:ec:8c:2c:35:41:7e:04:22:ec:ca:c9
Signer

Actual PE Digest

9d:b4:20:7f:df:ee:3a:37:c3:ec:8c:2c:35:41:7e:04:22:ec:ca:c9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\buildslave\steam_rel_client_win32\build\src\vstdlib\Release\vstdlib_s.pdb

Imports

kernel32

GetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
HeapAlloc
GetProcessHeap
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleExA
VerSetConditionMask
GetVersionExA
VerifyVersionInfoW
FoldStringW
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
SetLastError
GetFileSizeEx
WriteFile
ReadFile
FlushFileBuffers
SetFilePointer
FindClose
SetFileTime
CloseHandle
GetSystemTimeAsFileTime
GetProcAddress
GetDriveTypeW
GetDiskFreeSpaceA
CreateFileW
GetModuleHandleW
GetCurrentProcess
FreeLibrary
GetCommandLineW
WriteConsoleW
GetConsoleCP
DecodePointer
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
SetFilePointerEx
GetConsoleMode
GetStringTypeW
GetFileType
GetStdHandle
GetACP
GetModuleHandleExW
ExitProcess
GetCurrentDirectoryW
GetCurrentDirectoryA
SetCurrentDirectoryA
SetEnvironmentVariableA
GetFullPathNameA
DeleteCriticalSection
RtlUnwind
InterlockedFlushSList
RaiseException
TerminateProcess
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent

user32

CharLowerBuffW

tier0_s

Plat_OutputDebugStringRaw
VProfInternalEnterScopeCurrentThread
g_VProfProfilesRunningCount
ThreadGetCurrentProcessId
Plat_RelativeTicks
Is64BitOS
g_dwDllEntryThreadId
WriteMiniDump
Plat_IsInDebugSession
??1CThreadRWLock@@QAE@XZ
?UnlockWrite@CThreadRWLock@@QAEXXZ
?LockForWrite@CThreadRWLock@@QAEXXZ
?UnlockRead@CThreadRWLock@@QAEXXZ
?LockForRead@CThreadRWLock@@QAEXXZ
??0CThreadRWLock@@QAE@XZ
??0?$CDbgFmtSafeImplT@$00@@QAE@PAUDbgFmtFatalMsgTag_t@@VStringView@@@Z
Plat_OutputDebugString
??0?$CDbgFmtSafeImplT@$00@@QAE@VStringView@@@Z
Warning
VProfInternalGetProfileForCurrentThread
?GetCurrentScope@CVProfile@@QAEPAXXZ
?GetCurrentNode@CVProfile@@QAEPAVCVProfNode@@XZ
?IsEnabled@CVProfile@@QBE_NXZ
?ExitScope@CVProfile@@QAEXXZ
?EnterScope@CVProfile@@QAE_NPBDHW4EVProfBugdetGroup@@_NPAX@Z
?GetBudgetGroupID@CVProfNode@@QBE?AW4EVProfBugdetGroup@@XZ
?GetName@CVProfNode@@QAEPBDXZ
?GetCurrentScope@CVProfNode@@QAEPAXXZ
?GetProfile@CVProfNode@@QAEPAVCVProfile@@XZ
?GetParent@CVProfNode@@QAEPAV1@XZ
?Unlock@CThreadMutex@@QAEXXZ
?Lock@CThreadMutex@@QAEXXZ
??1CThreadMutex@@QAE@XZ
??0CThreadMutex@@QAE@XZ
?Set@CThreadLocalBase@@QAEXPAX@Z
?Get@CThreadLocalBase@@QBEPAXXZ
??1CThreadLocalBase@@QAE@XZ
??0CThreadLocalBase@@QAE@XZ
??0?$CDbgFmtSafeImplT@$0A@@@QAA@PBDZZ
g_pMemAllocSteam
?ClaimMemory@CValidator@@QAEXPAX@Z
?Pop@CValidator@@QAEXXZ
?Push@CValidator@@QAEXPBDPAX0@Z
Error
_DMsg
Msg
AssertMsgImplementation
Plat_GetProcessArgv
?ClaimArrayMemory@CValidator@@QAEXPAX@Z
getcwd_utf8
Plat_ExitProcess
ThreadImplOneTimeInit
g_VProfile

Exports

Exports

??0CCommandLineParam@@QAE@PBD0@Z
??0CGaussianRandomStream@@QAE@PAVIUniformRandomStream@@@Z
??0CUniformRandomStream@@QAE@$$QAV0@@Z
??0CUniformRandomStream@@QAE@ABV0@@Z
??0CUniformRandomStream@@QAE@XZ
??1CCommandLineParam@@QAE@XZ
??4CGaussianRandomStream@@QAEAAV0@$$QAV0@@Z
??4CGaussianRandomStream@@QAEAAV0@ABV0@@Z
??4CStringNormalization@@QAEAAV0@$$QAV0@@Z
??4CStringNormalization@@QAEAAV0@ABV0@@Z
??4CURLUtils@@QAEAAV0@$$QAV0@@Z
??4CURLUtils@@QAEAAV0@ABV0@@Z
??4CUniformRandomStream@@QAEAAV0@$$QAV0@@Z
??4CUniformRandomStream@@QAEAAV0@ABV0@@Z
??BCCommandLineParam@@QBEPAUOpaqueHParamType@@XZ
??_7CUniformRandomStream@@6B@
??_FCGaussianRandomStream@@QAEXXZ
?AttachToStream@CGaussianRandomStream@@QAEXPAVIUniformRandomStream@@@Z
?Exists@CCommandLineParam@@QBE_NXZ
?FixupSeparatorScheme@CURLUtils@@SAXAAVCUtlString@@@Z
?Fold@CStringNormalization@@SAHPBGPAGH@Z
?GenerateRandomNumber@CUniformRandomStream@@AAEHXZ
?GetHParam@CCommandLineParam@@QBEPAUOpaqueHParamType@@XZ
?GetValue@CCommandLineParam@@QBEPBDPBD@Z
?Initialize@CStringNormalization@@SAXXZ
?IsTLD@CURLUtils@@SA_NPBD@Z
?Normalize@CStringNormalization@@SAH_NPBDPADH@Z
?Normalize@CStringNormalization@@SAH_NPBGPAGH@Z
?RandomChar@CUniformRandomStream@@UAEDXZ
?RandomFillMemory@CUniformRandomStream@@UAEXPAXI@Z
?RandomFloat@CGaussianRandomStream@@QAEMMM@Z
?RandomFloat@CUniformRandomStream@@UAEMMM@Z
?RandomInt@CUniformRandomStream@@UAEHHH@Z
?SetSeed@CUniformRandomStream@@UAEXH@Z
?Test_BValidateStructures@CStringNormalization@@SA_NXZ
?V_ConvertStringToUUID@@YA_NPBDW4EUUIDStringFlags@@PAUV_UUID@@@Z
?V_ConvertStringToUUID@@YA_NPBGW4EUUIDStringFlags@@PAUV_UUID@@@Z
?V_ConvertUUIDToString@@YA_NPBUV_UUID@@W4EUUIDStringFlags@@PADH@Z
?V_ConvertUUIDToString@@YA_NPBUV_UUID@@W4EUUIDStringFlags@@PAGH@Z
?V_EscapeShellArgumentAndAppend@@YAIPADIPBD@Z
?V_EscapeShellArgumentAndAppend@@YAIPAVCUtlStringBuilder@@PBD@Z
?V_EscapeShellArgumentAndAppendPOSIX@@YAIPADIPBD@Z
?V_EscapeShellArgumentAndAppendWin32@@YAIPADIPBD@Z
?V_ParseShellCommandLine@@YAXPBDAAV?$CUtlVector@VCUtlString@@V?$CUtlMemory@VCUtlString@@@@@@HPAPBD@Z
?V_ParseShellCommandLinePOSIX@@YAXPBDAAV?$CUtlVector@VCUtlString@@V?$CUtlMemory@VCUtlString@@@@@@HPAPBD@Z
?V_ParseShellCommandLineWin32@@YAXPBDAAV?$CUtlVector@VCUtlString@@V?$CUtlMemory@VCUtlString@@@@@@HPAPBD@Z
?V_SplitString3@@YAXPBDPBQBDHAAV?$CUtlVector@VCUtlString@@V?$CUtlMemory@VCUtlString@@@@@@2@Z
?V_SplitStringInternal@@YAXPBDPBQBDQAPBDHAAV?$CUtlVector@VCUtlString@@V?$CUtlMemory@VCUtlString@@@@@@_N@Z
?V_UnicodeAdvance@@YAPADPADH@Z
?V_UnicodeAdvance@@YAPAGPAGH@Z
?V_UnicodeAdvance@@YAPAIPAIH@Z
?V_UnicodeCaseConvert@@YAHAAV?$CUtlVector@GV?$CUtlMemory@G@@@@HW4EStringConvertErrorPolicy@@@Z
?V_UnicodeCaseConvert@@YAHAAVCUtlString@@HW4EStringConvertErrorPolicy@@@Z
?V_UnicodeCaseConvert@@YAHAAVCUtlStringBuilder@@HW4EStringConvertErrorPolicy@@@Z
?V_UnicodeCaseConvert@@YAHPBDPADHHW4EStringConvertErrorPolicy@@@Z
?V_UnicodeCaseConvert@@YAHPBGPAGHHW4EStringConvertErrorPolicy@@@Z
?V_UnicodeCaseConvert@@YAHPBIPAIHHW4EStringConvertErrorPolicy@@@Z
?V_UnicodeLength@@YAHPBD@Z
?V_UnicodeLength@@YAHPBG@Z
?V_UnicodeLength@@YAHPBI@Z
?V_UnicodeRepair@@YAHPADW4EStringConvertErrorPolicy@@@Z
?V_UnicodeRepair@@YAHPAGW4EStringConvertErrorPolicy@@@Z
?V_UnicodeRepair@@YAHPAIW4EStringConvertErrorPolicy@@@Z
?V_UnicodeValidate@@YA_NPBD@Z
?V_UnicodeValidate@@YA_NPBG@Z
?V_UnicodeValidate@@YA_NPBI@Z
?V_atoui128@@YA?AVuint128@@PBD@Z
?V_stristr@@YAPBDPBD0@Z
?ValidateStatics@CStringNormalization@@SAXAAVCValidator@@PBD@Z
?ValidateStatics@CURLUtils@@SAXAAVCValidator@@PBD@Z
BHanIdeograph
CanBeginLine
CanBreakBetween
CanBreakRepeated
CanEndLine
CommandLine
Coroutine_Cancel
Coroutine_Continue
Coroutine_Create
Coroutine_DebugBreak
Coroutine_GetCurrentlyActive
Coroutine_GetStackDepth
Coroutine_IsActive
Coroutine_IsAddressInOurStack
Coroutine_ReleaseThreadMemory
Coroutine_Test
Coroutine_ValidateGlobals
Coroutine_YieldToMain
CreateInterface
DebugStatsSystem
GetNameFromOSType
GetOSDetailString
GetOSType
GetPlatformFromOS
GetPlatformName
GetPlatformNameFromEPlatformType
GetPortableOsVersionInformation
InstallUniformRandomStream
KeyValuesSystemSteam
OSIsCompatible
OSTypesAreCompatible
StringAfterPrefix
StringAfterPrefixCaseSensitive
StringFindSuffix
VStdLib_GetICVarFactory
V_AggressiveStripPrecedingAndTrailingWhitespace
V_AggressiveStripPrecedingAndTrailingWhitespaceW
V_AppendParamToURL
V_AppendSlash
V_BasicHtmlEntityEncode
V_BasicHtmlEntityEncodeBuffer
V_CP437CharsToUTF8
V_ComposeFileName
V_CopyAndFixSlashes
V_DefaultExtension
V_EscapeStringForPHP
V_ExtractDomainFromURL
V_ExtractFileExtension
V_ExtractFilePath
V_FileBase
V_FixDoubleSlashes
V_FixSlashes
V_FixupPathName
V_FormatAndAppend
V_FormatAndAppendTail
V_FormatAndAppendV
V_Get2LDFromDomainName
V_GetCurrentDirectory
V_GetFileExtension
V_HtmlEntityDecodeToUTF8
V_IsAbsolutePath
V_IsDeprecatedW
V_IsMeanSpaceW
V_IsTLD
V_IsValidDomainNameCharacter
V_IsValidUChar32
V_IsValidURLCharacter
V_JoinNumbers
V_JoinNumbersUint
V_JoinNumbersUint64
V_LocaleSpecificANSIToUTF8
V_MakeAbsolutePath
V_MakeFileSafeName
V_MakeRelativePath
V_MatchWildcardDNSName
V_MatchWildcardString
V_NormalizeUTF8
V_NormalizeUTF8Old
V_ParseURLQueryString
V_RemoveDotSlashes
V_ReplaceBadFilenameCharacters
V_ReplaceBadFilenameCharactersInPlace
V_SetCurrentDirectory
V_SetExtension
V_SetURLParam
V_SplitNumbers
V_SplitNumbersUint
V_SplitStringInternal
V_StrLeft
V_StrReplaceChar
V_StrRight
V_StrSkipArticles
V_StrSlice
V_StrSubst
V_StrSubstInPlace
V_StrTrim
V_StripAndPreserveHTML
V_StripAndPreserveHTMLCore
V_StripBBCode
V_StripExtension
V_StripFilename
V_StripLastDir
V_StripPrecedingAndTrailingWhitespace
V_StripPrecedingAndTrailingWhitespaceW
V_StripTrailingSlash
V_StripTrailingWhitespaceASCII
V_StripUnprintable
V_StripUnprintableW
V_TruncateAbsolutePathToDiskIdentity
V_UChar32ToUTF16
V_UChar32ToUTF16Len
V_UChar32ToUTF8
V_UChar32ToUTF8Len
V_URLContainsDomain
V_URLCracker
V_URLDecode
V_URLDecodeRaw
V_URLEncode
V_URLEncodeRaw
V_URLParse
V_URLPartsToString
V_UTF16ToUChar32
V_UTF16ToUTF32
V_UTF16ToUTF8
V_UTF32CharsToUTF16
V_UTF32CharsToUTF8
V_UTF32ToUTF16
V_UTF32ToUTF8
V_UTF8ToUChar32
V_UTF8ToUTF16
V_UTF8ToUTF32
V_UnqualifiedFileName
V_WcsSkipArticles
V_Windows1252CharsToUTF8
V_atof
V_atoi
V_atoui64
V_binarytohex
V_hextobinary
V_isbreakablewspace
V_isbreakablewspace32
V_isnumeric
V_isstrlower
V_isvalidhex
V_iswalpha32
V_memcpy_nocache
V_pretifymem
V_pretifynum
V_snprintf
V_snwprintf
V_strcat
V_strcmp_prefix
V_stricmp_filename
V_stricmp_prefix
V_strlower_fast
V_strnappend
V_strncat
V_strncat_length
V_strncat_length_unbounded
V_strnchr
V_strncmp
V_strncpy
V_strnicmp
V_strnistr
V_strnlen
V_strristr
V_strtoi64
V_strtoui64
V_strupper_fast
V_tolower
V_toupper
V_towlower32
V_towupper32
V_vsnprintf
V_vsnprintfRet
V_vsnwprintf
V_wcscat
V_wcsncat
V_wcsncpy
V_wcstoi64
V_wcstoui64
V_whextobinary
WeakRandomChar
WeakRandomFillMemory
WeakRandomFloat
WeakRandomGaussianFloat
WeakRandomInt
WeakRandomSeed
WeakRandomUint32
vstdlib_wcsicmp
vstdlib_wcsnicmp
vstdlib_wcstoi64
vstdlib_wcstoui64

Sections

.text
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3cfb6f9bfd71231efd298d766c11dd0

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39Certificate

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

9d:b4:20:7f:df:ee:3a:37:c3:ec:8c:2c:35:41:7e:04:22:ec:ca:c9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

tier0_s

Exports

Exports

Sections

.text Size: 204KB - Virtual size: 203KB

.rdata Size: 80KB - Virtual size: 80KB

.data Size: 7KB - Virtual size: 68KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 10KB

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

05:4f:46:6c:ec:cb:e9:d6:be:e8:1f:54:35:e6:4d:47
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

9d:b4:20:7f:df:ee:3a:37:c3:ec:8c:2c:35:41:7e:04:22:ec:ca:c9
Signer

.text
Size: 204KB - Virtual size: 203KB

.rdata
Size: 80KB - Virtual size: 80KB

.data
Size: 7KB - Virtual size: 68KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 10KB