steam[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

steam.dll
Size

484KB
MD5

a0d903fe4186ff28995e8b6cbf8efc99
SHA1

f728721a150db2dcf90f5b451a846464a9d46352
SHA256

f99cd3b70442444e6366e982351f738b3443b768c7f67ea3e4c80c70bd1d274a
SHA512

75b825d18a9fa4a2236fbaef68ad62bacb73137368e872b45f38d90def8978c18d4945443e12786cc34c12807ea1aafc2938a6633afced3013941588835848c4
SSDEEP

12288:/AURU2FiaF6GI5Y1x5jC/vC5wY/ow3SEDXJVMZGSP2vG9IxEkPTEo6:ISU2F65Y1y/Kb1a8GQPTV6

Score

1^/10

Malware Config

Signatures

Files

steam.dll
.dll windows:6 windows x86 arch:x86

e80540ab4be11866b370e66839b5aa87

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07/10/2021, 00:00

Not After

09/10/2024, 23:59

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

27:6d:55:4b:cc:76:7b:5b:36:4f:3d:77:2b:7e:ec:34:eb:ed:2d:65:5a:da:c6:d0:21:37:a9:de:79:02:1b:47
Signer

Actual PE Digest

27:6d:55:4b:cc:76:7b:5b:36:4f:3d:77:2b:7e:ec:34:eb:ed:2d:65:5a:da:c6:d0:21:37:a9:de:79:02:1b:47

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\buildslave\steam_rel_client_win32\build\src\steam2wrapper\Release\steam.pdb

Imports

shell32

ShellExecuteW
CommandLineToArgvW

kernel32

WideCharToMultiByte
CreateFileW
FindClose
GetLastError
VerSetConditionMask
CreateDirectoryW
CreateFileA
DeleteFileW
GetFullPathNameW
WriteFile
SetLastError
Sleep
GetCurrentProcess
GetCurrentProcessId
GetVersionExA
LoadLibraryA
GlobalAlloc
MultiByteToWideChar
GlobalLock
LocalAlloc
LocalFree
MoveFileExW
VerifyVersionInfoW
DeleteCriticalSection
GetCurrentThread
SetStdHandle
LCMapStringW
CompareStringW
GetConsoleCP
HeapAlloc
GetStdHandle
SetFilePointerEx
ReadConsoleW
GetConsoleMode
HeapFree
ExitProcess
HeapValidate
HeapSize
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
VirtualQuery
EncodePointer
InterlockedFlushSList
LoadLibraryExW
LoadLibraryExA
GetProcAddress
GetModuleHandleExW
GetModuleHandleA
GetModuleFileNameW
OpenProcess
GlobalUnlock
GetExitCodeProcess
InitializeCriticalSection
CloseHandle
GetFileAttributesW
GetCurrentDirectoryW
GetCommandLineW
GetCommandLineA
FreeLibrary
GetEnvironmentVariableA
OutputDebugStringA
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetTimeZoneInformation
HeapReAlloc
DecodePointer
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
WriteConsoleW
OpenThread
RtlUnwind
InitializeSListHead
GetStartupInfoW
UnhandledExceptionFilter
IsProcessorFeaturePresent
CreateEventW
WaitForSingleObjectEx
SetProcessAffinityMask
SetUnhandledExceptionFilter
GetProcessHeaps
DebugBreak
GetProcessAffinityMask
CreateThread
CreateEventA
WaitForSingleObject
GetSystemInfo
ResetEvent
SetEvent
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
DuplicateHandle
SetEnvironmentVariableW
SetThreadAffinityMask
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetExitCodeThread
TerminateThread
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDiskFreeSpaceA
GetDriveTypeW
GetFileInformationByHandle
GetFileSizeEx
ReadFile
SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFileTime
GetTempPathW
SleepEx
GetSystemTimeAsFileTime
GetTempPathA
RaiseException
GetModuleFileNameA
GetModuleHandleW
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcessHeap
HeapSetInformation
HeapLock
HeapUnlock
HeapWalk
HeapQueryInformation
TerminateProcess
GlobalMemoryStatusEx
VirtualAlloc
IsDebuggerPresent

user32

GetDesktopWindow
MessageBoxA
GetWindowTextLengthA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
GetDlgItem
EndDialog
DialogBoxParamA
SetWindowPos
wsprintfA
GetWindowThreadProcessId
EnumWindows
GetWindowRect
IsWindowVisible

advapi32

RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

oleaut32

VariantClear

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

ws2_32

getaddrinfo
freeaddrinfo
closesocket
connect
recv
ntohs
socket
__WSAFDIsSet
bind
recvfrom
sendto
select
ntohl
htonl
send
htons

Exports

Exports

CreateInterface
SteamAbortCall
SteamAbortOngoingUserIDTicketValidation
SteamAckSubscriptionReceipt
SteamBlockingCall
SteamChangeAccountName
SteamChangeEmailAddress
SteamChangeForgottenPassword
SteamChangeOfflineStatus
SteamChangePassword
SteamChangePersonalQA
SteamCheckAppOwnership
SteamCleanup
SteamClearError
SteamCloseFile
SteamCreateAccount
SteamCreateCachePreloaders
SteamCreateLogContext
SteamDefragCaches
SteamDeleteAccount
SteamEnumerateApp
SteamEnumerateAppDependency
SteamEnumerateAppIcon
SteamEnumerateAppLaunchOption
SteamEnumerateAppVersion
SteamEnumerateSubscription
SteamEnumerateSubscriptionDiscount
SteamEnumerateSubscriptionDiscountQualifier
SteamFindApp
SteamFindClose
SteamFindFirst
SteamFindFirst64
SteamFindNext
SteamFindNext64
SteamFindServersGetErrorString
SteamFindServersIterateServer
SteamFindServersNumServers
SteamFlushCache
SteamFlushFile
SteamForceCellId
SteamForgetAllHints
SteamGenerateSuggestedAccountNames
SteamGetAccountStatus
SteamGetAppCacheSize
SteamGetAppDLCStatus
SteamGetAppDependencies
SteamGetAppDir
SteamGetAppIds
SteamGetAppPurchaseCountry
SteamGetAppStats
SteamGetAppUpdateStats
SteamGetAppUserDefinedInfo
SteamGetAppUserDefinedRecord
SteamGetCacheDecryptionKey
SteamGetCacheDefaultDirectory
SteamGetCacheFilePath
SteamGetCachePercentFragmentation
SteamGetContentServerInfo
SteamGetCurrentAppId
SteamGetCurrentCellID
SteamGetCurrentEmailAddress
SteamGetDepotParent
SteamGetEncryptedUserIDTicket
SteamGetEncryptionKeyToSendToNewClient
SteamGetFileAttributeFlags
SteamGetLocalClientVersion
SteamGetLocalFileCopy
SteamGetNumAccountsWithEmailAddress
SteamGetOfflineStatus
SteamGetSponsorUrl
SteamGetSubscriptionExtendedInfo
SteamGetSubscriptionIds
SteamGetSubscriptionPurchaseCountry
SteamGetSubscriptionReceipt
SteamGetSubscriptionStats
SteamGetTotalUpdateStats
SteamGetUser
SteamGetUserType
SteamGetVersion
SteamGetc
SteamHintResourceNeed
SteamInitializeUserIDTicketValidator
SteamInsertAppDependency
SteamIsAccountNameInUse
SteamIsAppSubscribed
SteamIsCacheLoadingEnabled
SteamIsFileImmediatelyAvailable
SteamIsFileNeededByApp
SteamIsFileNeededByCache
SteamIsLoggedIn
SteamIsSecureComputer
SteamIsSubscribed
SteamIsUsingSdkContentServer
SteamLaunchApp
SteamLoadCacheFromDir
SteamLoadFileToApp
SteamLoadFileToCache
SteamLog
SteamLogResourceLoadFinished
SteamLogResourceLoadStarted
SteamLogin
SteamLogout
SteamMiniDumpInit
SteamMountAppFilesystem
SteamMountFilesystem
SteamMoveApp
SteamNumAppsRunning
SteamOpenFile
SteamOpenFile64
SteamOpenFileEx
SteamOpenTmpFile
SteamOptionalCleanUpAfterClientHasDisconnected
SteamPauseCachePreloading
SteamPrintFile
SteamProcessCall
SteamProcessOngoingUserIDTicketValidation
SteamPutc
SteamReadFile
SteamRefreshAccountInfo
SteamRefreshAccountInfo2
SteamRefreshAccountInfoEx
SteamRefreshLogin
SteamReleaseCacheFiles
SteamRemoveAppDependency
SteamRepairOrDecryptCaches
SteamRequestAccountsByCdKeyEmail
SteamRequestAccountsByEmailAddressEmail
SteamRequestEmailAddressVerificationEmail
SteamRequestForgottenPasswordEmail
SteamResumeCachePreloading
SteamSeekFile
SteamSeekFile64
SteamSetAppCacheSize
SteamSetAppVersion
SteamSetCacheDefaultDirectory
SteamSetMaxStallCount
SteamSetNotificationCallback
SteamSetUser
SteamSetUser2
SteamSetvBuf
SteamShutdownEngine
SteamShutdownSteamBridgeInterface
SteamShutdownUserIDTicketValidator
SteamSizeFile
SteamSizeFile64
SteamStartEngine
SteamStartEngineEx
SteamStartLoadingCache
SteamStartValidatingNewValveCDKey
SteamStartValidatingUserIDTicket
SteamStartup
SteamStat
SteamStat64
SteamStopLoadingCache
SteamSubscribe
SteamTellFile
SteamTellFile64
SteamUninstall
SteamUnmountAppFilesystem
SteamUnmountFilesystem
SteamUnsubscribe
SteamUpdateAccountBillingInfo
SteamUpdateSubscriptionBillingInfo
SteamVerifyEmailAddress
SteamVerifyPassword
SteamWaitForAppReadyToLaunch
SteamWaitForAppResources
SteamWaitForResources
SteamWasBlobRegistryDeleted
SteamWriteFile
SteamWriteMiniDumpFromAssert
SteamWriteMiniDumpSetComment
SteamWriteMiniDumpUsingExceptionInfo
SteamWriteMiniDumpUsingExceptionInfoWithBuildId
SteamWriteMiniDumpWithAppID
_f
g_dwDllEntryThreadId

Sections

.text
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 510KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e80540ab4be11866b370e66839b5aa87

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4Certificate

Extended Key Usages

Key Usages

27:6d:55:4b:cc:76:7b:5b:36:4f:3d:77:2b:7e:ec:34:eb:ed:2d:65:5a:da:c6:d0:21:37:a9:de:79:02:1b:47Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

kernel32

user32

advapi32

oleaut32

psapi

ws2_32

Exports

Exports

Sections

.text Size: 332KB - Virtual size: 332KB

.rdata Size: 112KB - Virtual size: 112KB

.data Size: 6KB - Virtual size: 510KB

.reloc Size: 20KB - Virtual size: 20KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

27:6d:55:4b:cc:76:7b:5b:36:4f:3d:77:2b:7e:ec:34:eb:ed:2d:65:5a:da:c6:d0:21:37:a9:de:79:02:1b:47
Signer

.text
Size: 332KB - Virtual size: 332KB

.rdata
Size: 112KB - Virtual size: 112KB

.data
Size: 6KB - Virtual size: 510KB

.reloc
Size: 20KB - Virtual size: 20KB