44fa487917793b25530230f9cfc056d4c4040668b3d4ab3b0e94faaf1b5c4191

Sharing

Copy URL Twitter E-mail

General

Target

44fa487917793b25530230f9cfc056d4c4040668b3d4ab3b0e94faaf1b5c4191
Size

3.1MB
MD5

b304bb3b4b461020b3e2a0e9cfcc15fc
SHA1

c153bcbf67de0dcf19c83f61563901713adb5a1b
SHA256

44fa487917793b25530230f9cfc056d4c4040668b3d4ab3b0e94faaf1b5c4191
SHA512

6452a3d4240d7aef62b13a846a247883db5739af01dff5a1d897b2f9a6ee4275a69379edb6537c9cdd6526c9c5ec5804697f8171c484be22e41e04a7c98a3cbd
SSDEEP

49152:oIDzsLvhAXiHjBIaKZrNO1LG+c18Iz7wYB5sLKCtPvOHH9CChpmoDYsG6o:oID2viiH+ZrA9G5117w05svJOHC

Score

1^/10

Malware Config

Signatures

Files

44fa487917793b25530230f9cfc056d4c4040668b3d4ab3b0e94faaf1b5c4191
.dll windows:6 windows x86 arch:x86

4e069498d4f2b5e926ccd472931c36e5

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07/10/2021, 00:00

Not After

09/10/2024, 23:59

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3c:b1:68:4a:c3:db:a7:3e:aa:6f:51:5a:94:4e:64:02:c4:bc:db:96:d9:96:db:eb:f9:d0:ec:d1:13:6f:9a:44
Signer

Actual PE Digest

3c:b1:68:4a:c3:db:a7:3e:aa:6f:51:5a:94:4e:64:02:c4:bc:db:96:d9:96:db:eb:f9:d0:ec:d1:13:6f:9a:44

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\buildslave\steam_rel_client_win32\build\src\steamconsole\Release\steamconsole.pdb

Imports

kernel32

SetLastError
GetCurrentProcess
GetCurrentProcessId
FreeLibrary
GetModuleFileNameW
LoadLibraryA
LocalFree
MoveFileExW
MultiByteToWideChar
GetFullPathNameW
GetFileSize
FileTimeToSystemTime
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDiskFreeSpaceA
GetDriveTypeW
GetFileSizeEx
SetEndOfFile
SetFileAttributesW
SetFilePointer
DeleteFileW
CreateFileA
CreateDirectoryW
GetFileInformationByHandle
DeviceIoControl
GetLastError
GetFileAttributesW
FindFirstFileW
FindClose
CreateFileW
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleExA
GetModuleFileNameA
GetProcessHeap
HeapAlloc
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
SetConsoleOutputCP
SetConsoleCtrlHandler
PeekConsoleInputA
ReadConsoleInputA
AllocConsole
WriteFile
SetEnvironmentVariableA
GetCurrentThreadId
SetConsoleMode
GetConsoleMode
ReadFile
GetStdHandle
GetModuleHandleA
SetFileTime
SleepEx
GetSystemTimeAsFileTime
GetDateFormatW
GetTimeFormatW
GetModuleHandleW
OpenProcess
GetExitCodeProcess
CloseHandle
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
CreateIoCompletionPort
GetModuleHandleExW
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSectionEx
InitOnceComplete
InitOnceBeginInitialize
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
SystemTimeToFileTime
GetSystemTime
ReadConsoleA
ConvertFiberToThread
DeleteFiber
GetEnvironmentVariableW
SetEvent
GetProcAddress
ResetEvent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventW
InitializeSListHead
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
TerminateProcess
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetStdHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
WriteConsoleW
ExitProcess
CompareStringW
LCMapStringW
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetCurrentDirectoryW
DecodePointer
GetTimeZoneInformation
SetFilePointerEx
ReadConsoleW
GetConsoleCP

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW

advapi32

RegCloseKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegOpenKeyA
RegQueryValueExA

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

tier0_s

VProfInternalEnterScopeCurrentThread
CVProfile_ExitScope
g_ClockSpeedSecondsMultiplier
ETW_Steamworks_RunCallbacks_Start
ETW_Steamworks_RunCallbacks_End_
ETW_Steamworks_DispatchCallback_Start
ETW_Steamworks_DispatchCallback_End_
?ClaimMemory@CValidator@@QAEXPBX@Z
?Push@CValidator@@QAEXPBDPAX0@Z
?Pop@CValidator@@QAEXXZ
??0CThreadMutex@@QAE@XZ
??1CThreadMutex@@QAE@XZ
?Lock@CThreadSpinLock@@ACEXI@Z
_SpewMessageType
?AssertFailed@?$AssertMsgHelper@$0A@@@SA_NPBDI0ZZ
Warning
?OnExit@CThread@@MAEXXZ
Msg
?GetThreadProc@CThread@@EAEP6GIPAX@ZXZ
Plat_FloatTime
Plat_CommandLineParamExists
Plat_GetExecutablePathUTF8
SpewOutputFunc
GetSpewOutputFunc
ValidateSpew
ThreadSleep
CreateSimpleProcess
ThreadCloseProcess
?ThreadTerminateProcessCode@@YA_NPAXH@Z
??0CThread@@QAE@XZ
??1CThread@@UAE@XZ
?Start@CThread@@QAE_NI@Z
?Join@CThread@@QAE_NI@Z
??0CValidator@@QAE@H_NPAVIMemBlockClaimedList@@@Z
??1CValidator@@QAE@XZ
?SetAllocSizeFilter@CValidator@@QAEXH@Z
?Finalize@CValidator@@QAEXXZ
?RenderObjects@CValidator@@QAEXI@Z
?RenderLeaks@CValidator@@QAE_NI@Z
?DiffAgainst@CValidator@@QAEXPAV1@@Z
?UnlockValidationLocks@CValidator@@QAEXXZ
?StartProfilingAllThreads@CVProfManager@@QAEXMH@Z
Plat_RelativeTicks
g_pMemAllocSteam
?StopProfilingAllThreads@CVProfManager@@QAEXXZ
?DumpAllThreadProfiles@CVProfManager@@QAEXH@Z
?ValidateGlobals@CTier0@@SAXAAVCValidator@@@Z
g_VProfProfilesRunningCount
?AssertFailed@?$AssertMsgHelper@$00@@SA_NPBDI0@Z
?IsThreadRunning@CThread@@MBE_NXZ
?Init@CThread@@MAE_NXZ
Plat_TickDiffMicroSec
CatchAndWriteMiniDumpExReturnsInt
g_VProfManager
Plat_ExitProcess
Plat_IsInDebugSession
WriteMiniDump
g_dwDllEntryThreadId
Plat_MSTime
Error
??0CThreadRWLock@@QAE@XZ
?LockForRead@CThreadRWLock@@QAEXXZ
?UnlockRead@CThreadRWLock@@QAEXXZ
?LockForWrite@CThreadRWLock@@QAEXXZ
Plat_AbsoluteTimeToFloat
Plat_AbsoluteTime
ThreadImplOneTimeInit
SecureRandomBytes
?ExitScope@CVProfile@@QAEXXZ
?EnterScope@CVProfile@@QAE_NPBDW4EVProfBugdetGroup@@PAX@Z
Plat_RelativeTickFrequency
?Set@CThreadLocalBase@@QAEXPAX@Z
??1CThreadLocalBase@@QAE@XZ
??0CThreadLocalBase@@QAE@XZ
ThreadInMainThread
ReleaseThreadHandle
SpewAndLogActivate
g_VProfile
g_ClockSpeed
ETWEnd
ETWBegin
ETWIsTracingEnabled
?MarkFrame@CVProfile@@QAEXPBD@Z
VProfInternalGetProfileForCurrentThread
?GetName@CThread@@QAEPBDXZ
?Get@CThreadLocalBase@@QBEPAXXZ
ThreadInterlockedExchangeAdd64
ThreadSetBackgroundPriority
?CreateSimpleThread@@YAPAXP6AIPAX@Z0PAII@Z
Plat_OutputDebugStringRaw
Plat_IsChromeOS
_DMsg
getcwd_utf8
TSQueue_PopIntoFreeList
TSQueueBase_UnsafeDummy
TSQueueBase_UnsafePeek
TSQueueBase_Pop
TSQueueBase_Push
TSQueueBase_Init
TSListBase_UnsafePeek
TSListBase_Pop
TSListBase_Init
?ClaimArrayMemory@CValidator@@QAEXPBX@Z
?IsClaimed@CValidator@@QBE_NPBX@Z
?Terminate@CThread@@QAE_NH@Z
?IsAlive@CThread@@QBE_NXZ
?SetName@CThread@@QAEXPBD@Z
?Set@CThreadEvent@@QAE_NXZ
??0CThreadEvent@@QAE@_N@Z
?Wait@CThreadSyncObject@@QAE_NI@Z
??1CThreadSyncObject@@QAE@XZ
ThreadGetCurrentProcessId
Plat_gmtime
Plat_ctime
Plat_OutputDebugString
Plat_localtime
??1CThreadRWLock@@QAE@XZ
?UnlockWrite@CThreadRWLock@@QAEXXZ

vstdlib_s

V_strncpy
V_strncat
V_strnicmp
V_atoi
V_isnumeric
V_strtoui64
V_vsnprintf
V_vsnprintfRet
V_hextobinary
V_StripFilename
V_MakeAbsolutePath
V_FixSlashes
V_UTF16ToUTF8
V_strncmp
?V_stristr@@YAPBDPBD0@Z
CommandLine
??0CCommandLineParam@@QAE@PBD0@Z
??1CCommandLineParam@@QAE@XZ
?ValidateStatics@CStringNormalization@@SAXAAVCValidator@@PBD@Z
?ValidateStatics@CURLUtils@@SAXAAVCValidator@@PBD@Z
V_strlower_fast
V_FileBase
V_UnqualifiedFileName
V_ExtractFilePath
V_ExtractFileExtension
?V_SplitStringInternal@@YAXPBDPBQBDQAPBDHAAV?$CUtlVector@VCUtlString@@V?$CUtlMemory@VCUtlString@@@@@@_N@Z
V_UTF8ToUTF16
V_binarytohex
V_snprintf
GetOSType
V_strncat_length
V_RemoveDotSlashes
V_IsAbsolutePath
V_FixDoubleSlashes
V_atof
V_atoui64
V_tolower
V_strcat
V_wcstoui64
KeyValuesSystemSteam
WeakRandomInt
Coroutine_Continue
DebugStatsSystem

ws2_32

WSASend
send
recv
WSAGetLastError
WSACleanup
closesocket
WSASetLastError

bcrypt

BCryptGenRandom

Exports

Exports

CreateInterface
SteamDllMain
SteamDllMainEx

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 805KB - Virtual size: 804KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e069498d4f2b5e926ccd472931c36e5

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4Certificate

Extended Key Usages

Key Usages

3c:b1:68:4a:c3:db:a7:3e:aa:6f:51:5a:94:4e:64:02:c4:bc:db:96:d9:96:db:eb:f9:d0:ec:d1:13:6f:9a:44Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

oleaut32

tier0_s

vstdlib_s

ws2_32

bcrypt

Exports

Exports

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 805KB - Virtual size: 804KB

.data Size: 47KB - Virtual size: 91KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 99KB - Virtual size: 99KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4
Certificate

3c:b1:68:4a:c3:db:a7:3e:aa:6f:51:5a:94:4e:64:02:c4:bc:db:96:d9:96:db:eb:f9:d0:ec:d1:13:6f:9a:44
Signer

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 805KB - Virtual size: 804KB

.data
Size: 47KB - Virtual size: 91KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 99KB - Virtual size: 99KB