SteamService[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SteamService.exe
Size

551KB
MD5

02da0ce5254520cb59a5e5ef6ee996d1
SHA1

02bfd655c622f5999fe1f0f61fd827cca9eb22de
SHA256

f439a87c720e153fd56e98bc4c6471bd75801ef66af1e928c98a945b4356d472
SHA512

a293fd80789d453097d647c655d983add043cda4181d54ac73c23e5251af3d85cbc7b6447012fe5e4cb776a48dc1662c9d384128078678a0fb9c47bd22798df8
SSDEEP

12288:n5OEFITxklZQ8I+zf4OE2I8lNVgkI4gD8sftcQ5YmoyyLi5:n5U0zo6lNVgkI4gZ5voyy4

Score

1^/10

Malware Config

Signatures

Files

SteamService.exe
.exe windows:5 windows x86 arch:x86

Password: 123

d3369bc25048b6f9984b3b504a29f7af

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/09/2012, 00:00

Not After

23/11/2015, 23:59

Subject

CN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:f1:ae:ae:32:12:d5:4c:a7:c4:28:8e:6a:d9:d8:8b:76:c2:0a:57
Signer

Actual PE Digest

5f:f1:ae:ae:32:12:d5:4c:a7:c4:28:8e:6a:d9:d8:8b:76:c2:0a:57

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\buildslave\steam_main_win32\build\src\SteamServiceHost\Release\SteamServiceHost.pdb

Imports

shlwapi

SHDeleteKeyA
SHStrDupW
SHDeleteKeyW

ws2_32

WSAStartup
gethostname

shell32

SHGetFolderPathA
ShellExecuteA
SHGetMalloc
SHGetSpecialFolderPathA

kernel32

GlobalLock
GlobalUnlock
GetCurrentProcess
SetLastError
GetFileSize
WriteFile
DeviceIoControl
FindClose
ExpandEnvironmentStringsA
GetFullPathNameW
CreateFileA
SetFileAttributesA
GetFileAttributesA
GetFileAttributesW
FindFirstFileA
FindNextFileA
MoveFileExA
GetVersionExA
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
MultiByteToWideChar
CreateToolhelp32Snapshot
Process32First
Process32Next
ReadFile
CreateFileW
GetCurrentThread
QueryPerformanceCounter
QueryPerformanceFrequency
GetOEMCP
GetACP
IsValidCodePage
AreFileApisANSI
GetModuleHandleExW
ExitProcess
CompareStringW
InterlockedIncrement
GlobalAlloc
InterlockedDecrement
GetTickCount
Sleep
TerminateProcess
OpenProcess
LocalFree
GetConsoleWindow
SetConsoleTitleA
SetConsoleCtrlHandler
DeleteFileA
GetFileAttributesExA
RemoveDirectoryA
CreateDirectoryA
OutputDebugStringA
GetCommandLineA
CreateProcessA
GetModuleFileNameA
LoadLibraryA
lstrlenA
FreeLibrary
GetCurrentDirectoryA
SetCurrentDirectoryA
SetEnvironmentVariableA
CreateProcessW
CloseHandle
WaitForSingleObject
GetLastError
GetEnvironmentStringsW
GetExitCodeProcess
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetStdHandle
GetFileType
GetConsoleMode
ReadConsoleW
FreeEnvironmentStringsW
GetCurrentDirectoryW
VirtualQuery
GetConsoleCP
SetStdHandle
OutputDebugStringW
WriteConsoleW
HeapQueryInformation
CopyFileA
GetModuleHandleW
GetStartupInfoW
UnhandledExceptionFilter
GetCPInfo
HeapReAlloc
IsProcessorFeaturePresent
GetLocalTime
RtlUnwind
GetProcessHeaps
HeapValidate
HeapSize
HeapFree
HeapAlloc
InterlockedExchangeAdd
DebugBreak
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
SetProcessAffinityMask
GetSystemInfo
WideCharToMultiByte
LCMapStringW
GetCurrentThreadId
FlushFileBuffers
SetEndOfFile
SetFilePointerEx
GetDriveTypeW
CreateDirectoryW
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
InitializeCriticalSection
DeleteCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
GetCurrentProcessId
GetModuleFileNameW
GetProcessHeap
HeapLock
HeapUnlock
HeapWalk
RaiseException
SetThreadAffinityMask
OpenThread
GetThreadPriority
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
SetEvent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
LoadLibraryW
LoadLibraryExA
LoadLibraryExW

user32

GetWindowThreadProcessId
MessageBoxA
ShowWindow
EnumWindows
GetDesktopWindow
GetWindowRect
GetWindowTextLengthA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetDlgItemTextA
DialogBoxParamA
IsWindowVisible
GetDlgItemInt
SetDlgItemInt
GetDlgItem
wsprintfA
SetWindowPos
EndDialog

advapi32

StartServiceA
RegOpenKeyA
SetNamedSecurityInfoA
RegOpenKeyExW
RegEnumKeyExW
DuplicateTokenEx
CreateProcessAsUserW
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
ConvertStringSidToSidA
SetEntriesInAclA
StartServiceCtrlDispatcherA
SetServiceStatus
SetServiceObjectSecurity
RegisterServiceCtrlHandlerA
QueryServiceStatusEx
QueryServiceStatus
QueryServiceObjectSecurity
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
ChangeServiceConfig2A
ChangeServiceConfigA
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey

ole32

PropVariantClear
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

Exports

Exports

g_dwDllEntryThreadId

Sections

.text
Size: 365KB - Virtual size: 365KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 123

d3369bc25048b6f9984b3b504a29f7af

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8Certificate

Extended Key Usages

Key Usages

5f:f1:ae:ae:32:12:d5:4c:a7:c4:28:8e:6a:d9:d8:8b:76:c2:0a:57Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

ws2_32

shell32

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 365KB - Virtual size: 365KB

.rdata Size: 137KB - Virtual size: 137KB

.data Size: 16KB - Virtual size: 457KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 22KB - Virtual size: 22KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Certificate

5f:f1:ae:ae:32:12:d5:4c:a7:c4:28:8e:6a:d9:d8:8b:76:c2:0a:57
Signer

.text
Size: 365KB - Virtual size: 365KB

.rdata
Size: 137KB - Virtual size: 137KB

.data
Size: 16KB - Virtual size: 457KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 22KB - Virtual size: 22KB