�k��]��d�e��e/��#��n�B�Y-4֠u��mh��g����+Y�Z�$F�a�[^�Wa�����$~�V��=|*���l��]����U��k��\�`��Mo��̀{4�:j\�B�����D���B`�S�~�6lߺ_��B�}pX����Ҕ����9�36rZ�;�5/�eSW�E�p\4{,�#�To#��(���4� �36y�o���V�Ί�?� ē;� ���:nW艧�<�=��Z� ���F*�f� ;��Z��L���JI�;��n�s;�K��1$�Ŵ�J/ݮ��C�� L����␖���<�XO�����K�� �������r�D�]���T��;�ԁv6&�Q�0�����e}/{H�f����7�����MѮ,.J��f���@7�?��Ww � c�IS���>x(%��W�:Z����2���;������x�,]�+v�Ԗ �Z�n�.�z�+#H�9zE�^CM�'�K��.XaHD��G��^Ɨ�'�qʢʌ����0ӥG�aU���P����O��& �ᕩ;�������!t�(<ؠ%C��L�axi�9����IofaJB;�n��.����3 $R_���r;nUY1�# 6{>�������٥��/�!�0x`�}����wy-��u�/���b>��l/�R:��G�X˳��^���AT�]V���K]�|�V���9&O����x�q��>�M����"�!�'�� (lQ�f������Rf!�6�>�-��>���6����Q�""�_�Dz)�M�kcH�4]�/3&~җ ���Anmm�!�����H�YI4�=z��Oc*������R��lJ8iHm�ۗ��Z��I-����[90n�n�O�=�E5�bT�T ��Sz^���;hԽ���<�a���S~�=��h%���~�6�C"`#����+����SЈw��~�� �N�L��J�����tP�{d��`nƫ�C� �';���m���罼k����L��̭���>�t��*X/����S��6]�uBH�>d]H��&����b]��{��Ȍ�x������!9FI�BR�e�VU<!�V^9�!��zZ����� :���-��D��&�zg�8S�zt��-��_Hٶ=�|���vʴ���$:݅�=�<����'fk�faD¹�ewLyI�'����=���۳����6����ۋ�T7N T�g^�aj/��KIcS�Z�H����!��4����*�As�����{���ÑX�L �zP�T���7�z�&;���%;\�y�=�5�P�;��Q�V���L� �O�:毸�s ԩ�H�����,c0{��m"��C�����B�����fr�OO��b�D��d��n�'�.�~�lJ�x��/�1�Oepe�+Ped�_+!������ h��S��X�4=��,�� F�[[�_�/�\�N����AQ$FbC�+�����n""dJx���O������GB-�ʀA˸��y%����,������?f�Tc�uX�ȇ9K휃�p��-7F(㜵U�i��h�5�W����>wmC�l����Χ���u�N8���*���<����h�˫}���M�Y����&�|{ �h��&]�"�A�O���V�Ԝ�5tjk��.��Q����OV�?g�ȣ�P@Mt����w��mȹF#H#�S�}�����k �<#U�asN��;�A�)p�u5�e� q1��Y�B=���yOspr�����iq�JX�h�Y��)S�s~� ������G������k��j9����� �L��$�s��J��[zd;L�N����=�?K͙+9�^����<;0�aX�.U4� H+�hx���D�a*�m��?0f��{���4�5&RHS�ХТ���,b�_��ܥ���@���o��q%�1��N>�=s�Dʸ�����o������b7�-I <�#u��܊V;�"0(x8 {�j�=�&V�U��C�k i�Cζ��&^I���l������_�S�<�dܪ��EQ�;�k�2t0����w��4c[Ka{�M��*�fK0��7Լ1�·u�%�m1�eIj%K����2 z�ct��ed��s7���?��{�z3���s�h��s�_gi��;�P?��Q�]3I)7}&�f4�N�C�{̲�����?��S�9����pN��c��Ϣ�M�e�N�y���Mi�}h«�YT�+��TD��;20�~N��S[ ����{aa��^1]�����ub� �/x��' ��,�l�r�L��J�����" ����R�6�������{�(J�3�+������ ��Vd~���|�Y�ֿr/��D:I ����0^c����Ȧ����?)��t�L�D BLm�K��$ sx4�Cܙ���*�v�*�Z\�@�G�S��8�Z��N�7��z��ʚ�\2g�����Y�q��D���fqFy������P=�r����ԥ� �We.|��z|e���� $q�86�cJ$�e�w2;9=�o/��:Hrz��!F���w����Lf�;��0�6�D��ΐ�)�RB.9఼�����4��"�Ȕ#��Z~��||M�qA�ԙe�%���S�k !�I�֤�r_���Ͷw��Ȩ�7����z�y�sL�P��I��U�#�=���&*���P�-�] �[��"E�b��ȕBg(� ��~(-Pz���+�WوL[�W9RLݍ� �"2Ș�����m?��P.ISlj�Aq_)���'SٯI0O��v��2U��g��B������W@sBF����X��P��2Y����4k4ٻ�l��Є�7� `Qc��g�� ��v�H�!m-�̈́��|��*0�jo���;nRR�����u��'�_�����~ՎT�a�D5��d�f��&*������M�hV�p����-1����ܚ��k6Ձ���݀i$��qy1�K�0��ѧM}C��ul�{�9�<��0.����5���A��T��Y���Q���|7tWEO3J�q�%\� 8�.��������~�gB̭7O�O��m{W�9��p�qo����iӅ��L��z�M��
Static task
static1
Behavioral task
behavioral1
Sample
DBD_Steam.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
DBD_Steam.exe
Resource
win10v2004-20241007-en
General
-
Target
DBD_Steam.exe
-
Size
23.9MB
-
MD5
40532c7817fdfb3df02eb307c00c16fb
-
SHA1
3d1653b2117295a46c12f57feb12f4dbfb59c8c8
-
SHA256
3e5a475ea4946460347fcda4c1b1be536a8447864ee23f0a419343579d4f1471
-
SHA512
fb4c5f7e7559a2d09879696641a65ee321d4f6b9b32072c10ffc66998ca675d0eeaabae76959c0be9db0289208216714ebf2868057c8f13647a2ba216696dac3
-
SSDEEP
393216:7SNG0DAMc1CIbEjoESprsJ4Tr8Z9nSgCgFea6Z2KDaLhslXxOe3CP2mEUp46uYNd:ONG0DAMcIIbERXrBSgCKCZNuLhuSu64g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DBD_Steam.exe
Files
-
DBD_Steam.exe.exe windows:6 windows x64 arch:x64
d6cf39bdd7d1f4bc7798b34a63bab223
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
K32EnumProcesses
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
CharUpperBuffW
gdi32
BitBlt
advapi32
GetTokenInformation
msvcp140
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
ntdll
RtlAdjustPrivilege
shlwapi
PathFindFileNameW
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertEnumCertificatesInStore
ws2_32
closesocket
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strchr
api-ms-win-crt-runtime-l1-1-0
_getpid
api-ms-win-crt-stdio-l1-1-0
fopen
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-environment-l1-1-0
getenv
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 902KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pom Size: - Virtual size: 24.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.&s: Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aSR Size: 23.9MB - Virtual size: 23.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ