SteamtoolsSetup (2)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SteamtoolsSetup (2).exe
Size 978KB
Sample241116-1ect3svanr
SHA256 c9f2e2abb046ff2535537182edf9a9b748aa10a22e98a1d8c948d874f4ffb304
MD5 bbf15e65d4e3c3580fc54adf1be95201
SHA1 79091be8f7f7a6e66669b6a38e494cf7a62b5117
SHA512 9bb261b4ed84af846e07ffb6352960687e59428fd497faa0a37d70b57a1a7430d48ac350fbb0c3f0f11e4231a98ebca4d6923deba0949fdd7a247a3c02737355
SSDEEP 24576:4Fa9OUi2VoN2gZ1M8UQag3BXrYZt+GgGTfG74T+TRcL:Z9OUiTN2gZ1MExEZkkf+4TARg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SteamtoolsSetup (2).exe

File Explorer

SteamtoolsSetup (2).exe

.exe 978KB

SteamtoolsSetup (2).exe

IMPHASH aa12b10b1679206dac295d5bb9ba213b
SHA256 c9f2e2abb046ff2535537182edf9a9b748aa10a22e98a1d8c948d874f4ffb304
MD5 bbf15e65d4e3c3580fc54adf1be95201
SHA1 79091be8f7f7a6e66669b6a38e494cf7a62b5117
SHA512 9bb261b4ed84af846e07ffb6352960687e59428fd497faa0a37d70b57a1a7430d48ac350fbb0c3f0f11e4231a98ebca4d6923deba0949fdd7a247a3c02737355
SSDEEP 24576:4Fa9OUi2VoN2gZ1M8UQag3BXrYZt+GgGTfG74T+TRcL:Z9OUiTN2gZ1MExEZkkf+4TARg
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

481900

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CertCreateCertificateChainEngine CertGetCertificateChain CertFreeCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertOpenStore CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain

wldap32

ord301 ord200 ord30 ord143 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79

ws2_32

gethostname sendto recvfrom WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent freeaddrinfo getaddrinfo ntohl ioctlsocket listen htonl socket send recv closesocket accept WSACleanup WSAStartup WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername connect bind WSASetLastError select __WSAFDIsSet inet_pton WSAGetLastError

kernel32

HeapSize SetEndOfFile GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FlsFree FlsSetValue FlsGetValue FlsAlloc CreateProcessW GetExitCodeProcess WaitForSingleObject HeapFree FlushFileBuffers HeapAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW GetCommandLineA ExitProcess GetModuleFileNameW WriteFile SetFilePointerEx GetStdHandle SetCurrentConsoleFontEx GetFileAttributesW MultiByteToWideChar WriteConsoleW SetConsoleCP SetConsoleOutputCP GetLastError SetLastError FormatMessageW QueryPerformanceCounter GetTickCount EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection Sleep SleepEx QueryPerformanceFrequency GetSystemDirectoryA FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA MoveFileExA CloseHandle WaitForSingleObjectEx WideCharToMultiByte GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoA CreateFileA GetFileSizeEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RaiseException RtlPcToFileHeader RtlUnwindEx CreateFileW InitializeSListHead GetCurrentThreadId GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentDirectoryW CreateDirectoryW RtlUnwind DeleteFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW RemoveDirectoryW GetTempPathW AreFileApisANSI GetModuleHandleW MoveFileExW GetStringTypeW InitializeCriticalSectionAndSpinCount CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess

advapi32

CryptDestroyHash RegQueryValueExA RegCloseKey CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyKey CryptImportKey CryptEncrypt RegOpenKeyExA

shell32

SHGetFolderPathW ShellExecuteW

ole32

CoUninitialize CoCreateInstance CoInitialize

Name

.text

Size

667KB

Virtual Size

666KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

214KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SteamtoolsSetup (2).exe

crypt32

wldap32

ws2_32

kernel32

advapi32

shell32

ole32

generic