SteamLuaPatcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SteamLuaPatcher.exe
Size 17.7MB
Sample260422-24v8dsdx61
SHA256 e55592d2d0a88d993ddc644cd44749a960731c0742ae50f24825e08be21a702e
MD5 f2065a6e5c2a2d5e665c159815146c34
SHA1 65087a3062cae1e28e4295354cc3d2ee209231f5
SHA512 5ed368b4006bd864519ac3b261e1eb6076f9f04c88cb4a20bc019b116e81487e16993580b14b2991056f1ebd31138286f25dd841b9746be5b9d55eb5c34f7c9a
SSDEEP 393216:WF40W9xOr1vTbFqkPqw9WZ0uhLKFdu9CwJsv6tJt6:44WRw/U
TLSH
T15C178D1762E401D4D57AC0398B279507EBB1B40A03B4ABDB21A096D62F77FF12E7E325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SteamLuaPatcher.exe

File Explorer

SteamLuaPatcher.exe

.exe 17.7MB

SteamLuaPatcher.exe

IMPHASH f0403b9945a9cfa045481cf6b7d3f91a
SHA256 e55592d2d0a88d993ddc644cd44749a960731c0742ae50f24825e08be21a702e
MD5 f2065a6e5c2a2d5e665c159815146c34
SHA1 65087a3062cae1e28e4295354cc3d2ee209231f5
SHA512 5ed368b4006bd864519ac3b261e1eb6076f9f04c88cb4a20bc019b116e81487e16993580b14b2991056f1ebd31138286f25dd841b9746be5b9d55eb5c34f7c9a
SSDEEP 393216:WF40W9xOr1vTbFqkPqw9WZ0uhLKFdu9CwJsv6tJt6:44WRw/U
TLSH
T15C178D1762E401D4D57AC0398B279507EBB1B40A03B4ABDB21A096D62F77FF12E7E325
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11833628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

uxtheme

CloseThemeData IsThemeBackgroundPartiallyTransparent GetThemeColor GetThemeBool GetThemeInt GetThemeEnumValue ord47 GetThemePropertyOrigin SetWindowTheme IsThemeActive IsAppThemed GetCurrentThemeName GetThemeTransitionDuration GetThemeBackgroundRegion GetThemeMargins GetThemePartSize OpenThemeData

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

d3d12

ord102 ord101 D3D12SerializeVersionedRootSignature

dwrite

DWriteCreateFactory

gdi32

CreateCompatibleBitmap CreateDCW CreateBitmap GetBitmapBits GetObjectW GdiFlush GetDIBits CreateDIBSection GetDeviceCaps ExtTextOutW SetWorldTransform OffsetRgn SelectClipRgn CombineRgn CreateRectRgn DeleteObject GetRegionData DeleteDC GetStockObject CreateCompatibleDC CreateFontIndirectW EnumFontFamiliesExW GetFontData SetTextAlign SetTextColor SetGraphicsMode SetBkMode GetCharABCWidthsI GetCharWidthI GetTextExtentPoint32W GetOutlineTextMetricsW GetGlyphOutlineW GetCharABCWidthsFloatW GetCharABCWidthsW GetTextFaceW GetTextMetricsW SelectObject RemoveFontMemResourceEx BitBlt AddFontMemResourceEx AddFontResourceExW RemoveFontResourceExW SetLayout

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

imm32

ImmGetDefaultIMEWnd ImmGetContext ImmReleaseContext ImmAssociateContext ImmAssociateContextEx ImmGetCompositionStringW ImmGetVirtualKey ImmSetCandidateWindow ImmSetCompositionWindow ImmNotifyIME ImmGetOpenStatus

setupapi

SetupDiGetClassDevsW SetupDiOpenDevRegKey SetupDiGetDeviceInterfaceDetailW SetupDiOpenDeviceInterfaceW

shlwapi

AssocQueryStringW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

comdlg32

GetSaveFileNameW GetOpenFileNameW

d3d9

Direct3DCreate9

iphlpapi

GetAdaptersAddresses ConvertInterfaceLuidToGuid ConvertInterfaceIndexToLuid ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameW ConvertInterfaceNameToLuidW

winhttp

WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpGetDefaultProxyConfiguration WinHttpCloseHandle WinHttpOpen

oleaut32

SysAllocString VariantInit VariantClear GetErrorInfo SetErrorInfo SysStringLen SysFreeString SafeArrayPutElement SafeArrayCreateVector

secur32

FreeContextBuffer QueryContextAttributesW ApplyControlToken DeleteSecurityContext EncryptMessage InitializeSecurityContextW FreeCredentialsHandle AcquireCredentialsHandleW InitSecurityInterfaceW AcceptSecurityContext DecryptMessage

bcrypt

BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptDecrypt

ncrypt

NCryptSetProperty NCryptExportKey

crypt32

CertAddCertificateContextToStore CertCreateCertificateContext CertCompareCertificate CertGetCertificateContextProperty CryptEncodeObject PFXImportCertStore CertFindChainInStore CertFreeCertificateChain CertGetCertificateChain CertOpenSystemStoreW CertAddStoreToCollection CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertVerifyTimeValidity CertOpenStore

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

userenv

GetUserProfileDirectoryW

advapi32

SetSecurityDescriptorGroup SetSecurityDescriptorDacl GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken AddAccessAllowedAceEx AddAccessDeniedAceEx AllocateAndInitializeSid RegNotifyChangeKeyValue GetUserNameW LookupAccountNameW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey GetNamedSecurityInfoW LookupAccountSidW SetSecurityDescriptorOwner InitializeSecurityDescriptor InitializeAcl GetLengthSid FreeSid CopySid DuplicateToken SystemFunction036

authz

AuthzAccessCheck AuthzInitializeResourceManager AuthzFreeResourceManager AuthzInitializeContextFromToken AuthzInitializeContextFromSid AuthzFreeContext

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException ExitProcess SetStdHandle SetFileAttributesW GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineA FreeLibraryAndExitThread ExitThread LoadLibraryExW InitializeCriticalSectionAndSpinCount RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree RtlVirtualUnwind VirtualProtect RtlUnwind SetLastError InterlockedFlushSList InterlockedPushEntrySList InitializeCriticalSection DeleteCriticalSection IsValidLocale EnumSystemLocalesW HeapReAlloc SetEnvironmentVariableW GetFileSizeEx GetSystemTimeAsFileTime HeapSize HeapQueryInformation IsValidCodePage GetOEMCP GetProcessHeap WriteConsoleW GetSystemDirectoryW GetUserDefaultLocaleName InitializeCriticalSectionEx GetTickCount64 SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive QueryPerformanceFrequency QueryPerformanceCounter VirtualFree VirtualAlloc CreateMutexW ReleaseMutex GlobalLock CompareStringEx CloseHandle DuplicateHandle GetLastError SetEvent WaitForSingleObject CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess CreateThread GetCurrentThread GetCurrentThreadId SetThreadPriority GetThreadPriority TerminateThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo GetSystemTime GetLocalTime GetCommandLineW GetCurrentProcessId LocalFree AllocConsole FreeConsole AttachConsole OutputDebugStringW GetConsoleWindow MultiByteToWideChar WideCharToMultiByte GetACP GetModuleHandleW CreateFileW GetFileAttributesExW LocalAlloc FormatMessageW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW GetFileAttributesW GetFileInformationByHandle GetFullPathNameW GetLogicalDrives GetLongPathNameW RemoveDirectoryW SetFileTime GetTempPathW GetVolumePathNamesForVolumeNameW SetErrorMode DeviceIoControl CopyFileW MoveFileW MoveFileExW TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetFileInformationByHandleEx FlushFileBuffers GetDriveTypeW GetFileType GetVolumeInformationW ReadFile SetEndOfFile SetFilePointerEx WriteFile CreateFileMappingW MapViewOfFile UnmapViewOfFile CompareStringW LCMapStringW GetTimeZoneInformation FindFirstFileExW FindNextFileW GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointer ConnectNamedPipe CreateNamedPipeW WaitForMultipleObjectsEx TerminateProcess GetExitCodeProcess CreateProcessW GetProcessId IsProcessorFeaturePresent GetModuleFileNameW FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification PeekNamedPipe GetOverlappedResult CancelIoEx ResetEvent WaitForSingleObjectEx CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW GetUserDefaultLCID GetUserPreferredUILanguages GetProcAddress GetCurrentPackageFullName GetGeoInfoW GetUserGeoID FreeLibrary GetModuleHandleExW LoadLibraryW GetComputerNameExW OpenProcess K32GetModuleFileNameExW GetUserDefaultLangID InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GlobalFree WTSGetActiveConsoleSessionId GlobalAlloc GlobalSize GlobalUnlock LeaveCriticalSection CheckRemoteDebuggerPresent ExpandEnvironmentStringsW lstrcmpW EnterCriticalSection

netapi32

NetShareEnum NetApiBufferFree

ole32

CoCreateInstance DoDragDrop CoGetMalloc CoUninitialize OleFlushClipboard OleGetClipboard CoTaskMemFree RevokeDragDrop RegisterDragDrop StringFromGUID2 OleInitialize OleUninitialize CoLockObjectExternal OleIsCurrentClipboard CoCreateGuid OleSetClipboard CoInitializeEx CoCreateFreeThreadedMarshaler ReleaseStgMedium

user32

MessageBoxW SystemParametersInfoW SystemParametersInfoForDpi GetDC ReleaseDC GetSystemMenu EnableMenuItem GetSystemMetrics GetSysColor GetDoubleClickTime IsWindow MessageBeep GetCaretBlinkTime GetDesktopWindow DestroyIcon UpdateLayeredWindowIndirect GetKeyboardLayoutList RegisterWindowMessageW RegisterPowerSettingNotification UnregisterPowerSettingNotification GetClassInfoW RegisterClassExW SetWindowPos GetWindowPlacement IsZoomed GetFocus InvalidateRect GetClientRect GetCursorPos ClientToScreen ScreenToClient WindowFromPoint ChildWindowFromPointEx GetParent LoadImageW GetThreadDpiAwarenessContext GetWindowDpiAwarenessContext AreDpiAwarenessContextsEqual IsValidDpiAwarenessContext EnableNonClientDpiScaling SetProcessDpiAwarenessContext ChangeWindowMessageFilter RegisterClipboardFormatW GetClipboardFormatNameW EnumDisplayDevicesW SendMessageW SendMessageTimeoutW AttachThreadInput IsChild ShowWindow UpdateLayeredWindow SetLayeredWindowAttributes FlashWindowEx MoveWindow SetWindowPlacement IsWindowVisible IsIconic BringWindowToTop SetFocus RegisterTouchWindow UnregisterTouchWindow UnregisterClassW GetCapture SetCapture ReleaseCapture GetSystemMetricsForDpi GetMenu SetActiveWindow GetForegroundWindow SetForegroundWindow BeginPaint EndPaint GetUpdateRect SetWindowRgn SetWindowTextW GetWindowRect AdjustWindowRectEx AdjustWindowRectExForDpi UnregisterDeviceNotification SetParent GetWindow DestroyCursor MonitorFromPoint MonitorFromWindow GetMonitorInfoW GetDpiForWindow GetAncestor LoadIconW IsHungAppWindow SetClipboardViewer ChangeClipboardChain AddClipboardFormatListener RemoveClipboardFormatListener SetMenu DrawMenuBar CreateMenu CreatePopupMenu DestroyMenu InsertMenuW AppendMenuW ModifyMenuW RemoveMenu TrackPopupMenu GetMenuItemInfoW SetMenuItemInfoW GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo EnumDisplayMonitors GetMessageW SendInput GetPointerInfo GetKeyboardLayout IsWindowEnabled CreateCaret DestroyCaret ShowCaret SetCaretPos FindWindowA GetKeyState GetKeyboardState ToAscii ToUnicode MapVirtualKeyW HiliteMenuItem TrackPopupMenuEx SetMenuDefaultItem SetCursorPos GetCursor LoadCursorW CreateCursor CreateIconIndirect GetIconInfo GetCursorInfo TrackMouseEvent GetMessageExtraInfo GetAsyncKeyState GetTouchInputInfo CloseTouchInputHandle GetPointerType GetPointerFrameTouchInfo GetPointerFrameTouchInfoHistory GetPointerPenInfo GetPointerPenInfoHistory SkipPointerFrameMessages GetPointerDeviceRects ChangeWindowMessageFilterEx RegisterClassW RegisterDeviceNotificationW DefWindowProcW PostMessageW PeekMessageW DispatchMessageW TranslateMessage DrawIconEx CharNextExA GetWindowThreadProcessId EnumWindows PostThreadMessageW SetWindowLongPtrW GetWindowLongPtrW KillTimer SetCoalescableTimer SetTimer MsgWaitForMultipleObjectsEx GetQueueStatus DestroyWindow SetCursor CreateWindowExW IsTouchWindow

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

winmm

timeKillEvent PlaySoundW timeSetEvent

ws2_32

WSAAccept WSAGetLastError setsockopt select listen htons getsockname WSARecv closesocket WSAHtonl __WSAFDIsSet getsockopt getnameinfo WSARecvFrom getaddrinfo ntohl htonl WSACleanup WSAStartup WSAAsyncSelect WSAConnect WSAIoctl WSANtohl bind WSASend WSASendTo WSASocketW WSANtohs getpeername freeaddrinfo

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

shell32

SHGetFileInfoW ord727 ShellExecuteW SHCreateItemFromIDList SHGetMalloc SHGetPathFromIDListW SHGetKnownFolderIDList SHBrowseForFolderW Shell_NotifyIconW Shell_NotifyIconGetRect SHCreateItemFromParsingName SHGetKnownFolderPath SHGetStockIconInfo CommandLineToArgvW ShellExecuteExW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

Name

.text

Size

12.6MB

Virtual Size

12.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

187KB

Virtual Size

277KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

606KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qtmimed

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SteamLuaPatcher.exe

uxtheme

d3d11

dxgi

d3d12

dwrite

gdi32

dwmapi

imm32

setupapi

shlwapi

wtsapi32

api-ms-win-shcore-scaling-l1-1-1

comdlg32

d3d9

iphlpapi

winhttp

oleaut32

secur32

bcrypt

ncrypt

crypt32

api-ms-win-core-synch-l1-2-0

userenv

advapi32

authz

kernel32

netapi32

ole32

user32

version

winmm

ws2_32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

shell32

api-ms-win-core-winrt-error-l1-1-1

generic