Steam[.]exe | Triage™

Resubmissions

10/07/2026, 23:13

260710-27dgraev8m3

10/07/2026, 23:12

260710-26skaaev4q3

Sharing

Copy URL Twitter E-mail

General

Target
Steam.exe
Size 3.3MB
Sample260710-27dgraev8m
SHA256 cc213f60aaf97a78071709216515b215103bef0fe9161a08a6db12ac9eaf2cad
MD5 120c55d3c8a52f4cedaf837b842e359d
SHA1 45809e8afd195df45397216c57c3b74dd977d20c
SHA512 06b1bf09ec6e5a097abb8163e3038308647fab98c4bcdd70f228e918c63e76b61013576b4c0972a7b68cfefcc260e3542caed2e487017355e0db3858702bbd7e
SSDEEP 49152:rSfwoIpd6IDgIAZaswMZOSCdhOgHGgT8+HEl2eD0aZ0z0gwaplIZqDTNwMw:pX6LIEaG2ZYIplcqDTNZ
TLSH
T11CF5CF47A3A542E9C166C47CC9479217F37278480320EAEB6BE44E561FE3BE06A7F351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Steam.exe

File Explorer

Steam.exe

.exe 3.3MB

Steam.exe

IMPHASH 24b1278898a8a1c20a21fd412f5ee773
SHA256 cc213f60aaf97a78071709216515b215103bef0fe9161a08a6db12ac9eaf2cad
MD5 120c55d3c8a52f4cedaf837b842e359d
SHA1 45809e8afd195df45397216c57c3b74dd977d20c
SHA512 06b1bf09ec6e5a097abb8163e3038308647fab98c4bcdd70f228e918c63e76b61013576b4c0972a7b68cfefcc260e3542caed2e487017355e0db3858702bbd7e
SSDEEP 49152:rSfwoIpd6IDgIAZaswMZOSCdhOgHGgT8+HEl2eD0aZ0z0gwaplIZqDTNwMw:pX6LIEaG2ZYIplcqDTNZ
TLSH
T11CF5CF47A3A542E9C166C47CC9479217F37278480320EAEB6BE44E561FE3BE06A7F351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1627924

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nicolas\Downloads\Hyperx-FiveM\Hyperx-FiveM\x64\Release\Steam.pdb

d3dx9_43

D3DXVec3Normalize D3DXMatrixTranspose D3DXVec3Transform

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

MapViewOfFile LocalFree GetLocaleInfoEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetFileInformationByHandleEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetSystemTimeAsFileTime OutputDebugStringW HeapFree TerminateProcess QueryPerformanceCounter AreFileApisANSI GetModuleHandleW GetProcessHeap DeleteCriticalSection HeapDestroy HeapAlloc HeapReAlloc HeapSize UnmapViewOfFile FreeLibrary VerSetConditionMask GetProcAddress CreateFileW InitializeCriticalSectionEx GetModuleFileNameW SetFileInformationByHandle GetFileAttributesExW IsDebuggerPresent GetCurrentProcessId QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar ExitProcess GetLastError GetModuleHandleA GetCurrentProcess CreateRemoteThread Sleep WaitForSingleObject ReadProcessMemory VirtualProtectEx CloseHandle CreateToolhelp32Snapshot OpenProcess FindNextFileW Module32First Module32Next VirtualFreeEx VirtualAllocEx GetTickCount GetTickCount64 EnterCriticalSection WakeAllConditionVariable FormatMessageA SetLastError CreateFileMappingA ReadFile GetFileSizeEx CreateFileA InitializeSListHead MoveFileExA VerifyVersionInfoA GetSystemDirectoryA SleepEx LeaveCriticalSection WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW

user32

TranslateMessage SetLayeredWindowAttributes DefWindowProcA MoveWindow GetMonitorInfoA MessageBoxA SetWindowLongA ShowWindow PeekMessageA PostQuitMessage RegisterClassExW GetWindowThreadProcessId FindWindowA GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture SetForegroundWindow UpdateWindow SetWindowDisplayAffinity mouse_event GetAsyncKeyState GetForegroundWindow GetCursorPos SetCursor GetClientRect IsWindowUnicode ReleaseCapture UnregisterClassW SetCursorPos OpenClipboard CreateWindowExW EnumDisplayMonitors DestroyWindow DispatchMessageA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard

advapi32

CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt GetTokenInformation OpenProcessToken AdjustTokenPrivileges ConvertSidToStringSidA CopySid IsValidSid GetLengthSid RegGetValueA CryptAcquireContextA

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Thrd_yield ??7ios_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Random_device@std@@YAIXZ _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_counter ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency _Mtx_lock ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z

wldap32

ord301 ord79 ord200 ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord30

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

normaliz

IdnToAscii

crypt32

CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine

ws2_32

socket closesocket recv send WSAIoctl WSAGetLastError WSAStartup WSACleanup bind accept connect getpeername getsockname htonl ntohl gethostname getsockopt sendto htons recvfrom listen ioctlsocket ntohs setsockopt freeaddrinfo getaddrinfo select __WSAFDIsSet WSASetLastError

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr longjmp memcpy memmove memset __C_specific_handler memcmp __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException memchr strstr __std_terminate __std_exception_copy __std_exception_destroy strchr

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh realloc _set_new_mode calloc

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo strerror __sys_nerr _register_thread_local_exe_atexit_callback _errno _resetstkoflw _c_exit _getpid exit _beginthreadex abort _exit _initterm_e _invoke_watson terminate _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-string-l1-1-0

_strdup strcmp strpbrk strncmp strspn isupper strcpy_s tolower toupper strcspn strncpy_s strncpy

api-ms-win-crt-convert-l1-1-0

atof atoi strtoull strtoul strtol strtod strtoll mbstowcs

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf fgetpos __stdio_common_vsprintf_s _lseeki64 fgetc _set_fmode setvbuf feof fputs fopen _open _close ungetc _write fsetpos _read __p__commode fputc fgets fread fflush _fseeki64 __stdio_common_vsscanf _wfopen _get_stream_buffer_pointers fclose __stdio_common_vfprintf fseek __acrt_iob_func ftell fwrite

api-ms-win-crt-math-l1-1-0

logf cosf powf sinf sqrtf fmodf acosf _dsign __setusermatherr atan2f _dclass _hypotf ceilf

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-filesystem-l1-1-0

_lock_file _access _fstat64 _unlink _unlock_file _stat64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

api-ms-win-crt-environment-l1-1-0

_wgetenv getenv

api-ms-win-crt-time-l1-1-0

_gmtime64 strftime _time64 _localtime64