SteamSetup[.]exe | Triage™

General

Target
SteamSetup.exe
Size 2.4MB
Sample260727-tmlzdswfra
SHA256 0cc3074e126a364c1ba87054a2fed9887ce493ae06f63d4bce891824a1ce3342
MD5 9878c5d7cbd99eb3a900279b2d26bf45
SHA1 c3671d9d3f4ddcbd3ce56aea6ec669e0cdc81a7c
SHA512 7db46730884348ad80d8549a1fb45a048f9f5975e15152472f04eb63d0c15fd26879968d295a57eabd2b7e9733830b68cc9afba45204389cd2bfaf022181a419
SSDEEP 49152:o5rVO/7CuNqgvlKj7gP4+2b42HVfx7cQgJmriR0zKiXJhuGgxeCX3:urwD5N/yO4j4237cruKcJhYxeCX3
TLSH
T1F0B512D7ED7DF1EEE00D8A341B5912865D2DAEA8CE34A6F32466C1D139EB88507781C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SteamSetup.exe

File Explorer

SteamSetup.exe

.exe 2.4MB

SteamSetup.exe

IMPHASH 90f4e5e00fb28b9b6d4b74b6d8933725
SHA256 0cc3074e126a364c1ba87054a2fed9887ce493ae06f63d4bce891824a1ce3342
MD5 9878c5d7cbd99eb3a900279b2d26bf45
SHA1 c3671d9d3f4ddcbd3ce56aea6ec669e0cdc81a7c
SHA512 7db46730884348ad80d8549a1fb45a048f9f5975e15152472f04eb63d0c15fd26879968d295a57eabd2b7e9733830b68cc9afba45204389cd2bfaf022181a419
SSDEEP 49152:o5rVO/7CuNqgvlKj7gP4+2b42HVfx7cQgJmriR0zKiXJhuGgxeCX3:urwD5N/yO4j4237cruKcJhYxeCX3
TLSH
T1F0B512D7ED7DF1EEE00D8A341B5912865D2DAEA8CE34A6F32466C1D139EB88507781C3
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

3

Major OS version

6

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle CreateFileW CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection FindClose FindFirstFileW FindNextFileW GetCurrentProcessId GetFileAttributesW GetLastError GetLocalTime GetLocaleInfoA GetModuleHandleA GetProcAddress GetStartupInfoA GetSystemInfo GetTempPathW GetTickCount InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WriteFile __C_specific_handler

advapi32

RegCloseKey RegOpenKeyExW

api-ms-win-crt-string-l1-1-0

_wcsicmp memset strlen strncmp wcscpy_s wcsncpy_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsnwprintf_s

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcpy

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ

Name

.iyibxr

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.widndh

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.maqhfa

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cjloje

Size

512B

Virtual Size

360B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dvmyvp

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qxanec

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.kznuov

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SteamSetup.exe

kernel32

advapi32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic