steamunlocked-launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
steamunlocked-launcher.exe
Size 12.9MB
Sample260727-trnzjsxtes
SHA256 55a91e68e0ddb7ad2876927321615e195d26c15b015586097c8b01cf63777307
MD5 18af0ca9fd6840fe70b25e534954adcb
SHA1 7f4cc1fec84897409fe1ca5b54859d92dd0389a4
SHA512 788e8e0ef54ad7f133166dbe8253b4412588e65c2fd224480dd39269675b722561979605fb1492aa7d9a03f019f7eb2a5752bf255198ab5816bf55de587c45d7
SSDEEP 98304:qeXmsNZgA/pWr3Biw8++GEJIWYE3PMoDGLA2YPzyGrBSqKccpGeJY8D0m4Esfg8y:V2sNZgiDp+TDl4Egg8KYBG+aP
TLSH
T1C6D63A117E9B5858D08ACCB4C38B8AA78E2130DF093AB4BF54CA52293F7D7F55F19219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
steamunlocked-launcher.exe

File Explorer

steamunlocked-launcher.exe

.exe 12.9MB

steamunlocked-launcher.exe

IMPHASH e32a6113654948993262e66910f2b65a
SHA256 55a91e68e0ddb7ad2876927321615e195d26c15b015586097c8b01cf63777307
MD5 18af0ca9fd6840fe70b25e534954adcb
SHA1 7f4cc1fec84897409fe1ca5b54859d92dd0389a4
SHA512 788e8e0ef54ad7f133166dbe8253b4412588e65c2fd224480dd39269675b722561979605fb1492aa7d9a03f019f7eb2a5752bf255198ab5816bf55de587c45d7
SSDEEP 98304:qeXmsNZgA/pWr3Biw8++GEJIWYE3PMoDGLA2YPzyGrBSqKccpGeJY8D0m4Esfg8y:V2sNZgiDp+TDl4Egg8KYBG+aP
TLSH
T1C6D63A117E9B5858D08ACCB4C38B8AA78E2130DF093AB4BF54CA52293F7D7F55F19219
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8128032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

steamunlocked_launcher.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile NtReadFile NtOpenFile NtDeviceIoControlFile NtWriteFile NtCancelIoFileEx RtlGetVersion NtCreateFile RtlNtStatusToDosError

kernel32

DuplicateHandle DeleteFileW GetFinalPathNameByHandleW CopyFileExW MoveFileExW CreateSymbolicLinkW SetWaitableTimer SetFilePointerEx FindNextFileW GetModuleFileNameW GetFileAttributesW GetWindowsDirectoryW LoadLibraryA GetVolumePathNameW GetDiskFreeSpaceW GetProcAddress GetSystemInfo GetModuleHandleA TerminateProcess GetSystemDirectoryW IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime IsDebuggerPresent RtlPcToFileHeader RaiseException EncodePointer CompareStringOrdinal ExitProcess TlsAlloc TlsGetValue TlsSetValue TlsFree UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep GetFileInformationByHandleEx LCIDToLocaleName RtlUnwindEx SetFileCompletionNotificationModes CloseHandle HeapAlloc GetLastError SwitchToThread lstrlenW HeapFree HeapReAlloc GetProcessHeap SetEnvironmentVariableW GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext AddVectoredExceptionHandler GetFileInformationByHandle GetCurrentThread CreateMutexW CreateWaitableTimerExW DeviceIoControl CreateProcessW CreateDirectoryW CreateThread WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA FindClose SetThreadStackGuarantee FindFirstFileExW SetFileInformationByHandle SetFileTime GetFullPathNameW SetNamedPipeHandleState SetHandleInformation FormatMessageW SleepEx MultiByteToWideChar WaitForSingleObject ReleaseMutex CreateFileW WideCharToMultiByte GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx SetLastError GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort InitializeCriticalSectionAndSpinCount CancelIoEx WriteFile GetOverlappedResult ReadFile RtlLookupFunctionEntry DeleteCriticalSection GetCurrentThreadId GetModuleHandleW GetSystemTimePreciseAsFileTime GetUserDefaultUILanguage LoadLibraryW InitializeSListHead GetTempPathW FreeLibrary LoadLibraryExW OutputDebugStringW LoadLibraryExA OutputDebugStringA

shell32

ShellExecuteExW SHAppBarMessage DragFinish DragQueryFileW ShellExecuteW SHGetKnownFolderPath ILCreateFromPathW ILFree SHOpenFolderAndSelectItems Shell_NotifyIconGetRect SHCreateItemFromParsingName Shell_NotifyIconW

ole32

CoCreateFreeThreadedMarshaler CoInitialize CoInitializeEx RegisterDragDrop RevokeDragDrop CoUninitialize CoTaskMemAlloc OleInitialize CoCreateInstance CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

advapi32

EventUnregister RegCloseKey RegOpenKeyExW SystemFunction036 RegGetValueW RegQueryValueExW EventRegister EventSetInformation EventWriteTransfer

user32

InvalidateRect SetCursorPos GetForegroundWindow FlashWindowEx IsWindowEnabled EnableWindow IsIconic IsWindowVisible GetAsyncKeyState SetPropW MonitorFromRect EnableMenuItem SetMenuItemInfoW VkKeyScanW SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity GetKeyState IsWindow RegisterTouchWindow GetMonitorInfoW DestroyAcceleratorTable ScreenToClient AdjustWindowRectEx DrawMenuBar GetMenu GetWindowLongW SetCapture RegisterRawInputDevices SystemParametersInfoW CheckMenuItem InsertMenuW AppendMenuW GetCursorPos ReleaseCapture ClientToScreen SetForegroundWindow TrackPopupMenu MonitorFromWindow CloseTouchInputHandle GetDC GetWindowPlacement TrackMouseEvent SetWindowPlacement UpdateWindow RegisterWindowMessageA ClipCursor GetSystemMetrics GetClipCursor ShowCursor SetWindowLongW GetSystemMenu InvalidateRgn ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyboardState TranslateAcceleratorW FindWindowExW MsgWaitForMultipleObjectsEx DefWindowProcW ChangeWindowMessageFilterEx RegisterClassW GetMenuItemInfoW LoadCursorW CreatePopupMenu CreateMenu EnumChildWindows DispatchMessageA GetMessageA SetWindowPos GetWindowLongPtrW AdjustWindowRect EnumDisplayMonitors MonitorFromPoint SetWindowLongPtrW CreateWindowExW RegisterClassExW FindWindowW GetParent DispatchMessageW TranslateMessage GetMessageW MapVirtualKeyW GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect RedrawWindow GetRawInputData DestroyWindow SetWindowRgn ChangeDisplaySettingsExW KillTimer SetTimer SetCursor GetWindow SetParent CreateAcceleratorTableW SetFocus SystemParametersInfoA DrawIconEx DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo DestroyIcon CreateIcon DestroyMenu RemoveMenu SetMenu PostMessageW GetActiveWindow SendInput ShowWindow SendMessageW PostQuitMessage IsProcessDPIAware GetTouchInputInfo

gdi32

CreateCompatibleDC BitBlt SelectObject DeleteDC CreateRectRgn CreateSolidBrush CombineRgn CreateDIBSection GetDeviceCaps SetBkMode SetTextColor DeleteObject

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass TaskDialogIndirect

oleaut32

SysStringLen GetErrorInfo SetErrorInfo SysFreeString

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

shlwapi

SHCreateMemStream

bcrypt

BCryptGenRandom

ws2_32

shutdown send recv accept listen freeaddrinfo getaddrinfo WSACleanup WSAStartup WSASend bind connect getsockopt getsockname WSAGetLastError getpeername closesocket WSAIoctl ioctlsocket WSASocketW setsockopt

crypt32

CertEnumCertificatesInStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertSetCertificateContextProperty CertAddEncodedCertificateToStore CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertDuplicateStore CertGetCertificateChain CertFreeCertificateChain

secur32

DeleteSecurityContext AcquireCredentialsHandleA InitializeSecurityContextW FreeContextBuffer QueryContextAttributesW ApplyControlToken AcceptSecurityContext EncryptMessage FreeCredentialsHandle DecryptMessage

api-ms-win-crt-math-l1-1-0

round trunc pow roundf floor __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s strcmp wcsncmp wcscmp _wcsicmp strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_set_app_type _register_onexit_function _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit terminate _crt_atexit __p___argc _wassert abort _seh_filter_exe _configure_narrow_argv _cexit __p___argv

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh calloc free

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale