Release_x86_SteamItch.zip
- SHA256 d98a31f746f38c47b622eb8a266bca66abffde8f8132735f42acae998924e2b3
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SickoMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
SickoMenu.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
version.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
version.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Release_x86_SteamItch.zip
- Size 2.8MB
- Sample260802-pwq79atamd
- SHA256 d98a31f746f38c47b622eb8a266bca66abffde8f8132735f42acae998924e2b3
- MD5 c41d37544c1e0a9d426c5c3ac56fa16d
- SHA1 41fb64ad7fa8f60eec3d5410b12050d4e16399c9
- SHA512 dc9cfecba9fa15802a3d32c8ab3f29c1a66949aac7a4d6cf1da4389c09cf6afee8b974ffe84fd9a3d26520dec22d453f725de8fb02dc34b7decf5e199a7934db
- SSDEEP 49152:YE8EULOFY9L6f4PHL0Lk5wCiBnuKJyKOxtokUPB67ZOinVDY8XbWp+zKz53:Y/LOq0OoEwCH7xrQBDcDYP+zW53
- TLSH T16DD533A048F02238F1938EE65E9E5F0862F1378D9F5AB15596573A45C4873E8CCEC9EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SickoMenu.dll unpack001/version.dll
File Explorer
-
Release_x86_SteamItch.zip.zip 2.8MB
-
LICENSE34KB
-
SickoMenu.dll.dll 3.0MB
-
version.dll.dll 3.0MB
LICENSE
- SHA256 230184f60bae2feaf244f10a8bac053c8ff33a183bcc365b4d8b876d2b7f4809
- MD5 e62637ea8a114355b985fd86c9ffbd6e
- SHA1 1eba7caf09a39110ad2f542e3ed8700d1a69c6d3
- SHA512 714d66c4a17e6dfc1553521af2be03f4579fac64048c0b96c592177562b01fc70a8e184bb21725e11ef96a54bf466ae1abd4992b8940f0fe2c0859d6a166a2ef
- SSDEEP 768:l7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD9I:lVtNIq1uzZY1w
- TLSH T115F2825FB74513B205A202526E4FA4DEE31DD07A376A00657869C15C23B7E3483BFBAD
- MD5 SHA1 SHA512 SSDEEP TLSH
SickoMenu.dll
- IMPHASH ef8dd12a42f9de94e76e0a3ed8ff1896
- SHA256 bfb935ebaa578680fc9b2b8fbc28fdedfb72464890ea79b16d9c3b24f0864b3c
- MD5 5ef54efa38a2833d887f8ba64b16df4a
- SHA1 a5d98cf9cedb54508adf12025e7cd00a0a0ca5de
- SHA512 5a0669256537c720f1f62ec2817f27ad7b80d9c5e9ff88c3f5d246f62b70e71e90930853b70b5821ce820296450376180387f8b744deef2db776af69b0a0ec93
- SSDEEP 49152:R07+DR6qmyKc/S+f3Z/E7P5kr//D80Go0mwOMCn895Gvl4wDV03K/3pOO8vd1IBs:q7s0qxd/hOD5kr2mbMCaq/30F
- TLSH T124E59D516E5CD837E28E06B9B42DB71F4C293D730B7585D7B3D0AAA925A00E39632F07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1614098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
SetLastError
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
CreateThread
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleFileNameW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibraryAndExitThread
FreeConsole
GetCurrentProcess
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
OutputDebugStringW
WriteFile
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
VirtualFree
VirtualProtect
GetModuleHandleW
CreateSemaphoreW
CloseHandle
GetUserDefaultLocaleName
HeapFree
HeapAlloc
ReadFile
WaitForSingleObject
ExitProcess
ReleaseSemaphore
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
RaiseException
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
Sleep
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
WriteConsoleW
SetEndOfFile
user32
ReleaseDC
GetKeyState
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
MessageBoxW
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
GetKeyboardState
CallWindowProcW
GetWindowRect
GetDC
SetWindowLongW
SystemParametersInfoW
gdi32
DeleteObject
GetFontData
SelectObject
CreateFontIndirectW
shell32
ShellExecuteA
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
807KB
Virtual Size
807KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
194KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
130KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=259, version=33145,
count=189, id=261, version=33145,
count=34, id=260, version=33145,
count=15, id=260, version=35207,
count=27, id=259, version=35207,
count=95, id=261, version=35207,
count=13, id=257, version=33145,
count=228, id=1, productName=Unmarked objects,
count=102, id=265, version=35227,
count=1, id=255, version=35227,
count=1, id=151,
count=1, id=258, version=35227,
version.dll
- IMPHASH 2abed268a96014bccbdaf003cfb3a076
- SHA256 0846539d0f8c49450da425f8cfe6519affadbeafe6a4778093e1ed3cc9bdf46d
- MD5 1ecd86244df3e7d0d78c208a52cc37ea
- SHA1 b6803eb77162cca4e776d7c7621a7ac17e307455
- SHA512 c00f7c5e4716f4b1b005209167b900b6123c04ba08a895c26c68bb43cd89345976d11568ecc9bd8b016a8b6bfc5aac1b386719aad83a846264571d8145653bdd
- SSDEEP 49152:Y7PTGovP1uHh9aE/AIwbSJ+1sDzPF6cs6EAGlWHiWXw4sPPFJk3pOONvF6JVyFOl:APqAuwBbSJ+1PjAGNJk30wF
- TLSH T134E59C91AE5CC477E29E06B9B42DB71E4C393D730BB185D7B3D0B9A925A00E29631F07
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1615200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
SetLastError
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
CreateThread
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleFileNameW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibraryAndExitThread
FreeConsole
ExitProcess
GetSystemDirectoryA
GetCurrentProcessId
VirtualAlloc
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
OutputDebugStringW
WriteFile
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
GetCurrentProcess
VirtualFree
VirtualProtect
GetModuleHandleW
CreateSemaphoreW
CloseHandle
ReadFile
WriteConsoleW
GetFileType
GetStdHandle
GetUserDefaultLocaleName
WaitForSingleObject
HeapSize
ReleaseSemaphore
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
RaiseException
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
Sleep
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetEndOfFile
user32
ReleaseDC
GetWindowThreadProcessId
FindWindowExW
IsWindowVisible
GetKeyState
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
MessageBoxW
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
GetKeyboardState
CallWindowProcW
GetWindowRect
GetDC
SetWindowLongW
SystemParametersInfoW
gdi32
DeleteObject
GetFontData
SelectObject
CreateFontIndirectW
shell32
ShellExecuteA
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
809KB
Virtual Size
808KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
194KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
130KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=259, version=33145,
count=189, id=261, version=33145,
count=34, id=260, version=33145,
count=15, id=260, version=35207,
count=27, id=259, version=35207,
count=95, id=261, version=35207,
count=13, id=257, version=33145,
count=231, id=1, productName=Unmarked objects,
count=103, id=265, version=35227,
count=1, id=256, version=35227,
count=1, id=255, version=35227,
count=1, id=151,
count=1, id=258, version=35227,