steam[1][.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
steam[1].exe
Size 23KB
Sample260804-slchwscg34
SHA256 aadd255a8efe2491b29c1d5917f72db3eea93ffde89995985a19d0d4c172213c
MD5 afe9b68ed167f0ec45a28bd47d3054f7
SHA1 bd07d119f7cc88573d864d68aa3d3612fcbbea9f
SHA512 657c69fa4ddc7a609d22f7e0a10911103177197a56a69d3c9d9461d8e8db6ca732c315e4b1f1bbb0934b6dee29574e569a381b02e3c3f40b6e392eb7b1659349
SSDEEP 384:A7nM/ItPc+pYsyKVzg6VvYxIP4Ztd6TTjuJtzwoF8BqbRZoXC6P+lK9vF907LaFy:psZWTJ2qaUR+XDP+lK9v47ya5z
TLSH
T1F4B23B337A168276D6A645B10839FFAA82BFA5305F7116D7FB818D2E0A705D1ED3240B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
steam[1].exe

File Explorer

steam[1].exe

.exe 23KB

steam[1].exe

IMPHASH 6dda173840fc586381b16d5f5fa9cfb1
SHA256 aadd255a8efe2491b29c1d5917f72db3eea93ffde89995985a19d0d4c172213c
MD5 afe9b68ed167f0ec45a28bd47d3054f7
SHA1 bd07d119f7cc88573d864d68aa3d3612fcbbea9f
SHA512 657c69fa4ddc7a609d22f7e0a10911103177197a56a69d3c9d9461d8e8db6ca732c315e4b1f1bbb0934b6dee29574e569a381b02e3c3f40b6e392eb7b1659349
SSDEEP 384:A7nM/ItPc+pYsyKVzg6VvYxIP4Ztd6TTjuJtzwoF8BqbRZoXC6P+lK9vF907LaFy:psZWTJ2qaUR+XDP+lK9v47ya5z
TLSH
T1F4B23B337A168276D6A645B10839FFAA82BFA5305F7116D7FB818D2E0A705D1ED3240B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13083

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ivank\source\repos\skeet\Release\steam.pdb

kernel32

WriteProcessMemory SetConsoleTitleA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetProcAddress VirtualAllocEx CreateRemoteThread GetCurrentDirectoryW GetLastError GetModuleHandleW LocalFree FormatMessageA GetLocaleInfoEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent

msvcp140

?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?good@ios_base@std@@QBE_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

vcruntime140

memmove __CxxFrameHandler3 __std_exception_destroy __std_exception_copy __std_terminate _CxxThrowException __current_exception __current_exception_context memset memcpy _except_handler4_common

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn terminate _initialize_onexit_table _register_thread_local_exe_atexit_callback _register_onexit_function _cexit _controlfp_s _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _crt_atexit _set_app_type _seh_filter_exe __p___argv _c_exit __p___argc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode