Steam Tools Fixer New Update.rar
- SHA256 9cb7595ff66759dd286026c9fb3d4092b5cfd5cec9f6a2fd7429a16b07fe83fb
Password
CW.FIX
Behavioral task
behavioral1
Sample
Steam Tools Fixer/SteamToolFixer.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target Steam Tools Fixer New Update.rar
- Size 17.8MB
- Sample260809-1bb4dawcqd
- SHA256 9cb7595ff66759dd286026c9fb3d4092b5cfd5cec9f6a2fd7429a16b07fe83fb
- MD5 2e7a973e527f17b1e3f8133b39579c05
- SHA1 c151b24170da773223e23dec8bcb19f5f15115c2
- SHA512 9b4c7164d5deb9d6cfa1aa8de9979d24772d375592150b65351a232fa09659f6becb304b8d436c38eed445b1c83c29419ec5172fc9251718507c1610691d86ba
- SSDEEP 393216:4qB/aUA7BMoYQp1BJyZFsm33Rg13O4sxXL04sF/ZkVT/1IXeFML4:4qBy5BMoZpUFsmHdsFBiZUeA4
- TLSH T1A01733DDF111A08E5C9D06F39A3B44D9A256B34CF8A14F7B138DA40D7D3B8A32D6A079
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack002/Steam Tools Fixer/SteamToolFixer.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Steam Tools Fixer/SteamToolFixer.exe
File Explorer
-
Steam Tools Fixer New Update.rar.rar 17.8MB
-
Steam Tools Fixer New Update/Readme.txt663B
-
Steam Tools Fixer New Update/Steam Tools Fixer.rar.rar 17.8MB
-
Steam Tools Fixer/SteamToolFixer.exe.exe 18.0MB
-
app.pyc53KB
Steam Tools Fixer New Update/Readme.txt
- SHA256 3ca39bc88b610e1cc76a05a9e832ca187eebe400ed468801bc717285359c4294
- MD5 49bb43ee46e090a72f9193ccfc22484f
- SHA1 1aa846ecc51262cf0c3baecfe4fe57c0d424d665
- SHA512 7c6beb80cac740c6c59a7663f3706b97c886835dae78d10d3560d50318a709193cb86200e4419764989053eb1882ad52675c999ed237037dec3791a58306ac8a
- TLSH T18A01D36F7FE3525017B453E42F8A58D5E200146D7778435DBE2653043D391A05C11FDE
- MD5 SHA1 SHA512 TLSH
Steam Tools Fixer New Update/Steam Tools Fixer.rar
- SHA256 8be637de0bac4df578ca4d4eef14f4fc12e14e6b369253be0d08ef5a030efa41
- MD5 72c06427ec53de3021404701180f1db9
- SHA1 e12ea713bfb7e2e47687d34527d062342839d761
- SHA512 5a0cd1b87946ac5bf880307a2425db77491663d9d9166af1ce1b7f9abe37368953daadd558e250698e230ba142f96ef3572495332be9f641a8edd7a2f3f61621
- SSDEEP 393216:6qB/aUA7BMoYQp1BJyZFsm33Rg13O4sxXL04sF/ZkVT/1IXeFMLr:6qBy5BMoZpUFsmHdsFBiZUeAr
- TLSH T1351733DDF111A08E5C9D06B39A3B44D9A256B34CF8A14F7B138DA40D7D3B8A33D6A079
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
CW.FIX
Steam Tools Fixer/SteamToolFixer.exe
- IMPHASH cf72283be50852e418ce6bbb6b645835
- SHA256 aa16e47fa7e1e667ce67f06b0c296ed2fe2e201f63267b18db9092540648c5f1
- MD5 7be820d3553e690bbd133a6152f3889b
- SHA1 b2de2e0bd16e05b7c5b2556b7a2af696ced38893
- SHA512 4a45610b23030cce2620baa1a44a4a758e099674802c2a0f61c00c832bba78b5c0321cacc27a11d0acdd2a62bd65cb1ebc08071f1d7b8f4782daaf03cc596d62
- SSDEEP 393216:4uiLoKjYnrZLrStZq5XpS2akHsxtEDweEQdKtD07Wl/oc:4Lr6VLrStZq5Va2wt7e1aDmc
- TLSH T177173369A395056BD8EB913C56E7C3B1F3B1A12027228DFF1B51072A2F6B4D0457E3B8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
CW.FIX
Minor OS version
0
Major OS version
6
Entry point
57632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
GetEnvironmentStringsW
CreateSymbolicLinkW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
SetDllDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
178KB
Virtual Size
177KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
93KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=158, id=1, productName=Unmarked objects,
count=29, id=260, version=36246,
count=1, id=258, version=36246,
app.pyc
- SHA256 417713866c5c28260fc781ec3ab89681bf26e5cf5b979d440354148289ea3eee
- MD5 0641c78b08a387b54a5a421ac6e20992
- SHA1 70800d097d33b317c37731a9a684f3ab64671388
- SHA512 bd2d625269f62726e1a55c274918c13ba61af5511c91c81926025f60b455e658935f768cf865d63b6587c3874b3daa442aa4bec6a28427a3237d95b3701f3558
- SSDEEP 768:XQofmrgewV/qlJzQNQ/lWkQ66dM6Nwdw4hC21cKa96PdLHQ:Xbfmrgee/YZ/pQh26NPIlw
- TLSH T15843F87A95306A27FEDCF13831D6ADD5B322C24A7612D70BF1188DBDBE8831A955060F
- MD5 SHA1 SHA512 SSDEEP TLSH