Release_x86_SteamItch.zip
- SHA256 a74cdde7e8ae8458279c722a8e6db0397b436b767ec86244e7077b4a0c61f1ef
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Release_x86_SteamItch.zip
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
LICENSE
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral3
Sample
SickoMenu.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
version.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
General
- Target Release_x86_SteamItch.zip
- Size 3.0MB
- Sample260823-xtvfwsal8x
- SHA256 a74cdde7e8ae8458279c722a8e6db0397b436b767ec86244e7077b4a0c61f1ef
- MD5 12e58425c4c994decaf532e9cb0b2cd1
- SHA1 193f85b07164c7452d02f896be0500c673f64d1a
- SHA512 b14d2fcfeede76ae582305c70699f44ca1be9eb7c75d5ca089a615f5b040775235aa1da20b943fa98f12071464523cbd99d9bfe5f5927d7b96f355b307925c6a
- SSDEEP 98304:rq88Vrdit5Utso7ZyLf0sqvaiUf/sSVaQPBrI0W:rx8VZ05GcLvKUnsSVJPBr+
- TLSH T10CE53314FDC03D73F2EA943A99D572F32E33D44E006B56BFE0E560B6964126A4233B99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/SickoMenu.dll unpack001/version.dll
File Explorer
-
Release_x86_SteamItch.zip.zip 3.0MB
-
LICENSE34KB
-
SickoMenu.dll.dll 3.2MB
-
version.dll.dll 3.2MB
LICENSE
- SHA256 230184f60bae2feaf244f10a8bac053c8ff33a183bcc365b4d8b876d2b7f4809
- MD5 e62637ea8a114355b985fd86c9ffbd6e
- SHA1 1eba7caf09a39110ad2f542e3ed8700d1a69c6d3
- SHA512 714d66c4a17e6dfc1553521af2be03f4579fac64048c0b96c592177562b01fc70a8e184bb21725e11ef96a54bf466ae1abd4992b8940f0fe2c0859d6a166a2ef
- SSDEEP 768:l7Y+tNdSz3ZlqXOWoInuzx3Y8N3WiYD9I:lVtNIq1uzZY1w
- TLSH T115F2825FB74513B205A202526E4FA4DEE31DD07A376A00657869C15C23B7E3483BFBAD
- MD5 SHA1 SHA512 SSDEEP TLSH
SickoMenu.dll
- IMPHASH f8c9f3a0a16bc626c7bb0d66c26a1713
- SHA256 f76c73c70cd5cc384011ca5b73f7b43e5836094468b16b0b7e34d5e16e00204d
- MD5 e5eacd5dc98c2e999abae808895980d2
- SHA1 a451d67ea3190b319e516da230484af01704810f
- SHA512 c6f8fe7bfce8d164e935f497bd4addc40c1a44d7cfa8c7e7566664383ecb97e0d44b1517ffc7dc204668b6f08d20723d72f573087fe760a7befc99649c7094e6
- SSDEEP 49152:ZQNH6haL1ysnQeliek5p0dc3dL8r/y8V1ah+5ZOL25wQoYPw0sMU08sU/znO3pO2:ZCHzL87qd0dst8EwTsU/znO304
- TLSH T178F5AD61779CC432E19E0274B45CAB1F482976BB0B7590C7F3D069A971B80E3AA71F1B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1764785
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
SetLastError
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
CreateThread
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleFileNameW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetModuleHandleW
FreeLibraryAndExitThread
FreeConsole
ExitProcess
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
OutputDebugStringW
WriteFile
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
CreateSemaphoreW
CloseHandle
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
WaitForSingleObject
QueryPerformanceCounter
ReleaseSemaphore
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
RaiseException
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
Sleep
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
WriteConsoleW
ReadFile
SetEndOfFile
user32
SetWindowLongW
GetKeyState
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
MessageBoxW
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
CallWindowProcW
GetWindowRect
shell32
ShellExecuteA
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
840KB
Virtual Size
839KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
194KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=259, version=33145,
count=189, id=261, version=33145,
count=34, id=260, version=33145,
count=15, id=260, version=35207,
count=27, id=259, version=35207,
count=95, id=261, version=35207,
count=13, id=257, version=33145,
count=221, id=1, productName=Unmarked objects,
count=102, id=265, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,
version.dll
- IMPHASH 7af1787369092d448a6cfd03d3393ffb
- SHA256 63da4a490b30870248f6f8be412702f5763c418792a5c67606b37cb125a0fcdf
- MD5 7504d444f1e2c19e2e9bf96e0303b08e
- SHA1 9e0d2d8c6d0091fbb0cf4b9441630c953b358851
- SHA512 2e36501e5960256e78b741e80b024ebe2ff43aeb06faed065fb28eb16d243dc87b6352b21ab73ed05ae973dd6b0eab1c0f69c55cee257bfd473d329d1cab95a6
- SSDEEP 49152:4tKBScWD9FKJ4YzVevOmLfG5H9Xd3UXqvdP7oK+P+n3JStB/53M3f6u13pOFbCvr:4sBSTTUmLO5ZVDn3JUu130F
- TLSH T134F59D51779CC432E28E12B4B46CAB1F482D76BB0B7594C7F3D069A931A81E39A31F17
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1765888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualFree
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetLastError
GetCurrentThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
SetLastError
GetProcAddress
FreeLibrary
LoadLibraryExW
DisableThreadLibraryCalls
CreateThread
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleFileNameW
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibraryAndExitThread
FreeConsole
VirtualProtect
GetSystemDirectoryA
GetCurrentProcessId
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
OutputDebugStringW
WriteFile
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
GetModuleHandleW
CreateSemaphoreW
HeapAlloc
ReadFile
WriteConsoleW
CloseHandle
WaitForSingleObject
ExitProcess
ReleaseSemaphore
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
RaiseException
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
Sleep
WakeAllConditionVariable
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
SetEndOfFile
user32
SetWindowLongW
GetWindowThreadProcessId
FindWindowExW
IsWindowVisible
GetKeyState
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
MessageBoxW
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
CallWindowProcW
GetWindowRect
shell32
ShellExecuteA
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExA
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
841KB
Virtual Size
841KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
21KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
194KB
Virtual Size
193KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=36, id=259, version=33145,
count=189, id=261, version=33145,
count=34, id=260, version=33145,
count=15, id=260, version=35207,
count=27, id=259, version=35207,
count=95, id=261, version=35207,
count=13, id=257, version=33145,
count=224, id=1, productName=Unmarked objects,
count=103, id=265, version=35228,
count=1, id=256, version=35228,
count=1, id=255, version=35228,
count=1, id=151,
count=1, id=258, version=35228,