steamcmd.zip
- SHA256 7669b170dee42db8ee2273775ed7dfb2d173bdba1b849f70d2c7b379290bce13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
steamcmd.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target steamcmd.zip
- Size 756KB
- Sample260925-tln3cs117k
- SHA256 7669b170dee42db8ee2273775ed7dfb2d173bdba1b849f70d2c7b379290bce13
- MD5 c320ecf2c5d82b605e81bc11a8078c39
- SHA1 cfc463be19d2a305412b897b050a3a94c81ddbf6
- SHA512 f13c9c9e3991342cd29ef70938ba9b4940f711f253080f1de312eca88484c838494c3c77dc548c58108525983ffd83d9e36100ab41014f478adc783a8d9cfc7f
- SSDEEP 12288:/lzlDCtX73mmrxmccismewTxH+RQjw+3leeV1wlVENCc9F5jHXrMcxts/EPne1xw:nDsr3mOxSmeYxwm3heLfc9F1zxts3w
- TLSH T1FBF4235807E512CE4DBF92BD906815EE3E6B52E45DB108F1ECC0A8D01628C9996F37BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/steamcmd.exe
File Explorer
-
steamcmd.zip.zip 756KB
-
steamcmd.exe.exe 1.6MB
steamcmd.exe
- IMPHASH b577ab37d933fff75ff8d0214ef60e64
- SHA256 fc103a323d70caaac475ae1cfcacfd8eec4c6b1e130005c4793f2013b4b019f8
- MD5 2629c77b1149eee9203e045e289e68ef
- SHA1 e45974be43d33419ac8e5208e0b2b787cd592fc4
- SHA512 397c238f43c6208feea21fb929e6f6429b3ed035414dc779982350998030dda834431864026e22f2b6a2c99b8b2bcd6d5d2970dd8d71c39698f03d6043c6778d
- SSDEEP 49152:r38U9PBcjnaqMbyrsmYjDVUf1yAF4/LPT4gsVdqJVuOji1Y:rn5cjnaqMbytYjRQy54g3
- TLSH T17375BF31BD03D171E4D311F5DE7DBB9E646EA9200B2956D373E80A5E19701E22E3A38B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
a4:df:78:f1:73:09:0a:05:db:01:b8:01:c9:bf:a6:a8:09:44:9e:ed
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=US
Chains
Dec 3, 2013
CN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=US
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 8, 2006 - Jul 16, 2036
Subject
CN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=US
Serial Number
47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 28, 2012 - Nov 23, 2015
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
1
Major OS version
5
Entry point
498719
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
e:\buildslave\steam_rel_client_win32\build\src\steamcmd\Release\steamcmd.pdb
ws2_32
select
__WSAFDIsSet
WSASendTo
WSARecvFrom
closesocket
shutdown
accept
WSAGetLastError
bind
WSAIoctl
ioctlsocket
getsockname
gethostbyname
ntohl
ntohs
htons
htonl
recv
send
connect
setsockopt
WSASocketA
WSAStartup
kernel32
GetTickCount
GetCurrentProcess
LocalFree
GetFileAttributesW
FreeLibrary
LoadLibraryA
SetFileAttributesA
GetFileAttributesA
SetLastError
Sleep
DeleteFileA
GetModuleFileNameA
RemoveDirectoryW
GetFullPathNameW
GlobalUnlock
GlobalAlloc
GlobalLock
InterlockedIncrement
InterlockedDecrement
GetFileSize
FindClose
GetDriveTypeA
DeviceIoControl
HeapCreate
HeapSetInformation
ExitProcess
FindFirstFileExA
FileTimeToLocalFileTime
MoveFileA
RtlUnwind
GetFullPathNameA
PostQueuedCompletionStatus
CreateIoCompletionPort
GetVersion
GlobalFree
GetLocalTime
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
SetProcessAffinityMask
GetProcessAffinityMask
GetSystemInfo
CopyFileA
HeapAlloc
HeapFree
HeapSize
InterlockedExchangeAdd
HeapValidate
InterlockedCompareExchange
DebugBreak
InterlockedExchange
MoveFileExW
SetErrorMode
SetEnvironmentVariableA
GetModuleHandleA
GetProcAddress
CreateProcessA
GetConsoleOutputCP
SetConsoleOutputCP
GetLastError
WriteFile
ReadFile
CreateFileA
WideCharToMultiByte
InitializeCriticalSection
CreateEventA
CreateThread
GetVersionExA
GetCurrentThreadId
ResetEvent
SetEvent
DeleteCriticalSection
CloseHandle
MultiByteToWideChar
OutputDebugStringA
GetCurrentDirectoryA
WaitForSingleObject
LeaveCriticalSection
GetProcessHeaps
HeapQueryInformation
SetUnhandledExceptionFilter
GetCurrentDirectoryW
SetCurrentDirectoryW
EnterCriticalSection
HeapReAlloc
SetEnvironmentVariableW
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetModuleFileNameW
VirtualFree
VirtualProtect
ResumeThread
SuspendThread
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsGetValue
GetACP
TlsFree
TlsAlloc
CreateMutexA
GetCurrentProcessId
WriteConsoleW
SetStdHandle
CompareStringW
VirtualQuery
RaiseException
GetTimeZoneInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
PeekNamedPipe
GetConsoleMode
GetConsoleCP
GetStartupInfoW
GetFileType
SetHandleCount
GetStdHandle
IsValidCodePage
GetOEMCP
SetThreadAffinityMask
TerminateThread
GetCPInfo
GetThreadPriority
OpenThread
GetExitCodeThread
GetCurrentThread
LCMapStringW
LoadLibraryExA
LoadLibraryW
LoadLibraryExW
GetModuleHandleW
SetFilePointer
GetFileSizeEx
SetEndOfFile
FlushFileBuffers
GetFileInformationByHandle
FindNextFileW
SleepEx
CreateFileW
CreateDirectoryW
SetFilePointerEx
SetFileAttributesW
SetFileTime
GetFileTime
DeleteFileW
GetDiskFreeSpaceA
GetDiskFreeSpaceExW
GetDriveTypeW
FindFirstFileW
WriteFileEx
VirtualAlloc
GetProcessHeap
HeapUnlock
HeapWalk
HeapLock
TerminateProcess
GetCommandLineA
IsDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
user32
MessageBoxA
SetDlgItemTextA
SetDlgItemInt
GetWindowRect
GetDesktopWindow
SetWindowPos
EndDialog
DialogBoxParamA
IsWindowVisible
GetDlgItemInt
EnumWindows
GetWindowThreadProcessId
CloseClipboard
SetClipboardData
wsprintfA
GetDlgItem
EmptyClipboard
OpenClipboard
GetWindowTextLengthA
advapi32
CryptGenRandom
RegCloseKey
SetSecurityDescriptorDacl
RegQueryValueExA
InitializeSecurityDescriptor
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExA
RegOpenKeyA
shell32
ord680
SHGetFileInfoW
oleaut32
VariantClear
CanSetClientBeta
ClientUpdateRunFrame
CreateInterface
GetBaseUserContentDir
GetBaseUserContentDirUTF8
GetBaseUserDir
GetBaseUserDirUTF8
GetBootstrapperVersion
GetClientUpdateBytesDownloaded
GetClientUpdateBytesToDownload
GetCurrentClientBeta
GetEUniverse
GetSteamExePath
GetSteamExePathUTF8
GetSteamInstallDir
GetSteamInstallDirUTF8
IsCheckingForUpdates
IsClientUpdateAvailable
PermitDownloadClientUpdates
SetClientBeta
StartCheckingForUpdates
g_dwDllEntryThreadId
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
283KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
59KB
Virtual Size
564KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
136KB
Virtual Size
135KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ