SteamSetup_patched[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SteamSetup_patched.exe
Size 5.9MB
Sample260930-lr3hyaxdlf
SHA256 df7740b375b28ea344673f0e35a55e058388acfbfe7daa83ab51b6d77f08b067
MD5 f4a4d972692e0d357f07093a016d97e9
SHA1 c8d8422a1039a2f5226d435883e0e32f3a9cad1c
SHA512 9e0811534ac31d2ec41af2ab59b9fb491aa79aa5152d04198ed70cd1803dae8b478fcf41ff01d5ac2fccdf1a0a4ad1900aede3a7fcb249578e9334f5c0a5e538
SSDEEP 98304:7cMXSCvVFyS+2Z5uj/TWQHRx9vxxjp1E+RBj1:3r5uj/KQxz/4+
TLSH
T19B567D52E26640ECC16BC0788756A637E7B178491330AAFF16A5D7312F23EE05B7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SteamSetup_patched.exe

File Explorer

SteamSetup_patched.exe

.exe 5.9MB

SteamSetup_patched.exe

IMPHASH a07ef86b82ac34ad2604f481754c9821
SHA256 df7740b375b28ea344673f0e35a55e058388acfbfe7daa83ab51b6d77f08b067
MD5 f4a4d972692e0d357f07093a016d97e9
SHA1 c8d8422a1039a2f5226d435883e0e32f3a9cad1c
SHA512 9e0811534ac31d2ec41af2ab59b9fb491aa79aa5152d04198ed70cd1803dae8b478fcf41ff01d5ac2fccdf1a0a4ad1900aede3a7fcb249578e9334f5c0a5e538
SSDEEP 98304:7cMXSCvVFyS+2Z5uj/TWQHRx9vxxjp1E+RBj1:3r5uj/KQxz/4+
TLSH
T19B567D52E26640ECC16BC0788756A637E7B178491330AAFF16A5D7312F23EE05B7E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext RegCloseKey RegCreateKeyExW RegOpenKeyExA RegQueryValueExA RegSetValueExW

comdlg32

GetOpenFileNameW GetSaveFileNameW

kernel32

AllocConsole CloseHandle CreateEventA CreateFileMappingW CreateFileW CreateHardLinkW CreateMutexW CreatePipe CreateProcessW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EnterCriticalSection ExitProcess FileTimeToSystemTime FillConsoleOutputCharacterW FindResourceW FormatMessageA FreeConsole FreeLibrary GetCommandLineW GetConsoleMode GetConsoleScreenBufferInfo GetConsoleScreenBufferInfoEx GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFullPathNameW GetLargestConsoleWindowSize GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessTimes GetStdHandle GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetVolumeInformationA GlobalAlloc GlobalLock GlobalUnlock InitializeCriticalSection InitializeProcThreadAttributeList K32EnumProcessModules K32GetModuleBaseNameA K32GetModuleFileNameExA LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile MoveFileExW MultiByteToWideChar OpenFileMappingW OpenProcess OpenThread OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleScreenBufferInfoEx SetConsoleScreenBufferSize SetConsoleTextAttribute SetConsoleTitleW SetConsoleWindowInfo SetCurrentConsoleFontEx SetDefaultDllDirectories SetEvent SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread Thread32First Thread32Next TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile UpdateProcThreadAttribute VirtualAllocEx VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteProcessMemory lstrcmpiW lstrcpynW

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtol strtoll strtoul strtoull wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ _wgetcwd getenv

api-ms-win-crt-filesystem-l1-1-0

_findclose _fstat64 _wchdir _wchmod _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen lroundf

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _get_errno _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_errno _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf _chsize_s _close _close _fileno _fseeki64 _ftelli64 _get_osfhandle _lseeki64 _open _read _setmode _wfopen _wopen _write fclose fflush fopen fputc fputs fputwc fread fwrite getc getwc putc putwc setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_strdup _wcsicmp isalnum iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm tolower toupper towlower towupper wcscat wcscmp wcscoll wcscpy wcscpy_s wcslen wcsncpy wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_wutime64 strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

ole32

CoInitialize CoTaskMemFree CoUninitialize

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW Shell_NotifyIconW

user32

AppendMenuW AttachThreadInput BringWindowToTop CloseClipboard CreatePopupMenu CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DispatchMessageW EmptyClipboard EnumWindows GetClipboardData GetCursorPos GetForegroundWindow GetMessageW GetWindowLongW GetWindowThreadProcessId IsIconic IsWindow IsWindowVisible LoadIconW MapVirtualKeyW MessageBoxW OpenClipboard PostMessageW PostQuitMessage RegisterClassExW SendInput SendMessageW SetActiveWindow SetClipboardData SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetWindowLongW SetWindowTextW ShowWindow SwitchToThisWindow TrackPopupMenu TranslateMessage VkKeyScanA keybd_event mouse_event

ws2_32

FreeAddrInfoW GetAddrInfoW WSACleanup WSAGetLastError WSAStartup accept bind closesocket htons inet_addr listen recv send setsockopt socket

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SteamSetup_patched.exe

advapi32

comdlg32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

shell32

user32

ws2_32

generic