Steamless.v3.1.0.5.-.by.atom0s.zip
- SHA256 e3e2d22e098ff3fb359b2876aa2bed9596f0501e6ff588cbffae90a76d2dc4f5
Static task
static1
1 signatures
General
- Target Steamless.v3.1.0.5.-.by.atom0s.zip
- Size 596KB
- Sample261006-y3khqaev4y
- SHA256 e3e2d22e098ff3fb359b2876aa2bed9596f0501e6ff588cbffae90a76d2dc4f5
- MD5 0e0d58e00de93c01253a9f217af55323
- SHA1 49dc25ced07f0fc7436fbff876400160cf6eca42
- SHA512 5af82a0d0c9cdbefa44a320823956bd028d3698389ffe597626340d66723dd3ea4b2372f086c15f41684f1c0760b27e1ca11f0e08c6201501be355211994fab9
- SSDEEP 12288:QmmIIMV/nFPK/wRDMpDnbRiUYv+FmwrzP3+FE4v/fFQG+AM9X:QmkMVJK4RDenMU5srPFh+d9X
- TLSH T1AAD423EE9705BAB1E3DFF9F0A77BA91BB4B10E84051DFA64B0D86966CE090371237144
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 12 IoCs
Checks for missing Authenticode signature.
resource unpack001/Plugins/ExamplePlugin.dll unpack001/Plugins/SharpDisasm.dll unpack001/Plugins/Steamless.API.dll unpack001/Plugins/Steamless.Unpacker.Variant10.x86.dll unpack001/Plugins/Steamless.Unpacker.Variant20.x86.dll unpack001/Plugins/Steamless.Unpacker.Variant21.x86.dll unpack001/Plugins/Steamless.Unpacker.Variant30.x64.dll unpack001/Plugins/Steamless.Unpacker.Variant30.x86.dll unpack001/Plugins/Steamless.Unpacker.Variant31.x64.dll unpack001/Plugins/Steamless.Unpacker.Variant31.x86.dll unpack001/Steamless.CLI.exe unpack001/Steamless.exe
File Explorer
-
Steamless.v3.1.0.5.-.by.atom0s.zip.zip 596KB
-
ExamplePlugin.zip.zip 3KB
-
ExamplePlugin/ExamplePlugin.csproj2KB
-
ExamplePlugin/Main.cs3KB
-
ExamplePlugin/Properties/AssemblyInfo.cs1KB
-
Plugins/ExamplePlugin.dll.dll 5KB
-
Plugins/SharpDisasm.dll.dll 215KB
-
Plugins/Steamless.API.dll.dll 33KB
-
Plugins/Steamless.Unpacker.Variant10.x86.dll.dll 11KB
-
Plugins/Steamless.Unpacker.Variant20.x86.dll.dll 19KB
-
Plugins/Steamless.Unpacker.Variant21.x86.dll.dll 24KB
-
Plugins/Steamless.Unpacker.Variant30.x64.dll.dll 17KB
-
Plugins/Steamless.Unpacker.Variant30.x86.dll.dll 16KB
-
Plugins/Steamless.Unpacker.Variant31.x64.dll.dll 16KB
-
Plugins/Steamless.Unpacker.Variant31.x86.dll.dll 16KB
-
Steamless.CLI.exe.exe 110KB
-
Steamless.CLI.exe.config189B
-
Steamless.exe.exe 1.2MB
-
Steamless.exe.config189B
ExamplePlugin.zip
- SHA256 6d856118bfc92349a982c97c810f9f6b64a6f27f249d71e0250d90784e1e81ce
- MD5 e8d5739d5ad7cca3bbf1bac5df0e3d42
- SHA1 8dede37dd8303da49cd0e3abfa3b785778487f61
- SHA512 beb7ac7fee69b77f4e5528c4426e4d42b924f0e5162c1ec996097b6e61d68b7ad8799138cfbf435cd34d246ea2d6aba6543927685b8e287269c1fcb0221adddb
- TLSH T102811810D0186E37C530C6FD28DC6CC3A5AD03140AC1FB6BAAAE85368C0DA136E143A7
- MD5 SHA1 SHA512 TLSH
ExamplePlugin/ExamplePlugin.csproj
- SHA256 aa2d20fdeb689df617def139b55ecaec031d1192c9b3edcda336563d55cb42cb
- MD5 8de33f2ecb84331627c02232764462ca
- SHA1 3b04675febd3c8c10cd08ec0c23f85cb2227c60d
- SHA512 2f331866844dadaf63c37383ac59098bf562b6a248c04f1a653c03ac9a86c7f76141d31c346ae5cc6f27cd74d4a1f97e4bf687599277a64b19380099388108f3
- TLSH T18F514031D1C86DEA03F1643291E3AF4ADA79A3F314A08C68B7A9E44B0B33A941013737
- MD5 SHA1 SHA512 TLSH
ExamplePlugin/Main.cs
- SHA256 69a741d8393c4c64be2a0e8c9a4746b8e7907e8a43fcd1fd6af8b5de9b41bdcb
- MD5 3767fc65ea4d8bde688bbb2c8e77d3a8
- SHA1 2013da9aeecf4dc8892b00e2e6e114cea6c426fa
- SHA512 57d47048a852899c87484e4006e4f9f24451625b3099784449582f9049ead383c87f2f683a1d081b0f3f012db93eddc17df4a011ac5ada0a102fbcd14acb9fc9
- TLSH T129813E5EA1CACA321C7201616F03F0CBF316061B9156E972B5FD93962F718AD0277E5A
- MD5 SHA1 SHA512 TLSH
ExamplePlugin/Properties/AssemblyInfo.cs
- SHA256 1a109a070135a1bb660e92db5078c50df5b57e591237f6d9eb13f803a70b7724
- MD5 534df18dec72839f22f3688fe13b4288
- SHA1 4414a40dd2bc716fab6f3b092ce87e30450bf59b
- SHA512 cc18ec027ff14565f134201c5666bcf316c2209edba80d209525212dca0be14e7bbc8c9124ba00664558e93ec30f264dc52a13c4d69387ac3c7ee6850d8bd812
- TLSH T15A410D2D5245532E5FA101B3AE6378CEF10F332611DA1C2574FC6583FF615684378E96
- MD5 SHA1 SHA512 TLSH
Plugins/ExamplePlugin.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c6dce0ce7d432fbb8cea249e4dcd1394adc8c2adc819012c745b709c68e585a9
- MD5 dbfe069390646f3402b21f28005f3156
- SHA1 062664b8e81e0b06f72970acf8cac2ecc2001d51
- SHA512 904525f99e9c458e4e04db95e4d10bb34f78cfc569b61b5b9a57e557bc50bf768e6d29f43ecc70b381e7a50d74dc7ab93ed5202e14b77a3ec036d031e9db19ca
- SSDEEP 48:6c6A+IvVrnXjGluJoN1DDemM+V4edYGlQlsNlRmlb/lbGyClbVSVgz3HVNUwtwcr:j+WVjgd1V4Wh5yWSVgzVxa5oM
- TLSH T185C1631563DC523AF9F74F71FCB353021639FA118DB3DBAD1489064A2D135248A71B32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/SharpDisasm.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6d3ce990cdf58da228697d25416d16d15994135c5f66571fe1e00e9c975bc2cf
- MD5 0f900d9190603d646009ec3523fa43cc
- SHA1 a04598dcef92337ec57c0a357c2e55a1fb9c0f40
- SHA512 24397a81c9ad30f3d5377632d74706345c4a9811076357df3fc8d307a8941167b2b40b85923a4782f22a531e9f3ac4fe234ab892bdc1139a1a60f4ed7798a467
- SSDEEP 3072:y0AUOuR0cuVT+INgDgU0CaG8yVHZ2pFnjuWG/tDTQPd0FvAvxl3vBsyr8fnLN64R:hsuRUVT7U0CaGpVHs/jEEsz6
- TLSH T13224A772654223B3D0766BFC47B3E68F01A0DCB729279F59388B39D6D9583305AA2D31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
216186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\sharpdisasm\SharpDisasm\obj\Release\net45\SharpDisasm.pdb
mscoree
_CorDllMain
Name
.text
Size
211KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Steamless.API.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d6acc4b0cc768213a46ffad0a6bf6070a6b13f79a22e0588f0ab50c950f9248c
- MD5 c347632a60da1519c48ff043831ca7df
- SHA1 5fa976d84468d69a7cda801651415f666e6e9b69
- SHA512 9ffab32ef1a53f9a08cab77d68b9d5b9676e4e1c2a63acc258f80769d544629a31b03c6f9b3fa17a19f7897e2fb0613379802e67758629a46b6d4978c5137906
- SSDEEP 768:DQS4Cd5dulN1LdZOAQoAksbgaDTO3NnS6KmskO4Nuy8S0N:+Cd5dulN1L7TcTy7NuAG
- TLSH T112F23A4117A4C32BCE9E0BB4B87391064375C147BA42FB9749F8B4DA6D533C90A26BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
40130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Steamless.Unpacker.Variant10.x86.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c890dcda2e79970e5a5541ee6340e503e829982f1613c36119be7f754c32065d
- MD5 31f399ccb6bf807bf07ec3ac264d930d
- SHA1 db7757f66e377f737cc06976c03c4d3772a2c85c
- SHA512 af299d52be53d8a1d41a77dde40cd4fd81850960b9842caedd1a7f4f917cf3b5523bc355a13ba95af872d17d704c3ac2ac18dd0c769b2472e57828599b81e100
- SSDEEP 192:q02+M3RP5GJp3WHAnROJqRZSz1rT/xEQayychMWfiKonzV:0B3GJpGHEbTY1fx5ayyhn5
- TLSH T12032E90656E44339EDFF5B38A8B2461745B8FE06A970CF0E45C441DF1E22AA18971BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
16850
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Steamless.Unpacker.Variant20.x86.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3cca1fb90b1aa3e1703565a095b665acfc8073b889ff44ef97d17f4221fe707f
- MD5 a058bf89c78880d7ca66c6513ba37a8f
- SHA1 485f1d5a0d6a0958da1dde342d506f76c0bf91bd
- SHA512 33224ad20c7eb7f7c8d6b962bbf42e066ec20d0eb23ca434010935d3620adc719b6736ad10af6444ee01ec7e9b0504fe51411c3c8ecfe532245058eccd0cdffb
- SSDEEP 384:6b90lYR0m+sjrrWTdRIgk+LY+2ITmXjECoQqt3kkJRNT7I1:aCqTWTfsEYRcNtd7t7S
- TLSH T1A192F80152EA423BE6FF1B7554F2924240B4FD67AD75EB8E0DDC60CE2933AE0550176B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
25026
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Steamless.Unpacker.Variant21.x86.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2f92eeaf47accd0f87bbe7fb7cf85fcd3c00830f464dfdbd4f661449bbc92b21
- MD5 2144889fddfdeb1fa2cf4f18b611581c
- SHA1 9232fd21d8f0fa92ff060c7ecb630025a1b0c015
- SHA512 94c019ba7b0cf15ed04378413b20e3a0afe7e59bead89d321d6b2323b7fee392436dfc86e606270ed97f4461bde889c0b3c770475b86c394794f949ff7b91978
- SSDEEP 384:y2K3WqyoKTT1FRSiNYkAdCah+LY+OYwFht/kWHj48yyyyvyyymyffDHMjFjQX:yfKFxd8CYEYbNntLfyyyyvyyymyffWY
- TLSH T1FAB20A0766A87336D5FFAF35687646020975B957BEB0DA0B2CCC50CB2F92AC04603796
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
21KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Steamless.Unpacker.Variant30.x64.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 81f1d36540fc8756b155b3e58b34f54da4f9bc1f974988cf91d0b17ffc1d14d8
- MD5 956eebdbafff1a5abb3eb9690f292165
- SHA1 4c4183fe055476b35c517753a4eeb160d084e074
- SHA512 c8d461513431df1a09b7b10f3aac6f8b04ff9845a2c6323d4ad05b5b854be19c02d7066eb48991cd8301e6d01e7817700baef5f6ec84e2e2b9660bda79ceca38
- SSDEEP 192:KLCAkfP7kB3VwWHU5FCRr32vfjuglnSs8FBuqrqJ7q1bQOgNj2HVfu3KWgGti:Kw37kM0U5QF4fjug5+y8gqaGgHA
- TLSH T14772D80666E45327E5FF1B39A8B247024579BD56BEB0DB1F9C8C808F2E267D04412766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22610
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Steamless.Unpacker.Variant30.x86.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fe2102b096d44aa956788d067856225254ee4e43c133c939e3cd5c0a6cc37399
- MD5 2a32a106e85dfdf75095d034b30b752a
- SHA1 e62d15fbeaa2936f8d40760b2ec4e03115564947
- SHA512 b6639121884a023f771d4049f781ac821995f9cb38885bdce80811a0c2789fbafed22336b29ed203b01261f45fbad41fcaa1187707dca473c8e79d6fb3961eee
- SSDEEP 384:zPuEBILbHtoZDreqbljug6FFl1rjqSG22b:JBIfH+w4hUBlGr
- TLSH T15772CA4A5AE4731AE9FF1B3C68B2470345B6F995FDB0DE1F8844808F1F67AD0481276A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Steamless.Unpacker.Variant31.x64.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 790f1974f97258058cb57c20787e8a2fcb5c16cca0911719b698580d74e38918
- MD5 8cef9d57f82ed85f390ccd387e21e5a0
- SHA1 e9c5eac6488c2467cb601ab534fe1560c9785502
- SHA512 8cc15de28e630c69e8d9b1b4b0064bcb7f28588156ec67c9c751da293bff0408f39c20b6dc15b90174748346716967104b25be2e2c57e3965c0a4af42c2f652d
- SSDEEP 384:nAZi4/VB2222222Az2QfAog6tc3nqaGsFR:A44tJKWAyi3q+
- TLSH T15272C80666E4532AE9FF1B7968B2470316B9F946FDB1CE1E8C5C808F1F26BD04811B76
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21606
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Plugins/Steamless.Unpacker.Variant31.x86.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fc7e1ac80a7d2c0121e083d218b7369c4d217eccaf395cd1c0292d000f19446b
- MD5 2c7a10fb35202e73632b2637426d9d1b
- SHA1 ef2a8cca203e05f6728a6d0bc61aefa5c22b650c
- SHA512 f502215a110d11bf6e52139e59553375c3d65f093859935fe5611b5ddcfdd1c5c2aa86696ace1a99720ec6bdd2e778c354f7cf7c393dc69a5ebf7894a3d0f7ac
- SSDEEP 384:bCSyGvzGvVFjnv3logr87Q1AK8QG2neA:QkzGvVJnPlDVG74
- TLSH T17A72A60656E0A31AE5FF2B3568B247135BB5F955FEB0CA1F884481CF1F26BC4481276B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
22026
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Steamless.CLI.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 70cd54354865ede605ec0fbfadf15f5302aa85a777394f28b0de6acfd243e795
- MD5 2a2f85ca57b8ffc8daf586c1773a1e56
- SHA1 d340cadd1eb578c25ad393541f16ecd6b0eac2be
- SHA512 4126a07df763fea7eaa142a29b5c13512f350153396a4d0ec6738c12a84f44765c8e3f80bf0b042adce810ee968d3d2a31ed243ab0f4fcc48c1600acdd3fd403
- SSDEEP 384:h89XmZM6WmqIRP68hcFpOGoA9aLu44B3qiVE341ByXvonJcbqPySHYqzQzw4rs:G9XmDWsR4PY2N1YGx1ByoJKqhHEDs
- TLSH T132B37151B4C8A564F93E75F2AC66C4C102763DAAAD215A1F34BDB34E09B3253CE2772C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18418
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Steamless.CLI.exe.config
- SHA256 e8decc96235b5494880083eb79c22c84c6d9ef312828baf9490bee7782c350ec
- MD5 ef0181de18ef3951806c0ad63b897ba4
- SHA1 4b6a4b0f7fbbbd1dceab385e7fac74a35fc132cb
- SHA512 b1816817e8deaa7b22bc51966e9debed46b254be6463f2ac0204be348baefb751c5d846a5353d43cce66a005a73f6226462b8ec8b59d4e16a54130c327c68b79
- TLSH T10CC080554454BD274D334B1357528529EFB073A36424140CF01FE5560F3114D4657377
- MD5 SHA1 SHA512 TLSH
Steamless.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 7d8858454e2065fac487ef23a5cc5f1b7e7c54656ca949c7931c8a17079afb2f
- MD5 c5ab3844b6f36633c392a6ab35ae7d6c
- SHA1 442b5c7ca3638533e12185b4386473d4d8b2386a
- SHA512 05bb075de612430e1c449215c5296c1a5f381655847e4559d7e3526af4f6c4315dd4277b440c037c64b43e65f405f3fb1080d5916e7084b172dffc4dca36a128
- SSDEEP 12288:sgeE+wrotQDHMSNBZ5qgAkxPOGHAlQOojukfI+UKMpPpB/d7dClQEMhroq:scHZJx5ARojI+UtB/dpCd
- TLSH T11B556B1123E84759C6DF33F6A0B1491439F57E1271B18329A5B5FA6AA832B57CCA033F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1197282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Steamless.exe.config
- SHA256 e8decc96235b5494880083eb79c22c84c6d9ef312828baf9490bee7782c350ec
- MD5 ef0181de18ef3951806c0ad63b897ba4
- SHA1 4b6a4b0f7fbbbd1dceab385e7fac74a35fc132cb
- SHA512 b1816817e8deaa7b22bc51966e9debed46b254be6463f2ac0204be348baefb751c5d846a5353d43cce66a005a73f6226462b8ec8b59d4e16a54130c327c68b79
- TLSH T10CC080554454BD274D334B1357528529EFB073A36424140CF01FE5560F3114D4657377
- MD5 SHA1 SHA512 TLSH