steam[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
steam.exe
Size 23KB
Sample261015-2rfbeaev3n
SHA256 30c4492ef5fb4199131ee5b926cd60671e0ade022f6d645c610c4661c81a9863
MD5 6df04b64f516ffac31185abf8b3499b4
SHA1 eb6407cd453b5a37d9833ec221e248a2bf6ce255
SHA512 9d14c9ab87ed2cbe269b91f796f17e68aae51279ecf1ca0afdaa968d49e8726756ee20b3c776be5c5aa7d074343b4bc431d1e1455cc194bbb9f7551a3d81b03f
SSDEEP 384:Gt5nGcVj9Pc20ucmArJG+MYaatd6wbu816q8Z+k4trG3Cm5r8r7v+CN3a:SHhcDM06NQkqrG3v5Ir7N
TLSH
T1DCB21A23BA578676D65216B1093AEFAB82FFA5301F6165D7F7844E2E0A205D0ED3600F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
steam.exe

File Explorer

steam.exe

.exe 23KB

steam.exe

IMPHASH 3fedf31deb15677c819ae9ae09f114aa
SHA256 30c4492ef5fb4199131ee5b926cd60671e0ade022f6d645c610c4661c81a9863
MD5 6df04b64f516ffac31185abf8b3499b4
SHA1 eb6407cd453b5a37d9833ec221e248a2bf6ce255
SHA512 9d14c9ab87ed2cbe269b91f796f17e68aae51279ecf1ca0afdaa968d49e8726756ee20b3c776be5c5aa7d074343b4bc431d1e1455cc194bbb9f7551a3d81b03f
SSDEEP 384:Gt5nGcVj9Pc20ucmArJG+MYaatd6wbu816q8Z+k4trG3Cm5r8r7v+CN3a:SHhcDM06NQkqrG3v5Ir7N
TLSH
T1DCB21A23BA578676D65216B1093AEFAB82FFA5301F6165D7F7844E2E0A205D0ED3600F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13242

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\byzzy\Documents\openC\FemboySense\Release\steam.pdb

kernel32

WriteProcessMemory SetConsoleTitleA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetProcAddress VirtualAllocEx CreateRemoteThread GetCurrentDirectoryW GetLastError GetModuleHandleW LocalFree FormatMessageA GetLocaleInfoEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess

msvcp140

?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?good@ios_base@std@@QBE_NXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

vcruntime140

__CxxFrameHandler3 memmove __std_exception_destroy __std_exception_copy __std_terminate _CxxThrowException __current_exception __current_exception_context memset _except_handler4_common memcpy

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_invoke_watson terminate _initialize_onexit_table _register_thread_local_exe_atexit_callback _register_onexit_function __p___argv _controlfp_s _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _crt_atexit _set_app_type _seh_filter_exe __p___argc _c_exit _cexit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode