Steam[.]exe | Triage™

Resubmissions

17/10/2026, 00:35

261017-axvvhay17m3

17/10/2026, 00:35

261017-axd7ray15m3

Sharing

Copy URL Twitter E-mail

General

Target
Steam.exe
Size 3.8MB
Sample261017-axd7ray15m
SHA256 a7006ae4206cfba82669da1468efc5094bddf388b0d518af97311c9130fc8172
MD5 6f72279a8f14e2daf706a453da1e17a0
SHA1 37439f64c3d2d97eb258dab1eac8dfbf2a69d3c6
SHA512 addb5b308dd7249840d824ba2df3e35214bba6496c2318e358ddbb6c4bd9dd9288dea3757708acbc4d91b2f8f876c7c707969713fa3c799c1494626412c035a5
SSDEEP 98304:lR8RpTFxmQEdeFabKi8EI/CCplQiMfQHi:lUpTFxmQEdeFlD5M
TLSH
T1FF06CF47A3A642ECC167D17CC65A9717E37278080322A7DB67D44EAA5F53AE02F3B740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Steam.exe

File Explorer

Steam.exe

.exe 3.8MB

Steam.exe

IMPHASH 9aa5c890f766c6beb7f0b39c156fff4e
SHA256 a7006ae4206cfba82669da1468efc5094bddf388b0d518af97311c9130fc8172
MD5 6f72279a8f14e2daf706a453da1e17a0
SHA1 37439f64c3d2d97eb258dab1eac8dfbf2a69d3c6
SHA512 addb5b308dd7249840d824ba2df3e35214bba6496c2318e358ddbb6c4bd9dd9288dea3757708acbc4d91b2f8f876c7c707969713fa3c799c1494626412c035a5
SSDEEP 98304:lR8RpTFxmQEdeFabKi8EI/CCplQiMfQHi:lUpTFxmQEdeFlD5M
TLSH
T1FF06CF47A3A642ECC167D17CC65A9717E37278080322A7DB67D44EAA5F53AE02F3B740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1807104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\menorquente\Downloads\td7 source free\v2 - Td7 Source\v2 - Td7 Source\v2 - Td7 Source\td7 external\src\x64\Release\Steam.pdb

d3dx9_43

D3DXMatrixTranspose D3DXVec3Transform D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleHandleW QueryFullProcessImageNameW EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx SetLastError FormatMessageW InitializeCriticalSection WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW GetTickCount GetExitCodeProcess WriteProcessMemory FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW CreateFileMappingA SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime GetComputerNameA OpenThread CreateDirectoryA GetCurrentProcessId CreateThread GetTickCount64 DuplicateHandle GetProcessId InitializeSListHead OutputDebugStringW CreateRemoteThreadEx QueryPerformanceCounter ReleaseSRWLockExclusive TerminateProcess VirtualAlloc VirtualProtect FreeLibrary VerSetConditionMask QueryPerformanceFrequency GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar ExitProcess GetStartupInfoA GetProcAddress LoadLibraryA GetLastError GetCommandLineA GetModuleHandleA CreateRemoteThread CopyFileW CreateProcessW MoveFileExW LocalFree CheckRemoteDebuggerPresent IsDebuggerPresent SetFileAttributesA GetSystemInfo DeleteFileW DeleteFileA CreateFileA Sleep SetFileAttributesW GetSystemDirectoryW CreateFileW WaitForSingleObject GetTempPathW GetModuleFileNameW DeviceIoControl WriteFile GetCurrentProcess GetFileSizeEx ReadFile ReadProcessMemory VirtualProtectEx CloseHandle Process32Next K32GetModuleFileNameExA CreateToolhelp32Snapshot OpenProcess Module32First Module32Next Process32First VirtualFreeEx VirtualAllocEx FindFirstFileExW FindNextFileW GetFileAttributesExW

user32

IsWindowVisible SetWindowPos TranslateMessage ToUnicode PeekMessageA GetWindowLongPtrA PostQuitMessage MessageBoxA SetWindowsHookExA FindWindowA UpdateWindow SetWindowDisplayAffinity mouse_event GetKeyNameTextA MoveWindow ShowWindow GetKeyboardState MapVirtualKeyA GetAsyncKeyState GetForegroundWindow RegisterClassExW UnregisterClassW DefWindowProcA CallNextHookEx EnumDisplayMonitors SetLayeredWindowAttributes DestroyWindow GetWindowRect DispatchMessageA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetWindowThreadProcessId SetWindowLongA GetCursorPos SetCursorPos ReleaseCapture CreateWindowExW GetSystemMetrics GetWindowTextA GetWindowLongA EnumWindows FindWindowW SetWindowsHookA GetWindowTextLengthA GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent IsWindowUnicode GetClientRect UnhookWindowsHookEx PostMessageA GetKeyboardLayout SetCapture SetCursor

advapi32

CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW ConvertSidToStringSidA CopySid SetSecurityInfo RegDeleteKeyA RegCreateKeyExA IsValidSid InitializeAcl GetLengthSid AddAccessAllowedAce QueryServiceStatus CloseServiceHandle OpenSCManagerA ControlService OpenServiceA RevertToSelf CreateProcessAsUserA RegGetValueA PrivilegeCheck SetTokenInformation LookupPrivilegeValueA SetThreadToken DuplicateTokenEx RegCloseKey RegEnumKeyW RegDeleteTreeW RegOpenKeyExW ConvertSidToStringSidW AdjustTokenPrivileges OpenProcessToken GetTokenInformation CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt SystemFunction036

shell32

ShellExecuteExW SHGetFolderPathA SHGetFolderPathW ShellExecuteA

ole32

CoInitializeEx

msvcp140

__crtLCMapStringW ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z _Xtime_get_ticks _Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter _Mtx_trylock ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock ?_Random_device@std@@YAIXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$ctype@D@std@@2V0locale@2@A ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0_Locinfo@std@@QEAA@PEBD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ _Thrd_yield ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??7ios_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@_W@std@@2V0locale@2@A _Wcsxfrm ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ

ws2_32

htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen WSACreateEvent recvfrom sendto ioctlsocket WSAEventSelect WSAEnumNetworkEvents getpeername send WSACloseEvent getsockname connect WSAResetEvent WSAWaitForMultipleEvents bind freeaddrinfo WSAStartup getsockopt getaddrinfo WSACleanup ntohs closesocket WSAGetLastError inet_pton WSASetLastError gethostname inet_ntop

crypt32

CertAddCertificateContextToStore CertGetCertificateChain CertFreeCertificateChainEngine CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertCreateCertificateChainEngine CertFindExtension CertGetNameStringW CryptQueryObject CertFreeCertificateChain

ntdll

ZwWriteVirtualMemory ZwReadVirtualMemory

psapi

GetModuleInformation

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception __C_specific_handler longjmp wcschr strrchr memcmp memchr __intrinsic_setjmp memset memcpy __RTtypeid wcsstr __std_type_info_compare strchr strstr _CxxThrowException __std_terminate __std_exception_copy __std_exception_destroy memmove

api-ms-win-crt-heap-l1-1-0

calloc free realloc malloc _set_new_mode _callnewh

api-ms-win-crt-string-l1-1-0

_strdup strncpy wcsncpy strpbrk wcsncmp strcmp strspn wcspbrk strncmp strcspn _wcsdup wcscat_s strcpy_s towupper strncpy_s _wcsicmp tolower toupper strlen wcslen

api-ms-win-crt-stdio-l1-1-0

fsetpos fread setvbuf _fseeki64 _get_stream_buffer_pointers _lseeki64 ftell _set_fmode fseek _wfopen fgetpos __stdio_common_vsprintf __p__commode fwrite _wopen _read _write fgetc _fileno _close fgets fclose fflush fputc ungetc _pclose _popen fputs __stdio_common_vfprintf feof __stdio_common_vsscanf __acrt_iob_func

api-ms-win-crt-convert-l1-1-0

strtod strtoll atof mbstowcs wcstol atoi strtoul wcstombs strtol strtoull

api-ms-win-crt-runtime-l1-1-0

__sys_nerr exit abort _invalid_parameter_noinfo __sys_errlist _resetstkoflw _errno terminate system _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _beginthreadex _initterm _get_narrow_winmain_command_line _set_app_type _seh_filter_exe _cexit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-math-l1-1-0

fmodf sinf log pow _fdopen _dsign powf atan2f sqrt sqrtf logf _hypotf acosf cosf ceilf __setusermatherr

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _fstat64 _unlock_file _lock_file _unlink

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv ___lc_locale_name_func

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-environment-l1-1-0

getenv _wgetenv

api-ms-win-crt-time-l1-1-0

_localtime64 _gmtime64 _time64 strftime