SteamWebHelper[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
SteamWebHelper.exe
Size 12.5MB
Sample261019-bykllaxybw
SHA256 fe4698faf6bcd3d5885563c79348c5bbc807f9037ac6b4d9afdae3b8f65a71a3
MD5 0d57a643b0aa0370f6ea94716c8de1d1
SHA1 a950e3c6a7b8ff8874eafaa1800af54e66a22995
SHA512 7b1da5313d8a49a972b893fc01f595712888dd924f5e42685a93333e31dd58b002364787d45e8cedabd991698a158c57af3c63a5678bd381725157154b547c49
SSDEEP 98304:brj0n2rKav4lGEWefz5B892Pupxc5uIEuHYS+bCtvKshG:3KGuGE7orc5fnBv
TLSH
T170D616016F9E59A9D1C9CC30C24A8BA38F2130DB1A7AB5BF55D202952F7D7B46F2C319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SteamWebHelper.exe

File Explorer

SteamWebHelper.exe

.exe 12.5MB

SteamWebHelper.exe

IMPHASH c97924454c9479057d9a2c0c0b9c27fd
SHA256 fe4698faf6bcd3d5885563c79348c5bbc807f9037ac6b4d9afdae3b8f65a71a3
MD5 0d57a643b0aa0370f6ea94716c8de1d1
SHA1 a950e3c6a7b8ff8874eafaa1800af54e66a22995
SHA512 7b1da5313d8a49a972b893fc01f595712888dd924f5e42685a93333e31dd58b002364787d45e8cedabd991698a158c57af3c63a5678bd381725157154b547c49
SSDEEP 98304:brj0n2rKav4lGEWefz5B892Pupxc5uIEuHYS+bCtvKshG:3KGuGE7orc5fnBv
TLSH
T170D616016F9E59A9D1C9CC30C24A8BA38F2130DB1A7AB5BF55D202952F7D7B46F2C319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9307952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SteamWebHelper.pdb

kernel32

CreateProcessW ExitProcess LocalFree CreateThread SetHandleInformation QueryPerformanceCounter SleepEx WaitForMultipleObjectsEx FlsSetValue K32GetPerformanceInfo GetSystemTimes IsThreadAFiber FlsFree LoadLibraryExA FreeLibrary DuplicateHandle FlsAlloc Sleep OpenProcess SetLastError ReleaseMutex WaitForMultipleObjects CreateMutexA CreateEventW GetModuleFileNameW GetCurrentProcess LoadLibraryA WaitForSingleObjectEx SetEvent GetProcAddress SwitchToThread GetModuleHandleA GetCurrentThread SetThreadStackGuarantee CreateEventA GetModuleHandleExW GetCurrentThreadId GetProcessHeap HeapFree HeapAlloc FormatMessageW GetProcessTimes SetWaitableTimer CopyFileExW GetProcessIoCounters GetModuleHandleW DeleteFileW SetFileInformationByHandle FindFirstFileExW FindNextFileW FindClose SetFilePointerEx GetFinalPathNameByHandleW GetSystemTimeAsFileTime GetExitCodeProcess WaitForSingleObject TerminateProcess ReadFile GetOverlappedResult WriteFile CancelIoEx GetLastError CloseHandle GetCurrentProcessId CreateIoCompletionPort SetFileCompletionNotificationModes InitializeSListHead CreateWaitableTimerExW GlobalMemoryStatusEx PostQueuedCompletionStatus GetQueuedCompletionStatusEx VirtualQueryEx CreateFileW ReadProcessMemory GetSystemInfo GetStdHandle GetConsoleMode GetConsoleOutputCP GetWindowsDirectoryW WriteConsoleW ReadFileEx WriteFileEx GetSystemDirectoryW GetFullPathNameW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx FreeEnvironmentStringsW CreateDirectoryW CancelIo GetFileAttributesW GetEnvironmentStringsW GetTempPathW CompareStringOrdinal GetEnvironmentVariableW MultiByteToWideChar RtlVirtualUnwind WideCharToMultiByte RtlLookupFunctionEntry RtlCaptureContext SetConsoleCtrlHandler GetCurrentDirectoryW HeapReAlloc AddVectoredExceptionHandler lstrlenW GetSystemTimePreciseAsFileTime QueryPerformanceFrequency GetComputerNameExW SetUnhandledExceptionFilter

user32

MonitorFromPoint DestroyWindow PeekMessageW PostThreadMessageW PostQuitMessage GetMessageW TranslateMessage DispatchMessageW

combase

CoCreateFreeThreadedMarshaler CoIncrementMTAUsage CoTaskMemFree

api-ms-win-core-winrt-l1-1-0

RoUninitialize RoInitialize RoGetActivationFactory

coremessaging

CreateDispatcherQueueController

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

advapi32

SystemFunction036 OpenProcessToken IsValidSid GetLengthSid CopySid GetTokenInformation RegCloseKey RegSetValueExW RegOpenKeyExW RegGetValueW

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

PropVariantClear StringFromIID CoInitializeEx CoDecrementMTAUsage CoUninitialize CoCreateInstance

mmdevapi

ActivateAudioInterfaceAsync

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

ntdll

RtlNtStatusToDosError NtQueryInformationProcess NtWriteFile NtDeviceIoControlFile NtReadFile NtOpenFile RtlGetVersion NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtQuerySystemInformation

mfreadwrite

MFCreateSourceReaderFromMediaSource

mfplat

MFCreateSample MFStartup MFShutdown MFCreateAttributes

mf

MFEnumDeviceSources

psapi

GetModuleFileNameExW

pdh

PdhCollectQueryData PdhEnumObjectsA PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCloseQuery PdhOpenQueryA PdhRemoveCounter

oleaut32

SysFreeString SysStringLen SetErrorInfo GetErrorInfo

bcryptprimitives

ProcessPrng

ws2_32

getsockname bind setsockopt WSAStartup accept freeaddrinfo getpeername recv send shutdown listen connect WSASocketW closesocket WSAGetLastError ioctlsocket WSAIoctl getsockopt getaddrinfo WSASend

bcrypt

BCryptGenRandom

powrprof

CallNtPowerInformation

vcruntime140

_CxxThrowException __CxxFrameHandler3 memcpy memcmp memmove memset __current_exception __C_specific_handler __current_exception_context

api-ms-win-crt-math-l1-1-0

sin ceil roundf cos sinf pow __setusermatherr

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv _crt_atexit __p___argc exit _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv terminate _seh_filter_exe _set_app_type _exit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func __p__commode __stdio_common_vsnprintf_s _set_fmode

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free

api-ms-win-crt-locale-l1-1-0

_configthreadlocale