download: | Steam.exe |
Full analysis: | https://app.any.run/tasks/9cfe2f5d-7872-4a07-804a-8f89fdb8922d |
Verdict: | Malicious activity |
Analysis date: | November 15, 2018, 19:04:25 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 6832751C19EBE5B6A4E41D7BB5AEEE96 |
SHA1: | 6184F198015F235DFE3FE62E47CF8982705DC034 |
SHA256: | ECBD33586E3CB5A19AC065B920B7D894047A2CCB7EF8B18A38880681C961071F |
SSDEEP: | 49152:/nlWWQqa5y5o77nDcV18Zeg/qwRL77NzFp6V/IWVvsxZ3e4gatssbSkPbJdXK+0H:/lWWQqaU5onDG882L7tF8VgUvP4g9s/e |
.exe | | | Generic Win/DOS Executable (50) |
---|---|---|
.exe | | | DOS Executable Generic (49.9) |
ProductName: | Steam Client Bootstrapper |
---|---|
OriginalFileName: | steam.exe |
SourceControlID: | 4801401 |
FileDescription: | Steam Client Bootstrapper |
ProductVersion: | 01.00.00.01 |
CompanyName: | Valve Corporation |
FileVersion: | 04.80.14.01 |
InternalName: | steamcmd (buildbot_steam-relclient-win32-builder_steam_rel_client_win32@steam-relclient-win32-builder) |
LegalCopyright: | Copyright (C) 2010 Valve Corporation |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x0017 |
ProductVersionNumber: | 1.0.0.1 |
FileVersionNumber: | 4.80.14.1 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0xe235c |
UninitializedDataSize: | - |
InitializedDataSize: | 1059840 |
CodeSize: | 2063872 |
LinkerVersion: | 14.14 |
PEType: | PE32 |
TimeStamp: | 2018:11:08 19:53:11+01:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 08-Nov-2018 18:53:11 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | Valve Corporation |
FileDescription: | Steam Client Bootstrapper |
FileVersion: | 1, 0, 0, 1 |
InternalName: | steamcmd |
LegalCopyright: | Copyright (C) 2010 Valve Corporation |
OriginalFilename: | steam.exe |
ProductName: | Steam Client Bootstrapper |
ProductVersion: | 1, 0, 0, 1 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000158 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 08-Nov-2018 18:53:11 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x001F7D4C | 0x001F7E00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.67752 |
.rdata | 0x001F9000 | 0x0009FB72 | 0x0009FC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.09358 |
.data | 0x00299000 | 0x00073234 | 0x00013000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.26925 |
.rsrc | 0x0030D000 | 0x00036C3C | 0x00036E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.46071 |
.reloc | 0x00344000 | 0x0001911C | 0x00019200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.63947 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.16897 | 2179 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 3.3778 | 296 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 5.55504 | 3752 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 6.13765 | 2216 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 5.5102 | 1384 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 7.98337 | 18630 | Latin 1 / Western European | English - United States | RT_ICON |
7 | 5.01546 | 16936 | Latin 1 / Western European | English - United States | RT_ICON |
8 | 5.14938 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
9 | 5.29577 | 6760 | Latin 1 / Western European | English - United States | RT_ICON |
10 | 5.00572 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
ADVAPI32.dll |
COMCTL32.dll |
CRYPT32.dll |
GDI32.dll |
KERNEL32.dll |
OLEAUT32.dll |
PSAPI.DLL |
SHELL32.dll |
USER32.dll |
VERSION.dll |
Title | Ordinal | Address |
---|---|---|
CanSetClientBeta | 1 | 0x00025D10 |
ClientUpdateRunFrame | 2 | 0x00025D30 |
CreateInterface | 3 | 0x00042C50 |
ForceUpdateNextRestart | 4 | 0x00025D40 |
GetBootstrapperVersion | 5 | 0x00025DB0 |
GetClientLauncherType | 6 | 0x00025DC0 |
GetClientUpdateBytesDownloaded | 7 | 0x00025DD0 |
GetClientUpdateBytesToDownload | 8 | 0x00025DF0 |
GetCurrentClientBeta | 9 | 0x00025E10 |
IsCheckingForUpdates | 10 | 0x00025E40 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1488 | "C:\Users\admin\AppData\Local\Temp\Steam.exe" | C:\Users\admin\AppData\Local\Temp\Steam.exe | explorer.exe | |
User: admin Company: Valve Corporation Integrity Level: MEDIUM Description: Steam Client Bootstrapper Version: 04.80.14.01 |
(PID) Process: | (1488) Steam.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Valve\Steam |
Operation: | write | Name: | SteamPID |
Value: 1488 | |||
(PID) Process: | (1488) Steam.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Valve\Steam |
Operation: | write | Name: | TempAppCmdLine |
Value: |
PID | Process | Filename | Type | |
---|---|---|---|---|
1488 | Steam.exe | C:\Users\admin\AppData\Local\Temp\package\tenfoot_misc_all.zip.1ca83d76835b4613170f5cead778b176b11f2b0c | — | |
MD5:— | SHA256:— | |||
1488 | Steam.exe | C:\Users\admin\AppData\Local\Temp\package\tenfoot_dicts_all.zip.33245b7d523f68418283e93b0572508fa127ee8f | — | |
MD5:— | SHA256:— | |||
1488 | Steam.exe | C:\Users\admin\AppData\Local\Temp\package\tenfoot_fonts_all.zip.vz.7673e4cd32b6752bc621d8bc1a7118a9af19b64a_12077027 | — | |
MD5:— | SHA256:— | |||
1488 | Steam.exe | C:\Users\admin\AppData\Local\Temp\package\tenfoot_ambientsounds_all.zip.89b80bcfdd11b2b99257ddbbdc374e2df54e2738 | — | |
MD5:— | SHA256:— | |||
1488 | Steam.exe | C:\Users\admin\AppData\Local\Temp\package\bins_misc_win32.zip.vz.79f25a747d2b76ccde98bd8127af0aa35cb689de_10463237 | — | |
MD5:— | SHA256:— | |||
1488 | Steam.exe | C:\Users\admin\AppData\Local\Temp\package\tenfoot_images_all.zip.vz.04fa59fdcdeb3818196294fb1db417f75a46d1ec_31242830 | — | |
MD5:— | SHA256:— | |||
1488 | Steam.exe | C:\Users\admin\AppData\Local\Temp\package\bins_win32.zip.vz.f31d99634fba0390d05377bd407453b80c0c1aa6_15570889 | — | |
MD5:— | SHA256:— | |||
1488 | Steam.exe | C:\Users\admin\AppData\Local\Temp\package\bins_cef_win32_win7.zip.vz.2338b1554b2a440c6269eddc98cd0bf8d742d2e6_51635137 | — | |
MD5:— | SHA256:— | |||
1488 | Steam.exe | C:\Users\admin\AppData\Local\Temp\package\tmp\tenfoot\resource\images\intro_movie.webm_ | — | |
MD5:— | SHA256:— | |||
1488 | Steam.exe | C:\Users\admin\AppData\Local\Temp\package\friendsui_all.zip.vz.3c4a7f86d9c15bca782499b76024765b2ff8376f_3087851 | binary | |
MD5:972269A817BE5B4696CA23A3DFCB8478 | SHA256:03A47DEFBB3A67E99BF9B6DDEC0A0A6222B1E67C5875A3467DB85DB58D5C68D8 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1488 | Steam.exe | GET | 200 | 2.16.186.64:80 | http://media4.steampowered.com/client/tenfoot_images_all.zip.vz.04fa59fdcdeb3818196294fb1db417f75a46d1ec_31242830 | unknown | — | 29.8 Mb | whitelisted |
1488 | Steam.exe | GET | 302 | 162.254.197.102:80 | http://client-download.steampowered.com/client/steam_client_win32 | DE | — | — | whitelisted |
1488 | Steam.exe | GET | 200 | 2.16.186.64:80 | http://media4.steampowered.com/client/tenfoot_misc_all.zip.1ca83d76835b4613170f5cead778b176b11f2b0c | unknown | binary | 12.5 Mb | whitelisted |
1488 | Steam.exe | GET | 200 | 2.16.186.64:80 | http://media4.steampowered.com/client/resources_music_all.zip.vz.7a62e15083d4a65668f0d1fa58ad8c1b99fb5ace_3708050 | unknown | binary | 3.54 Mb | whitelisted |
1488 | Steam.exe | GET | 200 | 2.16.186.64:80 | http://media4.steampowered.com/client/resources_misc_all.zip.vz.4a1fa88d21b005b67a41a9a0fc6044ae1fa46791_2225211 | unknown | binary | 2.12 Mb | whitelisted |
1488 | Steam.exe | GET | 200 | 2.16.186.64:80 | http://media4.steampowered.com/client/tenfoot_ambientsounds_all.zip.89b80bcfdd11b2b99257ddbbdc374e2df54e2738 | unknown | ini | 7.60 Mb | whitelisted |
1488 | Steam.exe | GET | 200 | 2.16.186.64:80 | http://media4.steampowered.com/client/resources_hidpi_all.zip.vz.3c5bd3d518c854fea3680ca96768205dee63c1bb_50023 | unknown | binary | 48.8 Kb | whitelisted |
1488 | Steam.exe | GET | 200 | 2.16.186.64:80 | http://media4.steampowered.com/client/tenfoot_sounds_all.zip.vz.ffef2b2fc386819a842ea79484b966a937c2ca7e_1209792 | unknown | binary | 1.15 Mb | whitelisted |
1488 | Steam.exe | GET | 200 | 2.16.186.64:80 | http://media4.steampowered.com/client/friendsui_all.zip.vz.3c4a7f86d9c15bca782499b76024765b2ff8376f_3087851 | unknown | binary | 2.94 Mb | whitelisted |
1488 | Steam.exe | GET | 200 | 2.16.186.64:80 | http://media4.steampowered.com/client/tenfoot_dicts_all.zip.33245b7d523f68418283e93b0572508fa127ee8f | unknown | binary | 11.7 Mb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1488 | Steam.exe | 2.16.186.64:80 | media4.steampowered.com | Akamai International B.V. | — | whitelisted |
1488 | Steam.exe | 162.254.197.102:80 | client-download.steampowered.com | Valve Corporation | DE | unknown |
Domain | IP | Reputation |
---|---|---|
client-download.steampowered.com |
| whitelisted |
media4.steampowered.com |
| whitelisted |