Steamclient64 dll (Steamclient dll) GSE 文件恶意软件分析

Steamclient64.dll (Steamclient.dll) 文件分析

更新于 2 months ago

检查者 Malware Check

steamclient64.dll

哈希类型	值	操作
MD5	6572edbd80d06fba19eaae40d45eeb67
SHA1	52fbb56ae7121e9715e5cbae5539d12a5a0bcb3c
SHA256	2e53c9ccd69b90b1161d0866f4fe7938869970cdbf13e96b11e930096c074317
SHA512	bc887f176aefcbb487e8c69436ac36d08a8435ab1da3ecc2ec8bedf13dcd622f6568d7fa3edeed1ad3f401773a21deb772f3639ef83e8af9a62b26068b791bad
ImpHash	9cf7cb882a905308052aaeeca16acf9c

哈希类型

值

操作

MD5

6572edbd80d06fba19eaae40d45eeb67

SHA1

52fbb56ae7121e9715e5cbae5539d12a5a0bcb3c

SHA256

2e53c9ccd69b90b1161d0866f4fe7938869970cdbf13e96b11e930096c074317

SHA512

bc887f176aefcbb487e8c69436ac36d08a8435ab1da3ecc2ec8bedf13dcd622f6568d7fa3edeed1ad3f401773a21deb772f3639ef83e8af9a62b26068b791bad

ImpHash

9cf7cb882a905308052aaeeca16acf9c

PE 分析

基本信息

▼

映像基址	`0x180000000`
入口点	`0x1805c872c`
编译时间	2024-09-15 15:33:33
校验和	0x00fb9c6e (实际: 0x00fb9c6e)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
数字签名	Chain verification from C=UK, O=GSE, OU=GSE, CN=GSE (serial:416549159621857092118335404876936541820552765922, sha1:e3f67f570d6286bcbc641bf5b5802826d1e4d4b2) failed: The X.509 certificate provided is self-signed - "Common Name: GSE, Organizational Unit: GSE, Organization: GSE, Country: UK"
导入	12 库
导出	41 函数
资源	5 资源
节	8 节

版本信息

▼

LegalCopyright	Copyright (C) 2005 GSE
InternalName	Steamclient.dll (win64)
FileVersion	08.56.38.63
CompanyName	GSE
ProductVersion	03.00.00.01
FileDescription	Steamclient.dll
Source Control ID	8563863
OriginalFilename	Steamclient.dll
ProductName	GSE
Translation	0x0409 0x04b0
CompanyName	GSE
FileDescription	Steamclient.dll
FileVersion	3, 0, 0, 1
InternalName	Steamclient.dll
LegalCopyright	Copyright (C) 2005 GSE
OriginalFilename	Steamclient.dll
ProductName	GSE
ProductVersion	3, 0, 0, 1
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	6,583,228 bytes	6,583,296 bytes	5.97 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`AD1805E8DC5A9B663213EA7E7B28904B`
`.rdata`	`0x00649000`	8,822,778 bytes	8,822,784 bytes	5.99 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`39DF215C260FCD8C9DCDA4AE02BC6498`
`.data`	`0x00eb3000`	810,992 bytes	724,992 bytes	4.87 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8DAA0946F230A784CDB1D3FBDE800CE8`
`.pdata`	`0x00f79000`	245,136 bytes	245,248 bytes	6.37 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`15E1C76118BFE05ECFB337EE4F8AE7B7`
`.detourc`	`0x00fb5000`	26,752 bytes	27,136 bytes	2.42 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`66CF08EC936A86C72881FCDF27AC7FA6`
`.detourd`	`0x00fbc000`	72 bytes	512 bytes	0.27 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`31B795DCCC410A524334953CD56357BE`
`.rsrc`	`0x00fbd000`	5,112 bytes	5,120 bytes	3.58 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A630AD2FFB5C30D95C66ABE07ED79199`
`.reloc`	`0x00fbf000`	44,460 bytes	44,544 bytes	5.47 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`CFEF2955CB9C2FCCAD1EB0B0D1CF57C6`

资源分析

▼

资源总数: 5 (4,682 字节)

资源类型	数量	总大小	百分比
SCID	1	7 字节	0.1%
WEVT_TEMPLATE	1	2,802 字节	59.8%
RT_VERSION	2	1,492 字节	31.9%
RT_MANIFEST	1	381 字节	8.1%

证书链分析

▼

证书 Information

产品	GSE
描述	Steamclient.dll
文件版本	08.56.38.63
原始名称	Steamclient.dll
验证状态	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
签名者	GSE
内部名称	Steamclient.dll (win64)
版权	Copyright (C) 2005 GSE

证书链摘要

GSE #1 主要

有效期: 2024-09-15 15:33:34 → 2039-11-01 15:33:34

签名算法: sha256RSA

序列号: 48 F6 B5 D7 F0 2B 4E 54 7A 7B F6 53 74 2A C1 D8 A1 08 61 E2

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

Chain verification from C=UK, O=GSE, OU=GSE, CN=GSE (serial:416549159621857092118335404876936541820552765922, sha1:e3f67f570d6286bcbc641bf5b5802826d1e4d4b2) failed: The X.509 certificate provided is self-signed - "Common Name: GSE, Organizational Unit: GSE, Organization: GSE, Country: UK"

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	steamclient64.dll
文件类型	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
扫描器版本	1.0.227.174
数据库版本	2025-10-14 23:00:16 UTC

Steamclient64.dll (Steamclient.dll) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别