Steamclient dll (Steamclient dll) GSE 文件恶意软件分析

Steamclient.dll (Steamclient.dll) 文件分析

更新于 2 months ago

检查者 Malware Check

steamclient.dll

哈希类型	值	操作
MD5	ee647c9c087b17348dd541233364c5c7
SHA1	fa01617a1a4fa0a43882fcf771de6ac6a09123a5
SHA256	522a096b1569c34da62ec6c9cb7988e750ee25a1a47ab6ce025f9fa79b2c830d
SHA512	8f6724f9d00deb26a1014a566850c3b97ee58a05be2f647bd0b353203974c91920417830bee8a275ae5dd717d5724c1aa938bb656bc677a0d450810503bf2ebb
ImpHash	1fb2bc4f5a872c4b0c4a3e26008e4ede

哈希类型

值

操作

MD5

ee647c9c087b17348dd541233364c5c7

SHA1

fa01617a1a4fa0a43882fcf771de6ac6a09123a5

SHA256

522a096b1569c34da62ec6c9cb7988e750ee25a1a47ab6ce025f9fa79b2c830d

SHA512

8f6724f9d00deb26a1014a566850c3b97ee58a05be2f647bd0b353203974c91920417830bee8a275ae5dd717d5724c1aa938bb656bc677a0d450810503bf2ebb

ImpHash

1fb2bc4f5a872c4b0c4a3e26008e4ede

PE 分析

基本信息

▼

映像基址	`0x10000000`
入口点	`0x104b4e60`
编译时间	2024-09-15 15:33:36
校验和	0x00e38544 (实际: 0x00e38544)
操作系统版本	6.0
PEiD 签名	`PE32 executable (DLL) (GUI) Intel 80386, for MS Windows`
数字签名	Chain verification from C=UK, O=GSE, OU=GSE, CN=GSE (serial:6232803408322828449044127051259884321175188336, sha1:f598f2ec08bbea1790600ebc45710d658ca14322) failed: The X.509 certificate provided is self-signed - "Common Name: GSE, Organizational Unit: GSE, Organization: GSE, Country: UK"
导入	12 库
导出	41 函数
资源	5 资源
节	7 节

版本信息

▼

LegalCopyright	Copyright (C) 2005 GSE
InternalName	Steamclient.dll (win32)
FileVersion	08.56.38.63
CompanyName	GSE
ProductVersion	03.00.00.01
FileDescription	Steamclient.dll
Source Control ID	8563863
OriginalFilename	Steamclient.dll
ProductName	GSE
Translation	0x0409 0x04b0
CompanyName	GSE
FileDescription	Steamclient.dll
FileVersion	3, 0, 0, 1
InternalName	Steamclient.dll
LegalCopyright	Copyright (C) 2005 GSE
OriginalFilename	Steamclient.dll
ProductName	GSE
ProductVersion	3, 0, 0, 1
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	5,398,240 bytes	5,398,528 bytes	6.42 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`7BB389A7D68B9A192F4D622A472F7EFE`
`.rdata`	`0x00527000`	8,536,348 bytes	8,536,576 bytes	6.06 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BC255C7779661065CF56C92A75F4A93E`
`.data`	`0x00d4c000`	757,336 bytes	693,248 bytes	5.02 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D2D51103A70A69B950D94EC2B7B88FA9`
`.detourc`	`0x00e05000`	13,880 bytes	14,336 bytes	3.44 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`34DD840A53F388A6785C7397C98E828D`
`.detourd`	`0x00e09000`	36 bytes	512 bytes	0.16 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5BFBF49F4BAB328D3222C4ABCC54D2B3`
`.rsrc`	`0x00e0a000`	5,112 bytes	5,120 bytes	3.58 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3606FA4C743B0ABE17B7102EB12D9B6B`
`.reloc`	`0x00e0c000`	219,572 bytes	219,648 bytes	6.67 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`3DD66A8D266ACA9698C40470F441576D`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 5 (4,682 字节)

资源类型	数量	总大小	百分比
SCID	1	7 字节	0.1%
WEVT_TEMPLATE	1	2,802 字节	59.8%
RT_VERSION	2	1,492 字节	31.9%
RT_MANIFEST	1	381 字节	8.1%

证书链分析

▼

证书 Information

产品	GSE
描述	Steamclient.dll
文件版本	08.56.38.63
原始名称	Steamclient.dll
验证状态	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
签名者	GSE
内部名称	Steamclient.dll (win32)
版权	Copyright (C) 2005 GSE

证书链摘要

GSE #1 主要

有效期: 2024-09-15 15:33:37 → 2039-11-01 15:33:37

签名算法: sha256RSA

序列号: 01 17 7D 12 FD 9C C6 A1 DD 46 B2 6B 8B B9 43 43 24 A3 33 70

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

Chain verification from C=UK, O=GSE, OU=GSE, CN=GSE (serial:6232803408322828449044127051259884321175188336, sha1:f598f2ec08bbea1790600ebc45710d658ca14322) failed: The X.509 certificate provided is self-signed - "Common Name: GSE, Organizational Unit: GSE, Organization: GSE, Country: UK"

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	steamclient.dll
文件类型	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.227.174
数据库版本	2025-10-14 23:00:16 UTC

Steamclient.dll (Steamclient.dll) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别