Steamclient extra x32 dll (Steamclient dll) GSE 文件恶意软件分析

Steamclient_extra_x32.dll (Steamclient.dll) 文件分析

更新于 2 months ago

检查者 Malware Check

steamclient_extra_x32.dll

哈希类型	值	操作
MD5	6b5a4feb5ac70d7ddf71d442cbd8e2fc
SHA1	60d7e1fb9f2df606dd5cbb31381aa3d2c355c074
SHA256	82b820882f007b7438da50d50c55697b473d9702668daf602ba4fe5db717135d
SHA512	be06f84e19f4a79490361b9e5a74f2beff67fe973e9b08d0356a243edda81601a6b800a01c8fd4a1129d06c2b19d0a4e96f5ad56eb66edfc2722bdc4e395c252
ImpHash	513c01edfd6c3b8bbc434de15f3751a2

哈希类型

值

操作

MD5

6b5a4feb5ac70d7ddf71d442cbd8e2fc

SHA1

60d7e1fb9f2df606dd5cbb31381aa3d2c355c074

SHA256

82b820882f007b7438da50d50c55697b473d9702668daf602ba4fe5db717135d

SHA512

be06f84e19f4a79490361b9e5a74f2beff67fe973e9b08d0356a243edda81601a6b800a01c8fd4a1129d06c2b19d0a4e96f5ad56eb66edfc2722bdc4e395c252

ImpHash

513c01edfd6c3b8bbc434de15f3751a2

PE 分析

基本信息

▼

映像基址	`0x10000000`
入口点	`0x100080a5`
编译时间	2024-09-15 15:31:03
校验和	0x000293f6 (实际: 0x000293f6)
操作系统版本	6.0
PEiD 签名	`PE32 executable (DLL) (GUI) Intel 80386, for MS Windows`
数字签名	Chain verification from C=UK, O=GSE, OU=GSE, CN=GSE (serial:206767428835674839382510048150785838928825771546, sha1:57a7b597c09bc66f46cfc186519a1859dc88f1fc) failed: The X.509 certificate provided is self-signed - "Common Name: GSE, Organizational Unit: GSE, Organization: GSE, Country: UK"
导入	1 库 KERNEL32
导出	0 函数
资源	5 资源
节	7 节

版本信息

▼

LegalCopyright	Copyright (C) 2005 GSE
InternalName	Steamclient.dll (win32)
FileVersion	08.56.38.63
CompanyName	GSE
ProductVersion	03.00.00.01
FileDescription	Steamclient.dll
Source Control ID	8563863
OriginalFilename	Steamclient.dll
ProductName	GSE
Translation	0x0409 0x04b0
CompanyName	GSE
FileDescription	Steamclient.dll
FileVersion	3, 0, 0, 1
InternalName	Steamclient.dll
LegalCopyright	Copyright (C) 2005 GSE
OriginalFilename	Steamclient.dll
ProductName	GSE
ProductVersion	3, 0, 0, 1
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	77,900 bytes	78,336 bytes	6.61 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`093666690871EAF6D7AF6A7FA1163D00`
`.rdata`	`0x00015000`	31,562 bytes	31,744 bytes	4.96 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`25A6C9FF16FDCA6233D6D71EE2C00327`
`.data`	`0x0001d000`	7,032 bytes	3,584 bytes	2.35 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`6BC7B78A92F1FC87ADE9AB4471DD3DA9`
`.detourc`	`0x0001f000`	13,880 bytes	14,336 bytes	2.80 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F66605B48C80D02E34803209F05344E2`
`.detourd`	`0x00023000`	36 bytes	512 bytes	0.16 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5BFBF49F4BAB328D3222C4ABCC54D2B3`
`.rsrc`	`0x00024000`	5,112 bytes	5,120 bytes	3.57 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8E1968BDEE071CAB23FD97C166496CCA`
`.reloc`	`0x00026000`	8,940 bytes	9,216 bytes	6.35 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`E96140E3A0D32DE3794033008980C817`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 5 (4,682 字节)

资源类型	数量	总大小	百分比
SCID	1	7 字节	0.1%
WEVT_TEMPLATE	1	2,802 字节	59.8%
RT_VERSION	2	1,492 字节	31.9%
RT_MANIFEST	1	381 字节	8.1%

证书链分析

▼

证书 Information

产品	GSE
描述	Steamclient.dll
文件版本	08.56.38.63
原始名称	Steamclient.dll
验证状态	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
签名者	GSE
内部名称	Steamclient.dll (win32)
版权	Copyright (C) 2005 GSE

证书链摘要

GSE #1 主要

有效期: 2024-09-15 15:31:04 → 2039-11-01 15:31:04

签名算法: sha256RSA

序列号: 24 37 C5 AD 53 72 4C 8D 40 D7 15 45 A4 8B D1 3A 1B ED 66 1A

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

Chain verification from C=UK, O=GSE, OU=GSE, CN=GSE (serial:206767428835674839382510048150785838928825771546, sha1:57a7b597c09bc66f46cfc186519a1859dc88f1fc) failed: The X.509 certificate provided is self-signed - "Common Name: GSE, Organizational Unit: GSE, Organization: GSE, Country: UK"

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	steamclient_extra_x32.dll
文件类型	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.227.174
数据库版本	2025-10-15 00:00:16 UTC

Steamclient_extra_x32.dll (Steamclient.dll) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别