Steamclient loader 64 exe (Goldberg Emulator) Goldberg Emulator 文件恶意软件分析

Steamclient_loader_64.exe (Goldberg Emulator) 文件分析

更新于 9 months ago

检查者 Malware Check

steamclient_loader_64.exe

哈希类型	值	操作
MD5	fe1eeadb238d21806759dc319cd24af0
SHA1	effa20a8cae3ebfb9794a6bb8fa72708196c2adf
SHA256	c15ac73622dd865c0338c8a67638278dec78b1f6fd9ecccc60871ba0e2048746
SHA512	9106726e083c5d096700db1dbb4b70988ed2a146673d347cf2d8e4fad2fc4d59125c69308bf0e20c2b397de4b8579415907d18fb2d20b1384dac5f6629350da8
ImpHash	f416d8fa23e102f0151cae3c8932a467

哈希类型

值

操作

MD5

fe1eeadb238d21806759dc319cd24af0

SHA1

effa20a8cae3ebfb9794a6bb8fa72708196c2adf

SHA256

c15ac73622dd865c0338c8a67638278dec78b1f6fd9ecccc60871ba0e2048746

SHA512

9106726e083c5d096700db1dbb4b70988ed2a146673d347cf2d8e4fad2fc4d59125c69308bf0e20c2b397de4b8579415907d18fb2d20b1384dac5f6629350da8

ImpHash

f416d8fa23e102f0151cae3c8932a467

PE 分析

基本信息

▼

映像基址	`0x140000000`
入口点	`0x140015cb8`
编译时间	2024-02-13 00:48:48
校验和	0x0005539c (实际: 0x0005539c)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
数字签名	Chain verification from CN=Goldberg Emu, O=Goldberg Emu (serial:449071789797473894870607371167978886547606995013, sha1:70955ce8695a8d7c5bcdb5f7f560edbf313280f0) failed: The X.509 certificate provided is self-signed - "Common Name: Goldberg Emu, Organization: Goldberg Emu"
导入	3 库 KERNEL32, USER32, ADVAPI32
导出	0 函数
资源	3 资源
节	7 节

版本信息

▼

LegalCopyright	Copyright (C) 2021 Goldberg Emulator
InternalName	Goldberg Emulator (win64)
FileVersion	08.56.38.63
CompanyName	Goldberg Emulator
ProductVersion	01.00.00.02
FileDescription	Goldberg Emulator
Source Control ID	8563863
OriginalFilename	steam.exe
ProductName	Goldberg Emulator
Translation	0x0409 0x04b0
CompanyName	Goldberg Emulator
FileDescription	Goldberg Emulator
FileVersion	1, 0, 0, 2
InternalName	Goldberg Emulator
LegalCopyright	Copyright (C) 2021 Goldberg Emulator
OriginalFilename	steam.exe
ProductName	Goldberg Emulator
ProductVersion	1, 0, 0, 2
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	224,256 bytes	224,256 bytes	6.44 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`15BAD01C81DFCD4A04A0DA076C6E750D`
`.rdata`	`0x00038000`	81,314 bytes	81,408 bytes	4.96 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`657B8AA18FD098021E57DA01B342BABC`
`.data`	`0x0004c000`	78,652 bytes	6,144 bytes	3.06 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`59DF05C75438E13C6124B85A0B0284AE`
`.pdata`	`0x00060000`	12,600 bytes	12,800 bytes	5.48 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A0C1FF2FC703412777F5B7B1B5881C04`
`_RDATA`	`0x00064000`	348 bytes	512 bytes	3.33 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`53FB686DA8A1E10C2C1D1E697570D1B8`
`.rsrc`	`0x00065000`	1,904 bytes	2,048 bytes	3.20 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E73054C14E03269E3F252521A3C216FA`
`.reloc`	`0x00066000`	2,684 bytes	3,072 bytes	5.17 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`B2DC858000A3CE97B29B2AF99D35D5CA`

资源分析

▼

资源总数: 3 (1,659 字节)

资源类型	数量	总大小	百分比
SCID	1	7 字节	0.4%
RT_VERSION	2	1,652 字节	99.6%

证书链分析

▼

证书 Information

产品	Goldberg Emulator
描述	Goldberg Emulator
文件版本	08.56.38.63
原始名称	steam.exe
验证状态	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
签名者	Goldberg Emu
内部名称	Goldberg Emulator (win64)
版权	Copyright (C) 2021 Goldberg Emulator

证书链摘要

Goldberg Emu #1 主要

有效期: 2024-02-13 00:48:48 → 2039-03-31 00:48:48

签名算法: sha256RSA

序列号: 4E A9 13 54 0D 2C 89 67 1B 1B A5 70 34 E2 26 57 74 A2 00 45

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

Chain verification from CN=Goldberg Emu, O=Goldberg Emu (serial:449071789797473894870607371167978886547606995013, sha1:70955ce8695a8d7c5bcdb5f7f560edbf313280f0) failed: The X.509 certificate provided is self-signed - "Common Name: Goldberg Emu, Organization: Goldberg Emu"

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	steamclient_loader_64.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.194.174
数据库版本	2024-10-26 07:00:28 UTC

Steamclient_loader_64.exe (Goldberg Emulator) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别