filenameSteam.dll
size329728 (0x50800)
md594d9e620da6bd5fe5a4d20aebb15ec6d
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Ramnit-6532 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1492102222
13121022146
1322102257
110507273
123507279
10127
1382102229
146210221
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4a0fe93e
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x2ce00
SizeOfInitializedData0x23600
SizeOfUninitializedData0
AddressOfEntryPoint0x1fa27
BaseOfCode0x1000
BaseOfData0x2e000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x55000
SizeOfHeaders0x400
CheckSum0x5b2fa
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x2cd790x2ce00R-X CODE
.rdata0x2e0000xf20f0xf400R-- IDATA
.data0x3e0000xd9040xb600RW- IDATA
.rsrc0x4c0000x3fb40x4000R-- IDATA
.reloc0x500000x4bd00x4c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x3b6c00x1b4f
IMPORT0x3abd00x64
RESOURCE0x4c0000x3fb4
EXCEPTION00
SECURITY00
BASERELOC0x500000x364c
DEBUG0x2e2600x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x385780x40
Bound_IAT00
IAT0x2e0000x1e0
Delay_IAT00
CLR_Header00
typenamesizecp
CONFIGDATACLIENTAPP_FILENAME121252
CONFIGDATAGENERALDIRECTORYSERVER_IPADDRPORTS1191252
CONFIGDATAGENERALDIRECTORYSERVER_IPADDRPORTS141252
ICON#17441252
ICON#213841252
ICON#322161252
ICON#473361252
STRING#8769561252
STRING#87710801252
STRING#8783481252
GROUP_ICON#102641252
VERSION#17921252
MANIFEST#23461252
idlangstring
140001033Steam Library has not been initialized
140011033App provided invalid TSteamError pointer to Steam API
140021033Steam library already initialized
140031033App provided bad argument to Steam API
140041033Unknown internal error occurred
140051033Bad launch configuration
140061033Not found
140071033Access denied
140081033User's ticket has expired
140091033Not logged in
140101033The specified resource already exists
140111033Already subscribed
140121033Not subscribed
140131033Must be an account admin
140141033This operation cannot be performed while the Application's FS is mounted
140151033Invalid handle value
140161033The command could not be completed
140171033The command was aborted
140181033Failed to resize the cache file
140191033The destination folder must be empty
140201033Login failed. This account does not exist, or the password is incorrect.
140211033Filesystem configuration error
140221033Unknown filesystem error
140231033File seek error
140241033Handles Exhausted
140251033Read failure
140261033End of file
140271033Non-UserConfig file cannot be written to
140281033Steam Filesystem calls have not been enabled
140291033Steam Logging calls have not been enabled
140301033Steam UserID Verification calls have not been enabled
140311033Steam Account calls have not been enabled
140321033The mount path does not exist
140331033The local Steam Service is not running
140341033Connection to the local Steam Service lost
140351033An operation is currently pending on this Account
module_namehintordfunction_name
USER32.dll504MessageBoxA
ADVAPI32.dll554RegCloseKey
ADVAPI32.dll631RegSetValueExA
ADVAPI32.dll615RegQueryValueExA
ADVAPI32.dll562RegCreateKeyExA
ADVAPI32.dll602RegOpenKeyExA
SHELL32.dll7CommandLineToArgvW
KERNEL32.dll85CompareStringW
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll82CompareStringA
KERNEL32.dll547GetProcessHeap
KERNEL32.dll540GetPrivateProfileStringA
KERNEL32.dll487GetLocalTime
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll260ExitProcess
KERNEL32.dll368GetCommandLineW
KERNEL32.dll332FreeLibrary
KERNEL32.dll819OpenProcess
KERNEL32.dll631GetVolumeInformationA
KERNEL32.dll875ReadProcessMemory
KERNEL32.dll148CreateProcessA
KERNEL32.dll108CreateDirectoryA
KERNEL32.dll544GetProcAddress
KERNEL32.dll983SetFileAttributesA
KERNEL32.dll753LoadLibraryA
KERNEL32.dll976SetEnvironmentVariableA
KERNEL32.dll500GetModuleFileNameA
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll1114VirtualProtect
KERNEL32.dll423GetCurrentDirectoryA
KERNEL32.dll67CloseHandle
KERNEL32.dll120CreateFileA
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll589GetSystemTime
KERNEL32.dll428GetCurrentThread
KERNEL32.dll581GetSystemDirectoryA
KERNEL32.dll692InitializeCriticalSection
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll1116VirtualQuery
KERNEL32.dll1004SetLastError
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll698InterlockedCompareExchange
KERNEL32.dll909ResumeThread
KERNEL32.dll322FlushInstructionCache
KERNEL32.dll604GetThreadContext
KERNEL32.dll1030SetThreadContext
KERNEL32.dll486GetLastError
KERNEL32.dll1063SuspendThread
KERNEL32.dll1069TerminateProcess
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll673HeapFree
KERNEL32.dll669HeapAlloc
KERNEL32.dll192DeleteFileA
KERNEL32.dll272FileTimeToSystemTime
KERNEL32.dll271FileTimeToLocalFileTime
KERNEL32.dll285FindFirstFileA
KERNEL32.dll302FindNextFileA
KERNEL32.dll281FindClose
KERNEL32.dll442GetDriveTypeA
KERNEL32.dll476GetFullPathNameA
KERNEL32.dll676HeapReAlloc
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll505GetModuleHandleW
KERNEL32.dll1057Sleep
KERNEL32.dll367GetCommandLineA
KERNEL32.dll858RaiseException
KERNEL32.dll914RtlUnwind
KERNEL32.dll1076TlsGetValue
KERNEL32.dll1074TlsAlloc
KERNEL32.dll1077TlsSetValue
KERNEL32.dll1075TlsFree
KERNEL32.dll704InterlockedIncrement
KERNEL32.dll700InterlockedDecrement
KERNEL32.dll1000SetHandleCount
KERNEL32.dll571GetStdHandle
KERNEL32.dll471GetFileType
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll1165WriteFile
KERNEL32.dll387GetConsoleCP
KERNEL32.dll405GetConsoleMode
KERNEL32.dll321FlushFileBuffers
KERNEL32.dll671HeapCreate
KERNEL32.dll672HeapDestroy
KERNEL32.dll1111VirtualFree
KERNEL32.dll347GetCPInfo
KERNEL32.dll338GetACP
KERNEL32.dll531GetOEMCP
KERNEL32.dll731IsValidCodePage
KERNEL32.dll737LCMapStringA
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll739LCMapStringW
KERNEL32.dll991SetFilePointer
KERNEL32.dll872ReadFile
KERNEL32.dll678HeapSize
KERNEL32.dll457GetFileAttributesA
KERNEL32.dll1020SetStdHandle
KERNEL32.dll693InitializeCriticalSectionAndSpinCount
KERNEL32.dll330FreeEnvironmentStringsA
KERNEL32.dll447GetEnvironmentStrings
KERNEL32.dll331FreeEnvironmentStringsW
KERNEL32.dll449GetEnvironmentStringsW
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll614GetTickCount
KERNEL32.dll1154WriteConsoleA
KERNEL32.dll409GetConsoleOutputCP
KERNEL32.dll1164WriteConsoleW
KERNEL32.dll573GetStringTypeA
KERNEL32.dll576GetStringTypeW
KERNEL32.dll488GetLocaleInfoA
KERNEL32.dll619GetTimeZoneInformation
KERNEL32.dll973SetEndOfFile
ordentry_vafunction_name
10xacf0CreateInterface
20xccd0InternalSteamNumClientsConnectedToEngine
30xcd00InternalSteamShouldShutdownEngine2
40xb3e0SteamAbortCall
50xc600SteamAbortOngoingUserIDTicketValidation
60xbe30SteamAckSubscriptionReceipt
70xb430SteamBlockingCall
80xb5f0SteamChangeAccountName
90xb620SteamChangeEmailAddress
100xb650SteamChangeForgottenPassword
110xcd60SteamChangeOfflineStatus
120xb680SteamChangePassword
130xb6b0SteamChangePersonalQA
140x9920SteamCheckAppOwnership
150xb260SteamCleanup
160xccb0SteamClearError
170x6ed0SteamCloseFile
180xb590SteamCreateAccount
190xa860SteamCreateCachePreloaders
200xb4d0SteamCreateLogContext
210xce70SteamDecryptDataForThisMachine
220xb5c0SteamDeleteAccount
230xcea0SteamEncryptDataForThisMachine
240x88f0SteamEnumerateApp
250x8ba0SteamEnumerateAppDependency
260xa400SteamEnumerateAppIcon
270x8d30SteamEnumerateAppLaunchOption
280xa4a0SteamEnumerateAppVersion
290xb6e0SteamEnumerateSubscription
300xb730SteamEnumerateSubscriptionDiscount
310xb760SteamEnumerateSubscriptionDiscountQualifier
320xa6e0SteamFindApp
330x75b0SteamFindClose
340x6fa0SteamFindFirst
350x72c0SteamFindNext
360x154c0SteamFindServersGetErrorString
370xced0SteamFindServersIterateServer
380xd1a0SteamFindServersNumServers
390xa900SteamFlushCache
400x78a0SteamFlushFile
410x8580SteamForgetAllHints
420xb790SteamGenerateSuggestedAccountNames
430xb7c0SteamGetAccountStatus
440xac90SteamGetAppCacheSize
450xa710SteamGetAppDependencies
460xa740SteamGetAppDir
470xa350SteamGetAppIds
480x9c60SteamGetAppPurchaseCountry
490x9fc0SteamGetAppStats
500xa270SteamGetAppUpdateStats
510x9cd0SteamGetAppUserDefinedInfo
520xa770SteamGetAppUserDefinedRecord
530xac60SteamGetCacheDecryptionKey
540xaae0SteamGetCacheDefaultDirectory
550x8670SteamGetCacheFilePath
560xd240SteamGetContentServerInfo
570xb7f0SteamGetCurrentEmailAddress
580xce40SteamGetEncryptedNewValveCDKey
590xbe90SteamGetEncryptedUserIDTicket
600xc1b0SteamGetEncryptionKeyToSendToNewClient
610xcd30SteamGetLocalClientVersion
620x8060SteamGetLocalFileCopy
630xb820SteamGetNumAccountsWithEmailAddress
640xcd90SteamGetOfflineStatus
650xa4f0SteamGetSponsorUrl
660xb850SteamGetSubscriptionExtendedInfo
670xb880SteamGetSubscriptionIds
680xb8b0SteamGetSubscriptionPurchaseCountry
690xb8e0SteamGetSubscriptionReceipt
700xb910SteamGetSubscriptionStats
710xa300SteamGetTotalUpdateStats
720xb940SteamGetUser
730xb9c0SteamGetUserType
740xb2b0SteamGetVersion
750x7930SteamGetc
760x8520SteamHintResourceNeed
770xc090SteamInitializeUserIDTicketValidator
780xa680SteamInsertAppDependency
790xb9f0SteamIsAccountNameInUse
800x9ac0SteamIsAppSubscribed
810xa8b0SteamIsCacheLoadingEnabled
820x82a0SteamIsFileImmediatelyAvailable
830xac00SteamIsFileNeededByCache
840xba20SteamIsLoggedIn
850xbab0SteamIsSecureComputer
860x9950SteamIsSubscribed
870x9270SteamLaunchApp
880xa950SteamLoadCacheFromDir
890xac30SteamLoadFileToCache
900xb500SteamLog
910xb560SteamLogResourceLoadFinished
920xb530SteamLogResourceLoadStarted
930xbae0SteamLogin
940xbb10SteamLogout
950x6950SteamMountAppFilesystem
960x6550SteamMountFilesystem
970xa560SteamMoveApp
980xbe60SteamNumAppsRunning
990x6dc0SteamOpenFile
1000x6da0SteamOpenFileEx
1010x7a60SteamOpenTmpFile
1020xc680SteamOptionalCleanUpAfterClientHasDisconnected
1030x85d0SteamPauseCachePreloading
1040x8410SteamPrintFile
1050xb370SteamProcessCall
1060xc4e0SteamProcessOngoingUserIDTicketValidation
1070x7ab0SteamPutc
1080x6de0SteamReadFile
1090xbb40SteamRefreshAccountInfo
1100xbb70SteamRefreshAccountInfoEx
1110xbba0SteamRefreshLogin
1120x8e60SteamRefreshMinimumFootprintFiles
1130xa6b0SteamRemoveAppDependency
1140xabd0SteamRepairOrDecryptCaches
1150xbbd0SteamRequestAccountsByCdKeyEmail
1160xbc00SteamRequestAccountsByEmailAddressEmail
1170xbc30SteamRequestEmailAddressVerificationEmail
1180xbc60SteamRequestForgottenPasswordEmail
1190x8620SteamResumeCachePreloading
1200x7b10SteamSeekFile
1210xa5b0SteamSetAppCacheSize
1220xa600SteamSetAppVersion
1230xa9f0SteamSetCacheDefaultDirectory
1240xb480SteamSetMaxStallCount
1250xd270SteamSetNotificationCallback
1260xbc90SteamSetUser
1270x84d0SteamSetvBuf
1280xb340SteamShutdownEngine
1290xc130SteamShutdownUserIDTicketValidator
1300x7f00SteamSizeFile
1310xb030SteamStartEngine
1320xaa40SteamStartLoadingCache
1330xc440SteamStartValidatingNewValveCDKey
1340xc240SteamStartValidatingUserIDTicket
1350xb060SteamStartup
1360x7680SteamStat
1370xaa90SteamStopLoadingCache
1380xbd10SteamSubscribe
1390x7db0SteamTellFile
1400xcde0SteamUninstall
1410x6c90SteamUnmountAppFilesystem
1420x6900SteamUnmountFilesystem
1430xbd40SteamUnsubscribe
1440xbd70SteamUpdateAccountBillingInfo
1450xbda0SteamUpdateSubscriptionBillingInfo
1460xbdd0SteamVerifyEmailAddress
1470xbe00SteamVerifyPassword
1480xa450SteamWaitForAppReadyToLaunch
1490xa7c0SteamWaitForResources
1500xd2a0SteamWasBlobRegistryDeleted
1510xce10SteamWeakVerifyNewValveCDKey
1520x7c80SteamWriteFile
1530xcc30SteamWriteMiniDumpFromAssert
1540xcc60SteamWriteMiniDumpSetComment
1550xcc90SteamWriteMiniDumpUsingExceptionInfo
1560xcc90SteamWriteMiniDumpUsingExceptionInfoWithBuildId
1570xade0_f
1580xa810?SteamForgetAllHints@@YAHPBDPAUTSteamError@@@Z
1590xaba0?SteamGetCacheFilePath@@YAHXZ
1600xa650?SteamNumAppsRunning@@YAHXZ
1610xa9a0?SteamPauseCachePreloading@@YAHPBDPAUTSteamError@@@Z
1620xab50?SteamResumeCachePreloading@@YAHPBDPAUTSteamError@@@Z
5010xe970Steam_GetAppId
module_nameSteam.dll
flags0
timestamp2009-05-17 10:38:48
version0.0
ordinal_base1
nFunctions501
nNames163
Names(163)0x3bebc
Functions(501)0x3b6e8
NameOrdinals(163)0x3c148

StringTable 040904b0

CompanyNameValve Corporation
LegalCopyright© Copyright 2000-2003 Valve Corporation All rights reserved.
ProductNameSteam
ProductVersion1.0.0.0
FileDescriptionSteam Client Engine
FileVersion2.0.0.0
OriginalFilenameSteam.dll
Source Control ID248965

VS_FIXEDFILEINFO

FileVersion2.0.0.0
ProductVersion1.0.0.0
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0329728DLL05/17/2009 10:38:54#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK