cd59b4dd810a058a64daf27c76ddc23d5e1051539f49085c8caf2a029cfa095d

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Feb-12 13:16:59
Debug artifacts D:\YandexDiskNEWOneDrive\YandexDisk\C#\csgotm bot\SteamDesktopAuthenticator-1.0.8.2\Steam Desktop Authenticator\obj\x86\Debug\Steam Desktop Authenticator.pdb
Comments Desktop implementation of Steam's mobile authenticator app
CompanyName
FileDescription Steam Desktop Authenticator
FileVersion 1.9.1.0
InternalName Steam Desktop Authenticator.exe
LegalCopyright Copyright @makcstudio 2025
LegalTrademarks
OriginalFilename Steam Desktop Authenticator.exe
ProductName Steam Desktop Authenticator
ProductVersion 1.9.1.0
Assembly Version 1.9.1.0

Plugin Output

Info Matching compiler(s): .NET executable -> Microsoft
Suspicious Strings found in the binary may indicate undesirable behavior: Miscellaneous malware strings:
  • CMD.exe
 Contains domain names:
  • download.microsoft.com
  • github.com
  • https://download.microsoft.com
  • https://download.microsoft.com/download/2/E/6/2E61CFA4-993B-4DD4-91DA-3737CD5CD6E3/vcredist_x86.exe
  • https://github.com
  • https://steamcommunity.com
  • microsoft.com
  • steamcommunity.com
Suspicious VirusTotal score: 2/72 (Scanned on 2025-03-23 20:04:08) CrowdStrike: win/malicious_confidence_60% (W)
MaxSecure: Trojan.Malware.300983.susgen

Hashes

MD5 a2cf7af0c34080f97a77ea31193f230b 🔍
SHA1 cf4be271eb518d96863f56955481e642d7ee973e 🔍
SHA256 cd59b4dd810a058a64daf27c76ddc23d5e1051539f49085c8caf2a029cfa095d 🔍
SHA3 d811fffc5378ba1c77cb0df4012761bbd0e6192f4433f8a187731360f021fe91 🔍
SSDeep 6144:zj2ZhbAfvMT6nw10zIffT6nw10zIffT6nw10zIffT6nw10zIffT6nw10zIffT6n:vv 🔍
Imports Hash f34d5f2d4577ed6d9ceec516c1f5a744 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x80

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 3
TimeDateStamp 2025-Feb-12 13:16:59
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 48.0
SizeOfCode 0x14e800
SizeOfInitializedData 0x1a600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x001507EE (Section: .text)
BaseOfCode 0x2000
BaseOfData 0x152000
ImageBase 0x400000
SectionAlignment 0x2000
FileAlignment 0x200
OperatingSystemVersion 4.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x170000
SizeOfHeaders 0x200
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 d92276aa5c11ceee788225bb9ea4614f 🔍
SHA1 0480223ed71a114f8631674736f943087ef14277 🔍
SHA256 55749190c17e97954856acb720f4544e126204bdc711791a6c397c6d180d24b7 🔍
SHA3 bb081e2beedc30fe72c088ef5c9a5d252a0db19ab8c84c9901b891e0817b78df 🔍
VirtualSize 0x14e7f4
VirtualAddress 0x2000
SizeOfRawData 0x14e800
PointerToRawData 0x200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 4.35125

.rsrc

MD5 7c2691af28ad0888dbcbb43afd39ecfa 🔍
SHA1 eb38629a03b6a28333b90dee0b38b14990ac5112 🔍
SHA256 06f80b28f96a8574d795357f09281755abb9e13a4cf16bce611b744a5c17f8dc 🔍
SHA3 84da417812120a655d00d05080c08afaedb9b9fb67f4367ce1345950fdd87ef3 🔍
VirtualSize 0x1a2a0
VirtualAddress 0x152000
SizeOfRawData 0x1a400
PointerToRawData 0x14ea00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.08217

.reloc

MD5 21006973feb3c26cebed3e82d01b328f 🔍
SHA1 e8944879e2a22a73bd2a585bdfca9585872ae6ca 🔍
SHA256 e676379306cb3df7e89ecdc1354a78ed60dd88198b925c28e5976b4059907f8e 🔍
SHA3 47a9495c350e77685d1e06aa7bf6ca2b456326c7dd11b0502d5fdb5630bb9989 🔍
VirtualSize 0xc
VirtualAddress 0x16e000
SizeOfRawData 0x200
PointerToRawData 0x168e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.0815394

Imports

mscoree.dll _CorExeMain

Delayed Imports

1

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.72987
MD5 3f7871796b2b483bad24ef26902210fd 🔍
SHA1 fd48c3cbd615460fd32f66d0d674aaac331b18d0 🔍
SHA256 a9a8da7e17daa1ce5676041e6c68d013d0602cacb98fca50ae098c3ae26dbd18 🔍
SHA3 f2cb536aef538920b5e4ef254c8c6c28098c6a3e2812d9f230fb58ef3afbde5c 🔍

2

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.68991
MD5 69f7c731dc646d981a6c91c16ba958f3 🔍
SHA1 094e439b3891074d2a1f7b7e915043dc486cda39 🔍
SHA256 6bed0c3c7a2b1f1ece51ac67d69d59df4d3b6a4b968b32988892fb3b27327a19 🔍
SHA3 583245d7d14e98849aa261c5759eec316497b32c0c14b7237be7ec76b62068c3 🔍

3

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x162f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.81587
Detected Filetype PNG graphic file
MD5 bf137cc76b41544f48e9ff72d1fd7d04 🔍
SHA1 016f1c8024bc2798195a837c1881c13d23ae8467 🔍
SHA256 b7d77a75615bffd066f5a9d65c8512b6bce4ba42b0371bbd61a96249ed9fdad1 🔍
SHA3 a0f7d598a5db04d6304e7c20386d8ba5d5942e12f203c77c96803fad7bf9005f 🔍

4

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.2112
MD5 e71661e8e1eaf9d66a18a11018148a98 🔍
SHA1 9df438e74dbbd09f6a25733f72252c4fbbc4d0b4 🔍
SHA256 e2e6fcf797c4c60127056233cb62fd39c41bb7ad0e1753cf323b657c74b60f10 🔍
SHA3 89352d8955a1fb2525bffe511cfafd80ef98bcdec429fa65a9fb2196c3360592 🔍

5

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x246f
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.89437
Detected Filetype PNG graphic file
MD5 d0e01a3000e7b9f648d0e200483d4cdc 🔍
SHA1 9bbfdcb1a63bf6a5c4e1234ae24cb2630587dbb2 🔍
SHA256 783f4e83bd26f0df77fef9d7936743d1cb6a532a9f262c3cf7249732bf647df6 🔍
SHA3 aee6edb140d9865d666e6ebbb7b41b6418c5d1bc93364adfbdc14c6b43d629fe 🔍

6

Type RT_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.9164
MD5 b5a21ea5278163cb073a88d2ea1b38b4 🔍
SHA1 c84b670ed2fc2f8afbcd8598f9ded020813af9a2 🔍
SHA256 bb99056712da545f06a8be61589aec57a82f13720a292183a9696893989c0269 🔍
SHA3 13ffcbdf2e26448e017b02998c0e6aba800685bc57358bc868067e7057c38d87 🔍

32512

Type RT_GROUP_ICON
Language UNKNOWN
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.68735
Detected Filetype Icon file
MD5 5a0d50c3ed8d343f99cc8b9fb4b7dee3 🔍
SHA1 570a3bce0bdc74a57609da125b74ec2557ccec13 🔍
SHA256 91e3c075ef585e0256e0b3f5943d9f35bf242865d33997b298798eea4cf6c931 🔍
SHA3 c0cc1de85884564a96ae44ac897debbf8dee8a0aa85636e28224ca8925efa5e3 🔍

1 (#2)

Type RT_VERSION
Language UNKNOWN
Codepage UNKNOWN
Size 0x434
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.35058
MD5 a73c646c8b07ee8763d02fbb9c637fcb 🔍
SHA1 1264a042dd542712aa29649642cbc19c863c20d3 🔍
SHA256 37454528e6ea8d57fcea6efec179a0833bcb5527c810ffc0e361e5d5ae9f4527 🔍
SHA3 a905cceeecbb115dd6f6380dfc3ee075d84a83b82db7e4e961af46da62943d39 🔍

1 (#3)

Type RT_MANIFEST
Language UNKNOWN
Codepage UNKNOWN
Size 0x1ea
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00112
MD5 b7db84991f23a680df8e95af8946f9c9 🔍
SHA1 cac699787884fb993ced8d7dc47b7c522c7bc734 🔍
SHA256 539dc26a14b6277e87348594ab7d6e932d16aabb18612d77f29fe421a9f1d46a 🔍
SHA3 4f72877413d13a67b52b292a8524e2c43a15253c26aaf6b5d0166a65bc615cff 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 1.9.1.0
ProductVersion 1.9.1.0
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
Comments Desktop implementation of Steam's mobile authenticator app
CompanyName
FileDescription Steam Desktop Authenticator
FileVersion (#2) 1.9.1.0
InternalName Steam Desktop Authenticator.exe
LegalCopyright Copyright @makcstudio 2025
LegalTrademarks
OriginalFilename Steam Desktop Authenticator.exe
ProductName Steam Desktop Authenticator
ProductVersion (#2) 1.9.1.0
Assembly Version 1.9.1.0
Resource LangID UNKNOWN

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2025-Feb-12 13:16:59
Version 0.0
SizeofData 284
AddressOfRawData 0x150680
PointerToRawData 0x14e880
Referenced File D:\YandexDiskNEWOneDrive\YandexDisk\C#\csgotm bot\SteamDesktopAuthenticator-1.0.8.2\Steam Desktop Authenticator\obj\x86\Debug\Steam Desktop Authenticator.pdb

TLS Callbacks

Load Configuration

RICH Header

Errors

Leave a comment

No comments yet.