Gridinsoft Logo
File Icon

SteamtoolsSetup.exe Trojan Heuristic Analysis

Updated 3 months ago
Checked by Malaware Check
SteamtoolsSetup.exe

Technical Analysis

File Name SteamtoolsSetup.exe
File Type
PE32 executable (console) Intel 80386, for MS Windows
Scanner Version 1.0.209.174
Database Version 2025-03-02 08:00:28 UTC
⚠

Trojan.Heur!.00014021

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
857,784
File Size (bytes)
2025-03-02
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
93ef55f275e12608889ba7c2e908e6d8
SHA1
969a31955b49a8bd82567fa582b3f29528ceb6f1
SHA256
7af03f9f3e8d96c931d69b1ecd531ee976c6e504d678bbf44f553ffea8943291
SHA512
fa3dfb36608777a5942cc3ffdb5d1599efd0420dbd436def11d860312b6dff64af6d9c3022964c78eaf34c3173a8907a3b58e88fda8f83a4e8e4063287ba7c53
ImpHash
daf1a87798de09fac3c1ad9d96de57bb

PE Analysis

Basic Information

▼
Icon
Hash: 407ae44b66a7991466de908519e1a11e
Fuzzy: 568f1e03e786d89003c091c6a9567692
dHash: 6c868b0dc1aea6d9
Image Base 0x00400000
Entry Point 0x00473500
Compilation Time 2024-11-24 06:36:46
Checksum 0x000d4eb0 (Actual: 0x000d4eb0)
OS Version 6.0
PEiD Signatures PE32 executable (console) Intel 80386, for MS Windows
PDB Path G:\AllCode\winmain\SteamtoolsSetup.pdb
Digital Signature OK
Imports 7 libraries
CRYPT32, WLDAP32, WS2_32, KERNEL32, ADVAPI32, SHELL32, ole32
Exports 0 functions
Resources 9 Resources
Sections 5 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 643,236 bytes 643,584 bytes 6.58 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 9B9622D298C5BA4A3FCDCD0978B8D9D5
.rdata 0x0009f000 132,234 bytes 132,608 bytes 5.81 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 24AB34ACDB2AB1076F03194FD5C379C1
.data 0x000c0000 10,316 bytes 6,144 bytes 3.67 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE A97DF2EB7D4F6E69368F36FD8CF77C32
.K,) 0x000c3000 3,824 bytes 4,096 bytes 7.21 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 93E74609BE95A5BDEC2402B70BF9B5A9
.rsrc 0x000c4000 43,893 bytes 44,032 bytes 1.92 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D5FFAF8F16202E740478374DEED9F868
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 9 (43,373 bytes)
Resource Type Count Total Size Percentage
RT_ICON 7 42,888 bytes
98.9%
RT_GROUP_ICON 1 104 bytes
0.2%
RT_MANIFEST 1 381 bytes
0.9%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

OK

Trojan.Heur!.00014021 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.00014021 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware