The WTF exe (Steam Client Bootstrapper) Valve Corporation File Malware Analysis

The WTF.exe (Steam Client Bootstrapper) File Analysis

Updated 2 days ago

Checked by Malware Check

WTF.exe

Hash Type	Value	Action
MD5	5289e645d61de1dd7259a652b9548056
SHA1	938663d2fc11a2d26ea4bce960c9551bf82b3beb
SHA256	d8d54e89502bc0d38ced421d370399e423c0647329e81761c47251b89276f23b
SHA512	2c2665cc7c7264e6b55fd6a541eaacece1f2257f7478e6c4fcba44a5bd5a8af9789022fe9534ac6201eb1ebea2aa6522115853b5bceefc28b2df363c5dd37adf
ImpHash	5aaf18d7bda8e5061d9348ea85b6c75e

Hash Type

Value

Action

MD5

5289e645d61de1dd7259a652b9548056

SHA1

938663d2fc11a2d26ea4bce960c9551bf82b3beb

SHA256

d8d54e89502bc0d38ced421d370399e423c0647329e81761c47251b89276f23b

SHA512

2c2665cc7c7264e6b55fd6a541eaacece1f2257f7478e6c4fcba44a5bd5a8af9789022fe9534ac6201eb1ebea2aa6522115853b5bceefc28b2df363c5dd37adf

ImpHash

5aaf18d7bda8e5061d9348ea85b6c75e

PE Analysis

Basic Information

▼

Icon	Hash: 6b0eb35e879c18be5945b34b16d95b15 Fuzzy: 7bac9fc98f98ee07f69205dc00e77b13 dHash: 55f0e0d0e8686069
Image Base	`0x00400000`
Entry Point	`0x00689944`
Compilation Time	2019-12-08 21:13:49
Checksum	0x0040310f (Actual: 0x0040310f)
OS Version	5.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	12 libraries
Exports	1 functions
Resources	68 Resources
Sections	11 Sections

Version Information

▼

CompanyName	Valve Corporation
FileDescription	Steam Client Bootstrapper
FileVersion	1.0.0.0
InternalName	steamcmd
LegalCopyright	Copyright (C) 2010 Valve Corporation
OriginalFilename	steam.exe
ProductName	Steam Client Bootstrapper
ProductVersion	1.0.0.0
Comments	Modified by an unpaid evaluation copy of Resource Tuner 2. http://www.heaventools.com
Translation	0x0409 0x04e4

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	2,648,152 bytes	2,648,576 bytes	6.49 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2421BE6CA74146CA1A1E91C057D183C4`
`.itext`	`0x00288000`	6,620 bytes	6,656 bytes	6.34 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`54F28CA34EFF2BBC905AEB6D1A688592`
`.data`	`0x0028a000`	40,128 bytes	40,448 bytes	6.09 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`585FF77C05C20E7EA0F9322F7D78970D`
`.bss`	`0x00294000`	104,108 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x002ae000`	15,132 bytes	15,360 bytes	5.27 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`151E7E710AE2BCF9867A5C37007B4941`
`.didata`	`0x002b2000`	2,504 bytes	2,560 bytes	4.21 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`C095DA5C87CBF4E4C0240CB4FBC517DD`
`.edata`	`0x002b3000`	94 bytes	512 bytes	1.10 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`09BE0D560308A8FF1A0340008167F266`
`.tls`	`0x002b4000`	76 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x002b5000`	24 bytes	512 bytes	0.21 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D84660330696872391413C0F876A4063`
`.reloc`	`0x002b6000`	224,448 bytes	224,768 bytes	6.73 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`B9BFC64D8E853D5DEF8E768B3E401CAE`
`.rsrc`	`0x002ed000`	1,204,216 bytes	1,204,224 bytes	6.91 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A50C3FE380E65BC033F34CCF308D2273`

Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 68 (1,200,223 bytes)

Resource Type	Count	Total Size	Percentage
VCLSTYLE	1	78,911 bytes	6.6%
WAVE	1	634,316 bytes	52.8%
RT_CURSOR	8	2,464 bytes	0.2%
RT_BITMAP	12	4,964 bytes	0.4%
RT_ICON	1	22,855 bytes	1.9%
RT_STRING	28	25,200 bytes	2.1%
RT_RCDATA	6	429,626 bytes	35.8%
RT_GROUP_CURSOR	8	160 bytes	0%
RT_GROUP_ICON	1	20 bytes	0%
RT_VERSION	1	984 bytes	0.1%
RT_MANIFEST	1	723 bytes	0.1%

Certificate Chain Analysis

▼

Certificate Information

Product	Steam Client Bootstrapper
Description	Steam Client Bootstrapper
File Version	1.0.0.0
Original Name	steam.exe
Internal Name	steamcmd
Copyright	Copyright (C) 2010 Valve Corporation

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	WTF.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.219.174
Database Version	2025-06-25 17:00:17 UTC

The WTF.exe (Steam Client Bootstrapper) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification