GTA5[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

GTA5.exe
Size

57.6MB
MD5

0f8421ba19d430b7e8cdc6c75b3d0f45
SHA1

d423086fd7a7721b8be77cfb9a4f8826784b284b
SHA256

06b59a02747c3d9f74c6c3621756387f4d85b148a882f4a6735a03383875c1f9
SHA512

e3d373297b3b85c4f974c9f4d685266447660efab858bb74e553bb6144f3f137422df129b73eb96e26398a3375cf68c3e16d36943e37bca9ea11cd1c2a186d7d
SSDEEP

1572864:OQtoGCR3G+NOp7SPbSs+3auzpUI16iNEemLq:OkoGGG+NOR/sJIMiNEeOq

Score

N/A

Malware Config

Signatures

Files

GTA5.exe
.exe windows x64

1e9fc1ca4336145ef5f3b25fa69fc55a

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:65:f4:57:25:17:cb:cc:aa:8b:37:76:58:0a:8d:3d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/02/2020, 00:00

Not After

17/02/2023, 12:00

Subject

CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

cb:d6:b6:c2:4f:2c:16:f2:2c:a1:ef:b7:f6:fc:86:8d:6b:8e:30:e5
Signer

Actual PE Digest

cb:d6:b6:c2:4f:2c:16:f2:2c:a1:ef:b7:f6:fc:86:8d:6b:8e:30:e5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

18/04/2022, 14:56
Valid: true

Chain 1

CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetFileInformationByHandle
SetStdHandle
ReadConsoleW
CreateSemaphoreW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
FlushFileBuffers
GetCurrentDirectoryW
GetConsoleMode
GetConsoleCP
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsDebuggerPresent
IsProcessorFeaturePresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStartupInfoW
GetFileType
GetStdHandle
SetLastError
FindFirstFileExW
HeapReAlloc
PeekNamedPipe
HeapSize
GetFullPathNameA
GetDriveTypeW
GetTimeZoneInformation
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
DecodePointer
EncodePointer
GetLocaleInfoW
ResetEvent
GetFileTime
VerifyVersionInfoW
VerSetConditionMask
InitializeCriticalSection
CreateFileA
GetOverlappedResult
GetSystemDefaultUILanguage
VerifyVersionInfoA
OutputDebugStringA
SetThreadExecutionState
LocalFree
LocalAlloc
MoveFileExW
GetFileAttributesExW
SetFileAttributesW
RemoveDirectoryW
GetTempPathW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFullPathNameW
OutputDebugStringW
LoadLibraryW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocalTime
SetFileTime
SetFilePointerEx
SetEndOfFile
TerminateProcess
WerSetFlags
QueryPerformanceCounter
CreateDirectoryW
GetModuleHandleW
GetModuleFileNameW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
WriteConsoleW
SetEnvironmentVariableA
GetProcessId
CreateProcessW
GetSystemDirectoryW
lstrcmpA
SetNamedPipeHandleState
LoadLibraryExW
CreateSemaphoreA
CreateMutexA
GetSystemInfo
ReleaseMutex
ReleaseSemaphore
SetEvent
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResumeThread
GetLastError
GetThreadPriority
SetThreadPriorityBoost
SetThreadPriority
GetThreadId
GetCurrentThreadId
CreateThread
GetProcessAffinityMask
GetProcessHeap
HeapFree
HeapAlloc
TransactNamedPipe
GetConsoleWindow
GetModuleHandleExW
GetModuleHandleA
VirtualQueryEx
VirtualProtect
OpenProcess
GetCurrentProcessId
ExitProcess
WriteFile
CloseHandle
GetModuleFileNameA
GetCommandLineA
CreateFileW
CreateToolhelp32Snapshot
Process32First
Process32Next
GetDiskFreeSpaceExA
DeleteFileW
GetFileSize
ReadFile
FindClose
lstrcpyA
lstrcpyW
lstrcatW
lstrlenA
GetFileAttributesW
FindFirstFileW
FindNextFileW
MultiByteToWideChar
WaitForMultipleObjects
GetDiskFreeSpaceExW
FindFirstChangeNotificationA
FindNextChangeNotification
FindCloseChangeNotification
WaitForSingleObject
FreeLibrary
GetProcAddress
GlobalMemoryStatusEx
GetSystemFirmwareTable
SetHandleInformation
GetNativeSystemInfo
CreatePipe
LoadLibraryA
CreateProcessA
GetEnvironmentVariableA
GetWindowsDirectoryA
GetVolumeInformationA
QueryPerformanceFrequency
GetVersionExA
WideCharToMultiByte
GetUserDefaultUILanguage
GetSystemDefaultLocaleName
GetWriteWatch
ResetWriteWatch
GetCurrentProcess
RaiseException
GetCurrentThread
GetThreadContext
GetSystemTimeAsFileTime
GetModuleHandleExA
DeleteFileA
Sleep
SetFilePointer
CreateEventA
VirtualAlloc
VirtualFree
WaitNamedPipeW
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQuery

user32

ShowWindow
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
RegisterRawInputDevices
GetRawInputData
ClientToScreen
GetCursorPos
SetCursorPos
ShowCursor
MapVirtualKeyExW
MapVirtualKeyW
MapVirtualKeyA
GetKeyState
GetDoubleClickTime
SendMessageW
GetKeyboardLayout
GetKeyboardLayoutList
UnloadKeyboardLayout
ActivateKeyboardLayout
LoadKeyboardLayoutW
LockSetForegroundWindow
LoadCursorA
ClipCursor
GetForegroundWindow
ReleaseCapture
SetCapture
GetCapture
CreateWindowExW
RegisterClassW
PostMessageA
PeekMessageW
DispatchMessageW
GetCursorInfo
GetMonitorInfoA
LoadIconA
GetParent
SetWindowLongPtrA
UpdateWindow
GetSystemMetrics
KillTimer
SetTimer
SetFocus
GetClientRect
GetWindowRect
AdjustWindowRect
GetWindowLongA
MessageBoxW
GetWindowLongPtrA
SystemParametersInfoA
GetDesktopWindow
DefWindowProcW
TranslateMessage
SetWindowPos

gfsdk_shadowlib.win64

?NV_ShadowLib_AddBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_BufferDesc@@PEAPEAI@Z
?NV_ShadowLib_RemoveBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAPEAI@Z
?NV_ShadowLib_ClearBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI@Z
?NV_ShadowLib_RenderBufferUsingExternalMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_ExternalMapDesc@@PEAUID3D11ShaderResourceView@@PEAIPEAUNV_ShadowLib_BufferRenderParams@@@Z
?NV_ShadowLib_FinalizeBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAPEAUID3D11ShaderResourceView@@@Z
?NV_ShadowLib_ModulateBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@Ugfsdk_float3@@@Z
?NV_ShadowLib_DevModeToggleDebugCascadeShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_DevModeToggleDebugEyeViewZShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_GetVersion@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@@Z
?NV_ShadowLib_OpenDX@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@QEIAUNV_ShadowLib_Ctx@@QEIAUID3D11Device@@QEIAUID3D11DeviceContext@@PEAUgfsdk_new_delete_t@@@Z

ws2_32

bind
getaddrinfo
WSACleanup
WSAStartup
accept
ntohs
ioctlsocket
getpeername
getsockname
inet_addr
listen
recv
send
setsockopt
gethostname
WSAGetLastError
ntohl
getnameinfo
WSAAddressToStringA
htonl
freeaddrinfo
shutdown
sendto
select
recvfrom
gethostbyname
socket
htons
connect
closesocket
__WSAFDIsSet
getsockopt

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

dsound

ord9
ord3
ord8
ord1
ord6

bink2w64

BinkStartAsyncThread
BinkRequestStopAsyncThread
BinkWaitStopAsyncThread
BinkOpen
BinkSetMemory
BinkOpenDirectSound
BinkSetSoundSystem
BinkSetFrameRate
BinkSetIO
BinkSetSoundTrack
BinkDoFrameAsyncWait
BinkDoFrameAsync
BinkShouldSkip
BinkSetVolume
BinkGetKeyFrame
BinkGoto
BinkPause
BinkClose
BinkWait
BinkNextFrame
BinkDoFrame
BinkRegisterFrameBuffers
BinkGetFrameBuffersInfo

wininet

HttpQueryInfoW
InternetCrackUrlW
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetSetOptionW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetQueryDataAvailable

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

psapi

GetModuleFileNameExA
GetModuleInformation
GetModuleBaseNameA
EnumProcessModules

mf

MFCreateASFMediaSinkActivate
MFCreateASFProfile
MFCreateASFContentInfo
MFShutdownObject
MFCreatePresentationClock
MFGetService
MFCreateSourceResolver

mfplat

MFCreateSample
MFCreateMediaType
MFShutdown
MFCreateAttributes
MFCreateMemoryBuffer
MFGetSystemTime
MFTEnum
MFCreateSystemTimeSource
MFInitAMMediaTypeFromMFMediaType
MFStartup

msdmo

MoFreeMediaType

mfreadwrite

MFCreateSourceReaderFromMediaSource
MFCreateSinkWriterFromURL

propsys

PropVariantToInt64
PropVariantGetStringElem
PSStringFromPropertyKey
PropVariantToStringWithDefault
PropVariantToUInt32
PropVariantToUInt64

crypt32

CertGetNameStringA
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

d3d9

D3DPERF_EndEvent
D3DPERF_BeginEvent

d3dcompiler_43

D3DReflect

gfsdk_txaa_alpharesolve.win64

TxaaOpenDX
TxaaResolveDX

imm32

ImmGetContext
ImmReleaseContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus

dinput8

DirectInput8Create

xinput1_3

ord3
ord2

bcrypt

BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptDestroyKey
BCryptFinalizeKeyPair
BCryptSecretAgreement
BCryptDeriveKey
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptGenerateKeyPair
BCryptEncrypt
BCryptDecrypt
BCryptExportKey
BCryptSetProperty
BCryptImportKeyPair
BCryptDestroySecret

rpcrt4

UuidCreateSequential

iphlpapi

GetBestRoute
GetIpForwardTable2
GetIpAddrTable
FreeMibTable

shlwapi

SHStrDupW

gdi32

CreateDCA
ExtEscape
GetDeviceCaps
GetStockObject
DeleteDC

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExW
CryptAcquireContextA

shell32

ShellExecuteA
ShellExecuteExA
ShellExecuteW
SHCreateDirectoryExW
SHGetFolderPathW
SHGetKnownFolderPath

ole32

PropVariantClear
CoTaskMemFree
CoSetProxyBlanket
CoLockObjectExternal
CoInitializeEx
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeSecurity

oleaut32

SysStringLen
SysAllocStringByteLen
VariantInit
SysAllocString
SysFreeString
VariantClear

Sections

.text
Size: 25.1MB - Virtual size: 25.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKBSS
Size: - Virtual size: 96B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.3MB - Virtual size: 18.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BINKCONS
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 490KB - Virtual size: 490KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 24.8MB - Virtual size: 24.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e9fc1ca4336145ef5f3b25fa69fc55a

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0f:65:f4:57:25:17:cb:cc:aa:8b:37:76:58:0a:8d:3dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

cb:d6:b6:c2:4f:2c:16:f2:2c:a1:ef:b7:f6:fc:86:8d:6b:8e:30:e5Signer

Signature Validations

Verification

18/04/2022, 14:56 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gfsdk_shadowlib.win64

ws2_32

version

dsound

bink2w64

wininet

winmm

psapi

mf

mfplat

msdmo

mfreadwrite

propsys

crypt32

wintrust

wtsapi32

d3d9

d3dcompiler_43

gfsdk_txaa_alpharesolve.win64

imm32

dinput8

xinput1_3

bcrypt

rpcrt4

iphlpapi

shlwapi

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 25.1MB - Virtual size: 25.1MB

BINK Size: 3KB - Virtual size: 3KB

BINKBSS Size: - Virtual size: 96B

.rdata Size: 3.7MB - Virtual size: 3.7MB

.data Size: 2.3MB - Virtual size: 18.0MB

.pdata Size: 1.0MB - Virtual size: 1.0MB

.tls Size: 2KB - Virtual size: 2KB

BINKCONS Size: 512B - Virtual size: 512B

.rsrc Size: 183KB - Virtual size: 183KB

.reloc Size: 490KB - Virtual size: 490KB

.text Size: 24.8MB - Virtual size: 24.8MB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0f:65:f4:57:25:17:cb:cc:aa:8b:37:76:58:0a:8d:3d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

cb:d6:b6:c2:4f:2c:16:f2:2c:a1:ef:b7:f6:fc:86:8d:6b:8e:30:e5
Signer

18/04/2022, 14:56
Valid: true

.text
Size: 25.1MB - Virtual size: 25.1MB

BINK
Size: 3KB - Virtual size: 3KB

BINKBSS
Size: - Virtual size: 96B

.rdata
Size: 3.7MB - Virtual size: 3.7MB

.data
Size: 2.3MB - Virtual size: 18.0MB

.pdata
Size: 1.0MB - Virtual size: 1.0MB

.tls
Size: 2KB - Virtual size: 2KB

BINKCONS
Size: 512B - Virtual size: 512B

.rsrc
Size: 183KB - Virtual size: 183KB

.reloc
Size: 490KB - Virtual size: 490KB

.text
Size: 24.8MB - Virtual size: 24.8MB