GTAIV[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

GTAIV.exe
Size

14.8MB
MD5

6dc86e3cf6a6b86cd594e1af6e4fa62c
SHA1

0f175fa8a367c0c88d0de776d34c26e160359f21
SHA256

ab21c0d90d2ca1c697785aca9dcf44635e1f8d48aa0df1d737e9190bddf0cb4c
SHA512

8e33b1475e48bcc6105e8af29ffe2aba211aba265d04e791909dd6fc48600758ab5127ac4fc2ec0bb4d64d568ca2c11289180c08191526ba05fc499b5a043710
SSDEEP

196608:dkTQagDdSNd7xemQqtwsjbWsqeGwwWymq/hhqG:iTQagDMBtQqi3eGwcpb

Score

1^/10

Malware Config

Signatures

Files

GTAIV.exe
.exe windows:4 windows x86 arch:x86

6fc559f54bb653a196ba082524f95161

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:71:a0:dd:68:76:ac:86:0f:4b:f3:2f:a0:dd:d8:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

24/10/2009, 00:00

Not After

24/10/2010, 23:59

Subject

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York City,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d4:56:fc:a6:9f:17:df:6c:92:42:ff:ac:c1:af:0b:57:63:2e:77:0d
Signer

Actual PE Digest

d4:56:fc:a6:9f:17:df:6c:92:42:ff:ac:c1:af:0b:57:63:2e:77:0d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

x:\gta\build\GTAIV.pdb

Imports

user32

wsprintfA
ReleaseCapture
GetParent
ShowCursor
EnumDisplayDevicesA
GetWindowInfo
RegisterClassW
CreateWindowExW
MoveWindow
SetWindowTextA
UpdateWindow
GetDesktopWindow
LoadIconA
DefWindowProcW
TranslateMessage
DispatchMessageA
LoadCursorA
RegisterClassA
SetRect
CharLowerBuffA
MessageBoxA
PostMessageA
DestroyWindow
UnregisterClassA
DefWindowProcA
AdjustWindowRect
GetSystemMetrics
GetClientRect
GetWindowRect
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetDC
ReleaseDC
GetKeyboardState
IsWindow
GetWindowTextA
IsWindowVisible
IsWindowUnicode
GetTitleBarInfo
GetMessageExtraInfo
SendInput
GetKeyboardLayout
GetKeyboardType
GetKeyboardLayoutNameA
LoadKeyboardLayoutA
MapVirtualKeyExA
ToAsciiEx
ToUnicodeEx
SetWindowLongA
SetWindowPos
SetFocus
GetForegroundWindow
GetActiveWindow
GetTopWindow
SetActiveWindow
SetForegroundWindow
SetCapture
IsWindowEnabled
GetFocus
EnableWindow
GetWindow
GetCapture
SystemParametersInfoA
PeekMessageA
ShowWindow
SendMessageA
IsIconic
MessageBoxW

psapi

EnumProcessModules
GetModuleFileNameExA

crypt32

CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertFreeCertificateContext
CertGetNameStringA
CryptMsgClose
CryptProtectData
CryptUnprotectData
CertCloseStore

wininet

InternetCloseHandle
InternetSetOptionA
InternetQueryOptionA
HttpAddRequestHeadersA
HttpEndRequestA
HttpSendRequestA
InternetOpenA
HttpOpenRequestA
InternetCrackUrlA
InternetConnectA
InternetWriteFile
HttpSendRequestExA
InternetCheckConnectionA
InternetGetConnectedState
InternetReadFile
InternetQueryDataAvailable

binkw32

_BinkRegisterFrameBuffers@8
_BinkSetSoundSystem@8
_BinkPause@8
_BinkOpenDirectSound@4
_BinkNextFrame@4
_BinkWait@4
_BinkGoto@12
_BinkGetFrameBuffersInfo@8
_BinkGetKeyFrame@12
_BinkSetMemory@8
_BinkDoFrame@4
_BinkSetVolume@12
_BinkClose@4
_BinkGetSummary@8
_BinkOpen@8
_BinkShouldSkip@4

wintrust

WinVerifyTrust

xlive

ord5324
ord5319
ord5278
ord5280
ord5312
ord5215
ord5260
ord5252
ord5214
ord5365
ord5327
ord5300
ord5323
ord5326
ord5
ord5330
ord5322
ord5325
ord5328
ord5316
ord5317
ord5318
ord5329
ord5333
ord5332
ord20
ord24
ord7
ord5262
ord5265
ord75
ord5331
ord5337
ord5295
ord5360
ord63
ord66
ord5310
ord5311
ord5276
ord5277
ord5286
ord5281
ord5284
ord5022
ord5292
ord5315
ord5024
ord5263
ord5030
ord52
ord2
ord51
ord1
ord26
ord9
ord11
ord13
ord18
ord5016
ord5021
ord5020
ord652
ord5017
ord5002
ord5007
ord5005
ord5003
ord5267
ord5251
ord72
ord70
ord69
ord5303
ord5305
ord14
ord5294
ord5350
ord5270
ord651
ord27
ord15
ord5256
ord5335
ord38
ord39
ord1083
ord6
ord4
ord5344
ord5345
ord5367
ord1082
ord12
ord5372
ord5254
ord5264
ord5314
ord5008
ord3
ord5019
ord5018
ord5297
ord84
ord5037
ord5035
ord22
ord73
ord57
ord58
ord5034
ord5038
ord5336
ord5036
ord5355

d3d9

Direct3DCreate9

dinput8

DirectInput8Create

dsound

ord3
ord9
ord11
ord2

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ws2_32

inet_ntoa
closesocket
socket
recv
sendto
ntohs
shutdown
WSAGetLastError
htons
gethostname
ntohl
recvfrom
send
connect
gethostbyname
inet_addr
WSACleanup
__WSAFDIsSet
select
htonl
getsockname

shlwapi

PathFileExistsA
PathAppendA
PathStripPathW
PathAppendW

wmvcore

WMCreateSyncReader
WMCreateReader

winmm

timeGetTime
waveOutSetVolume
waveOutReset
waveOutWrite
waveOutPrepareHeader
waveOutOpen
waveOutClose
timeBeginPeriod
timeEndPeriod

powrprof

CallNtPowerInformation

kernel32

Process32Next
GetCurrentProcess
SetThreadAffinityMask
GetCurrentThread
GetSystemDirectoryA
GlobalAlloc
GlobalFree
lstrcmpiA
OpenEventA
SystemTimeToFileTime
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
VirtualQuery
VirtualProtect
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
RaiseException
RtlUnwind
HeapCreate
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleHandleW
GetWindowsDirectoryA
GetStdHandle
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
OutputDebugStringA
GetOEMCP
GetACP
GetCPInfo
GetFileType
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapReAlloc
GetFullPathNameA
GetCurrentDirectoryA
GetDriveTypeA
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetStartupInfoA
ExitProcess
TerminateThread
DuplicateHandle
LoadLibraryW
WaitForMultipleObjects
InitializeCriticalSection
TryEnterCriticalSection
InterlockedCompareExchange
GetTimeFormatA
GetDateFormatA
FileTimeToLocalFileTime
SetEndOfFile
MoveFileA
FindFirstFileA
CreateDirectoryA
WriteFile
SetFileTime
CreateFileA
FormatMessageA
FindNextFileA
FileTimeToSystemTime
SetFileAttributesA
RemoveDirectoryA
GetUserDefaultLangID
GetProcessHeap
HeapAlloc
HeapFree
SetThreadPriorityBoost
ResumeThread
ReleaseSemaphore
GetCurrentThreadId
CreateSemaphoreA
lstrlenW
ExpandEnvironmentStringsA
GetFileAttributesA
QueryPerformanceCounter
QueryPerformanceFrequency
OpenThread
GetThreadPriority
SetThreadPriority
GetModuleFileNameA
GetCommandLineA
GetVersionExA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
ResetEvent
InterlockedIncrement
SetEvent
CreateMutexA
OpenFile
CreateFileMappingA
CreateProcessA
GetProcessId
Sleep
LocalFree
OpenProcess
CloseHandle
GetCurrentProcessId
MultiByteToWideChar
ReleaseMutex
FindFirstFileW
FindNextFileW
FindClose
FoldStringW
GlobalMemoryStatus
GetLocalTime
WideCharToMultiByte
CreateToolhelp32Snapshot
InterlockedExchange
InterlockedExchangeAdd
GetModuleFileNameW
SetLastError
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetErrorMode
GetFileAttributesW
SetFilePointer
CreateThread
GetExitCodeThread
CreateFileW
GetFileSize
GetTickCount
ReadFile
GetLastError
CreateDirectoryW
CopyFileA
DeleteFileW
DeleteFileA
GetDiskFreeSpaceExA
LoadLibraryA
FreeLibrary
VirtualAlloc
VirtualFree
HeapSetInformation
GetProcessAffinityMask
GetSystemTime
GetUserDefaultUILanguage
WaitForSingleObject
CreateEventA
GetModuleHandleA
GlobalMemoryStatusEx
GetProcAddress
GetSystemInfo
GetSystemTimes
Process32First
LocalAlloc
TerminateProcess

gdi32

GetDeviceCaps
ExtEscape
CreateDCA
DeleteDC
GetStockObject

advapi32

CryptHashData
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegCreateKeyExA
CryptReleaseContext
CryptAcquireContextA
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
RegOpenKeyA

shell32

SHCreateDirectoryExA
SHGetFolderPathW
SHGetFolderPathA
ShellExecuteA
ShellExecuteExA

ole32

CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitialize
OleUninitialize
OleDraw
CLSIDFromString
OleInitialize

oleaut32

SysFreeString
VariantClear
SysAllocString
VariantInit
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector

atl80

ord41
ord42

Sections

.text
Size: 9.3MB - Virtual size: 9.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.7MB - Virtual size: 11.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 944KB - Virtual size: 941KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6fc559f54bb653a196ba082524f95161

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

78:71:a0:dd:68:76:ac:86:0f:4b:f3:2f:a0:dd:d8:01Certificate

Extended Key Usages

Key Usages

d4:56:fc:a6:9f:17:df:6c:92:42:ff:ac:c1:af:0b:57:63:2e:77:0dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

psapi

crypt32

wininet

binkw32

wintrust

xlive

d3d9

dinput8

dsound

version

ws2_32

shlwapi

wmvcore

winmm

powrprof

kernel32

gdi32

advapi32

shell32

ole32

oleaut32

atl80

Sections

.text Size: 9.3MB - Virtual size: 9.3MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 1.7MB - Virtual size: 11.3MB

.tls Size: 4KB - Virtual size: 2KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 944KB - Virtual size: 941KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

78:71:a0:dd:68:76:ac:86:0f:4b:f3:2f:a0:dd:d8:01
Certificate

d4:56:fc:a6:9f:17:df:6c:92:42:ff:ac:c1:af:0b:57:63:2e:77:0d
Signer

.text
Size: 9.3MB - Virtual size: 9.3MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 1.7MB - Virtual size: 11.3MB

.tls
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 944KB - Virtual size: 941KB