GTA5[.]exe | Triage

Resubmissions

15/06/2024, 21:19

240615-z6d1sayejp 1

Sharing

Copy URL Twitter E-mail

General

Target

GTA5.exe
Size

74.0MB
MD5

0e94c30eb7c2c7bd2de968b4148f9493
SHA1

79a272830be65afae4acd520bfbfe176e0b142f3
SHA256

af4cfb1ff9b5eb0b0de09bc00c67826b214d8f57ea8078fee15f86beded3ef5a
SHA512

3fd1e25cf2b3ed3f527fe0aaa0f8dc8876ef430508c21ab57d9e8b80ee608d617c6d42213699fc15d929dfaa65b9d63f206ad61cf21e1078329bfe00423d9ec6
SSDEEP

1572864:j/iptQG2AI2wjiqSbmf7FoIan4usbd53KiL3BJxz973+SJ4lzLumBQCG:j/iptQ/tfjiqwmfBoF4u8dZKiLRfpu58

Score

1^/10

Malware Config

Signatures

Files

GTA5.exe
.exe windows:5 windows x64 arch:x64

18e1969763c82ed3751c6cb8b31cfa3f

Code Sign

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10/06/2015, 13:46

Not After

10/11/2030, 14:16

Subject

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3e
Certificate

Issuer

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

09/03/2017, 22:04

Not After

20/03/2020, 22:34

Subject

CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:52:8e:d4:2f:cf:29:08:6f:f2:2f:f4:87:37:1b:bb:28:38:17:98
Signer

Actual PE Digest

69:52:8e:d4:2f:cf:29:08:6f:f2:2f:f4:87:37:1b:bb:28:38:17:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

x:\gta5\titleupdate\dev_ng_Live\game_win64_master.pdb

Imports

kernel32

TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
FlushFileBuffers
GetCurrentDirectoryW
GetConsoleMode
GetConsoleCP
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsProcessorFeaturePresent
IsDebuggerPresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStartupInfoW
GetFileType
SetLastError
FindFirstFileExW
HeapReAlloc
GetModuleHandleExW
HeapSize
GetFullPathNameA
GetDriveTypeW
GetTimeZoneInformation
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
DecodePointer
EncodePointer
ResetEvent
GetFileTime
VerifyVersionInfoW
VerSetConditionMask
InitializeCriticalSection
GetSystemTimeAsFileTime
CreateFileA
LoadLibraryExW
GetOverlappedResult
LocalFree
LocalAlloc
GetModuleFileNameW
GetSystemDefaultUILanguage
VerifyVersionInfoA
OutputDebugStringA
SetThreadExecutionState
WerSetFlags
QueryPerformanceCounter
CreateSemaphoreA
CreateMutexA
GetSystemInfo
ReleaseMutex
ReleaseSemaphore
SetEvent
ReadConsoleW
SetStdHandle
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
OutputDebugStringW
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResumeThread
GetThreadPriority
SetThreadPriorityBoost
SetThreadPriority
GetThreadId
GetCurrentThreadId
LoadLibraryW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
WriteConsoleW
SetEnvironmentVariableA
CreateProcessW
GetSystemDirectoryW
lstrcmpA
CreateThread
GetProcessAffinityMask
GetProcessHeap
HeapFree
HeapAlloc
GetConsoleWindow
GetStdHandle
GetModuleHandleA
VirtualQueryEx
VirtualProtect
OpenProcess
GetCurrentProcessId
ExitProcess
CloseHandle
GetModuleFileNameA
GetCommandLineA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetDiskFreeSpaceExA
DeleteFileW
GetFileSize
WriteFile
ReadFile
FindClose
lstrcpyA
lstrcpyW
lstrcatW
lstrlenA
CreateFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
MultiByteToWideChar
WaitForMultipleObjects
GetDiskFreeSpaceExW
FindFirstChangeNotificationA
FindNextChangeNotification
FindCloseChangeNotification
WaitForSingleObject
FreeLibrary
GetProcAddress
GlobalMemoryStatusEx
GetSystemFirmwareTable
SetHandleInformation
GetNativeSystemInfo
CreatePipe
LoadLibraryA
CreateProcessA
GetEnvironmentVariableA
GetWindowsDirectoryA
GetVolumeInformationA
QueryPerformanceFrequency
GetVersionExA
WideCharToMultiByte
GetUserDefaultUILanguage
GetSystemDefaultLocaleName
GetCurrentProcess
RaiseException
GetCurrentThread
GetLastError
GetThreadContext
GetModuleHandleExA
DeleteFileA
Sleep
SetFilePointer
CreateEventA
TerminateProcess
SetEndOfFile
SetFilePointerEx
SetFileTime
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTempPathW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesExW
MoveFileExW
VirtualAlloc
VirtualFree
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQuery

user32

ShowWindow
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
UpdateWindow
RegisterRawInputDevices
GetRawInputData
ClientToScreen
GetCursorPos
SetCursorPos
ShowCursor
MapVirtualKeyExW
MapVirtualKeyW
MapVirtualKeyA
GetKeyState
GetDoubleClickTime
SendMessageW
GetKeyboardLayout
GetKeyboardLayoutList
UnloadKeyboardLayout
ActivateKeyboardLayout
LoadKeyboardLayoutW
GetMonitorInfoA
LockSetForegroundWindow
LoadIconA
LoadCursorA
SetWindowPos
GetParent
ClipCursor
GetForegroundWindow
GetSystemMetrics
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetCapture
SetFocus
CreateWindowExW
RegisterClassW
PostMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
GetCursorInfo
GetClientRect
GetWindowRect
AdjustWindowRect
GetWindowLongA
MessageBoxW
GetWindowLongPtrA
SystemParametersInfoA
GetDesktopWindow
DefWindowProcW
SetWindowLongPtrA

gfsdk_shadowlib.win64

?NV_ShadowLib_OpenDX@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@QEIAUNV_ShadowLib_Ctx@@QEIAUID3D11Device@@QEIAUID3D11DeviceContext@@PEAUgfsdk_new_delete_t@@@Z
?NV_ShadowLib_ClearBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI@Z
?NV_ShadowLib_AddBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_BufferDesc@@PEAPEAI@Z
?NV_ShadowLib_RenderBufferUsingExternalMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_ExternalMapDesc@@PEAUID3D11ShaderResourceView@@PEAIPEAUNV_ShadowLib_BufferRenderParams@@@Z
?NV_ShadowLib_FinalizeBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAPEAUID3D11ShaderResourceView@@@Z
?NV_ShadowLib_ModulateBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@Ugfsdk_float3@@@Z
?NV_ShadowLib_DevModeToggleDebugCascadeShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_DevModeToggleDebugEyeViewZShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_GetVersion@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@@Z
?NV_ShadowLib_RemoveBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAPEAI@Z

ws2_32

shutdown
freeaddrinfo
htonl
WSAAddressToStringA
getnameinfo
ntohl
sendto
select
recvfrom
getsockopt
__WSAFDIsSet
WSAGetLastError
gethostname
setsockopt
send
recv
listen
inet_addr
getsockname
closesocket
connect
htons
socket
gethostbyname
WSAStartup
WSACleanup
getaddrinfo
ntohs
accept
getpeername
bind
ioctlsocket

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

dsound

ord9
ord8
ord6
ord1
ord3

bink2w64

BinkDoFrameAsyncWait
BinkDoFrameAsync
BinkShouldSkip
BinkSetVolume
BinkGetKeyFrame
BinkSetSoundTrack
BinkPause
BinkSetSoundSystem
BinkWait
BinkNextFrame
BinkRegisterFrameBuffers
BinkSetIO
BinkGoto
BinkGetFrameBuffersInfo
BinkOpen
BinkWaitStopAsyncThread
BinkRequestStopAsyncThread
BinkStartAsyncThread
BinkSetFrameRate
BinkOpenDirectSound
BinkSetMemory
BinkClose

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

psapi

EnumProcessModules
GetModuleBaseNameA
GetModuleInformation
GetModuleFileNameExA

mf

MFCreateASFProfile
MFCreateASFMediaSinkActivate
MFGetService
MFCreateSourceResolver
MFShutdownObject
MFCreateASFContentInfo
MFCreatePresentationClock

mfplat

MFGetSystemTime
MFCreateSample
MFCreateMemoryBuffer
MFCreateSystemTimeSource
MFInitAMMediaTypeFromMFMediaType
MFCreateAttributes
MFShutdown
MFStartup
MFCreateMediaType
MFTEnum

msdmo

MoFreeMediaType

mfreadwrite

MFCreateSourceReaderFromMediaSource
MFCreateSinkWriterFromURL

propsys

PropVariantToUInt32
PropVariantGetStringElem
PSStringFromPropertyKey
PropVariantToUInt64
PropVariantToInt64
PropVariantToStringWithDefault

crypt32

CertGetNameStringA
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

wintrust

WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

d3d9

D3DPERF_EndEvent
D3DPERF_BeginEvent

d3dcompiler_43

D3DReflect

gfsdk_txaa_alpharesolve.win64

TxaaOpenDX
TxaaResolveDX

imm32

ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus
ImmReleaseContext
ImmGetContext

dinput8

DirectInput8Create

xinput1_3

ord2
ord3

rpcrt4

UuidCreateSequential

iphlpapi

GetIpAddrTable
GetBestRoute
GetIpForwardTable

shlwapi

SHStrDupW

gdi32

GetDeviceCaps
DeleteDC
ExtEscape
GetStockObject
CreateDCA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptAcquireContextA
GetUserNameA

shell32

ShellExecuteW
SHCreateDirectoryExW
ShellExecuteExA
ShellExecuteA
SHGetFolderPathW

ole32

CoCreateInstance
CoInitializeEx
CoLockObjectExternal
PropVariantClear
CoTaskMemFree
CoInitialize
CoSetProxyBlanket
CoUninitialize
CoInitializeSecurity

oleaut32

SysAllocStringByteLen
VariantClear
VariantInit
SysStringLen
SysFreeString
SysAllocString

Sections

.text
Size: 24.7MB - Virtual size: 24.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKBSS
Size: - Virtual size: 96B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.3MB - Virtual size: 18.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1023KB - Virtual size: 1023KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BINKCONS
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 484KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 41.8MB - Virtual size: 41.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

18e1969763c82ed3751c6cb8b31cfa3f

Code Sign

43:c1:0b:1c:00:00:00:00:51:d3:73:daCertificate

Extended Key Usages

Key Usages

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3eCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

69:52:8e:d4:2f:cf:29:08:6f:f2:2f:f4:87:37:1b:bb:28:38:17:98Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gfsdk_shadowlib.win64

ws2_32

version

dsound

bink2w64

winmm

psapi

mf

mfplat

msdmo

mfreadwrite

propsys

crypt32

wintrust

wtsapi32

d3d9

d3dcompiler_43

gfsdk_txaa_alpharesolve.win64

imm32

dinput8

xinput1_3

rpcrt4

iphlpapi

shlwapi

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 24.7MB - Virtual size: 24.7MB

BINK Size: 3KB - Virtual size: 3KB

BINKBSS Size: - Virtual size: 96B

.rdata Size: 3.6MB - Virtual size: 3.6MB

.data Size: 2.3MB - Virtual size: 18.0MB

.pdata Size: 1023KB - Virtual size: 1023KB

.tls Size: 2KB - Virtual size: 2KB

BINKCONS Size: 512B - Virtual size: 512B

.rsrc Size: 183KB - Virtual size: 183KB

.reloc Size: 484KB - Virtual size: 484KB

.text Size: 41.8MB - Virtual size: 41.8MB

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3e
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

69:52:8e:d4:2f:cf:29:08:6f:f2:2f:f4:87:37:1b:bb:28:38:17:98
Signer

.text
Size: 24.7MB - Virtual size: 24.7MB

BINK
Size: 3KB - Virtual size: 3KB

BINKBSS
Size: - Virtual size: 96B

.rdata
Size: 3.6MB - Virtual size: 3.6MB

.data
Size: 2.3MB - Virtual size: 18.0MB

.pdata
Size: 1023KB - Virtual size: 1023KB

.tls
Size: 2KB - Virtual size: 2KB

BINKCONS
Size: 512B - Virtual size: 512B

.rsrc
Size: 183KB - Virtual size: 183KB

.reloc
Size: 484KB - Virtual size: 484KB

.text
Size: 41.8MB - Virtual size: 41.8MB