GTA5[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

GTA5.exe
Size

57.5MB
MD5

5cf62efdb69b803685049559a43d5d3f
SHA1

21dcfb3a4475288e1044dab0f6d9b039ae7c5bd5
SHA256

9bd5e3e471900734d605aefbb0de3a931b021c16b1ea0a2dff7cdc44d6ed2f63
SHA512

7042274b29cb68d9c49b4390462cc6f598dd31892e70d5350ba84a669f702830c0c7c87196f25fbe3c51de930906d3bd687bbf6c770b9f07713b323abd1d1152
SSDEEP

1572864:QW1gCyZTJaWPGKd8O621SB0bDr1KVfu7Vn:QWGCyhPVd00AMR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GTA5.exe

Files

GTA5.exe
.exe windows:5 windows x64 arch:x64

47c32ee192f332ced5b16130b25ee2b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

x:\gta5\titleupdate\dev_ng_Live\game_win64_steammaster.pdb

Imports

kernel32

GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
FlushFileBuffers
GetCurrentDirectoryW
GetConsoleMode
GetConsoleCP
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsProcessorFeaturePresent
IsDebuggerPresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStartupInfoW
GetFileType
GetStdHandle
SetLastError
FindFirstFileExW
HeapReAlloc
HeapSize
GetFullPathNameA
GetDriveTypeW
GetTimeZoneInformation
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
DecodePointer
EncodePointer
ResetEvent
GetFileTime
VerifyVersionInfoW
VerSetConditionMask
InitializeCriticalSection
GetSystemTimeAsFileTime
CreateFileA
LoadLibraryExW
GetOverlappedResult
GetSystemDefaultUILanguage
VerifyVersionInfoA
OutputDebugStringA
SetThreadExecutionState
WerSetFlags
QueryPerformanceCounter
CreateSemaphoreA
CreateMutexA
GetSystemInfo
ReleaseMutex
ReleaseSemaphore
SetEvent
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResumeThread
GetThreadPriority
SetThreadPriorityBoost
SetThreadPriority
GetThreadId
ReadConsoleW
SetStdHandle
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
OutputDebugStringW
GetCurrentThreadId
CreateThread
GetProcessAffinityMask
GetProcessHeap
HeapFree
HeapAlloc
VirtualProtect
VirtualFree
VirtualAlloc
MoveFileExW
GetFileAttributesExW
SetFileAttributesW
RemoveDirectoryW
LoadLibraryW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
WriteConsoleW
SetEnvironmentVariableA
CreateProcessW
GetSystemDirectoryW
lstrcmpA
CreateDirectoryW
GetTempPathW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetConsoleWindow
GetModuleHandleExW
GetModuleHandleA
GetLocalTime
SetFileTime
OpenProcess
GetCurrentProcessId
ExitProcess
CloseHandle
GetModuleFileNameA
GetModuleFileNameW
GetCommandLineA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetDiskFreeSpaceExA
DeleteFileW
GetFileSize
WriteFile
ReadFile
FindClose
lstrcpyA
lstrcpyW
lstrcatW
lstrlenA
CreateFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
MultiByteToWideChar
WaitForMultipleObjects
GetDiskFreeSpaceExW
FindFirstChangeNotificationA
FindNextChangeNotification
FindCloseChangeNotification
WaitForSingleObject
FreeLibrary
GetProcAddress
GlobalMemoryStatusEx
GetSystemFirmwareTable
SetHandleInformation
GetNativeSystemInfo
CreatePipe
LoadLibraryA
CreateProcessA
GetEnvironmentVariableA
GetWindowsDirectoryA
GetVolumeInformationA
QueryPerformanceFrequency
GetVersionExA
WideCharToMultiByte
GetUserDefaultUILanguage
GetSystemDefaultLocaleName
GetWriteWatch
ResetWriteWatch
VirtualQueryEx
ReadProcessMemory
GetModuleHandleExA
LocalAlloc
LocalFree
GetCurrentProcess
GetCurrentThread
GetThreadContext
DeleteFileA
Sleep
SetFilePointer
CreateEventA
TerminateProcess
GetLastError
SetEndOfFile
SetFilePointerEx
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQuery

user32

ShowWindow
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
DefWindowProcW
GetDesktopWindow
SystemParametersInfoA
RegisterRawInputDevices
GetRawInputData
ClientToScreen
GetCursorPos
SetCursorPos
ShowCursor
MapVirtualKeyExW
MapVirtualKeyW
MapVirtualKeyA
GetKeyState
GetDoubleClickTime
SendMessageW
GetKeyboardLayout
GetKeyboardLayoutList
UnloadKeyboardLayout
ActivateKeyboardLayout
LoadKeyboardLayoutW
GetMonitorInfoA
LockSetForegroundWindow
LoadIconA
LoadCursorA
GetParent
ClipCursor
GetForegroundWindow
GetSystemMetrics
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetCapture
SetFocus
CreateWindowExW
RegisterClassW
PostMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
GetCursorInfo
SetWindowLongPtrA
UpdateWindow
SetWindowPos
GetWindowLongPtrA
MessageBoxW
GetWindowLongA
AdjustWindowRect
GetWindowRect
GetClientRect

steam_api64

SteamAPI_RegisterCallback
SteamInternal_ContextInit
SteamAPI_GetHSteamUser
SteamAPI_GetHSteamPipe
SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamAPI_UnregisterCallback
SteamAPI_RunCallbacks
SteamInternal_CreateInterface

gfsdk_shadowlib.win64

?NV_ShadowLib_OpenDX@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@QEIAUNV_ShadowLib_Ctx@@QEIAUID3D11Device@@QEIAUID3D11DeviceContext@@PEAUgfsdk_new_delete_t@@@Z
?NV_ShadowLib_GetVersion@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@@Z
?NV_ShadowLib_DevModeToggleDebugEyeViewZShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_DevModeToggleDebugCascadeShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_ModulateBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@Ugfsdk_float3@@@Z
?NV_ShadowLib_FinalizeBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAPEAUID3D11ShaderResourceView@@@Z
?NV_ShadowLib_RenderBufferUsingExternalMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_ExternalMapDesc@@PEAUID3D11ShaderResourceView@@PEAIPEAUNV_ShadowLib_BufferRenderParams@@@Z
?NV_ShadowLib_RemoveBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAPEAI@Z
?NV_ShadowLib_AddBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_BufferDesc@@PEAPEAI@Z
?NV_ShadowLib_ClearBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI@Z

version

GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoA

dsound

ord1
ord3
ord6
ord8
ord9

bink2w64

BinkDoFrameAsyncWait
BinkDoFrameAsync
BinkSetSoundTrack
BinkRequestStopAsyncThread
BinkSetIO
BinkSetFrameRate
BinkSetSoundSystem
BinkOpenDirectSound
BinkSetMemory
BinkShouldSkip
BinkSetVolume
BinkGetKeyFrame
BinkGoto
BinkPause
BinkClose
BinkWait
BinkNextFrame
BinkRegisterFrameBuffers
BinkGetFrameBuffersInfo
BinkOpen
BinkWaitStopAsyncThread
BinkStartAsyncThread

ws2_32

ntohl
WSAAddressToStringA
htonl
freeaddrinfo
getaddrinfo
shutdown
sendto
htons
ntohs
accept
bind
closesocket
connect
ioctlsocket
getpeername
getsockname
inet_addr
listen
recv
send
setsockopt
socket
gethostbyname
gethostname
WSAStartup
WSACleanup
WSAGetLastError
__WSAFDIsSet
getsockopt
recvfrom
select
getnameinfo

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime

psapi

EnumProcessModules
GetModuleBaseNameA
GetModuleInformation
GetModuleFileNameExA

mf

MFCreateASFProfile
MFCreateASFMediaSinkActivate
MFGetService
MFCreateSourceResolver
MFShutdownObject
MFCreateASFContentInfo
MFCreatePresentationClock

mfplat

MFGetSystemTime
MFCreateSample
MFCreateMemoryBuffer
MFCreateSystemTimeSource
MFInitAMMediaTypeFromMFMediaType
MFCreateAttributes
MFShutdown
MFStartup
MFCreateMediaType
MFTEnum

msdmo

MoFreeMediaType

mfreadwrite

MFCreateSourceReaderFromMediaSource
MFCreateSinkWriterFromURL

propsys

PropVariantToUInt32
PropVariantGetStringElem
PSStringFromPropertyKey
PropVariantToUInt64
PropVariantToInt64
PropVariantToStringWithDefault

crypt32

CryptMsgGetParam
CryptQueryObject
CertFindCertificateInStore
CertGetNameStringA

wintrust

WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

d3d9

D3DPERF_EndEvent
D3DPERF_BeginEvent

d3dcompiler_43

D3DReflect

gfsdk_txaa_alpharesolve.win64

TxaaOpenDX
TxaaResolveDX

imm32

ImmGetContext
ImmReleaseContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus

dinput8

DirectInput8Create

xinput1_3

ord3
ord2

rpcrt4

UuidCreateSequential

iphlpapi

GetBestRoute
GetIpAddrTable
GetIpForwardTable

shlwapi

SHStrDupW

gdi32

ExtEscape
GetDeviceCaps
DeleteDC
CreateDCA
GetStockObject

advapi32

GetUserNameA
RegQueryValueExA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptAcquireContextA
RegOpenKeyExA

shell32

ShellExecuteW
SHCreateDirectoryExW
ShellExecuteExA
ShellExecuteA
SHGetFolderPathW

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree
PropVariantClear
CoUninitialize
CoLockObjectExternal
CoInitialize

oleaut32

SysAllocStringByteLen
VariantClear
VariantInit
SysStringLen
SysFreeString
SysAllocString

Sections

.text
Size: 24.2MB - Virtual size: 24.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKBSS
Size: - Virtual size: 96B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.3MB - Virtual size: 17.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1000KB - Virtual size: 1000KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BINKCONS
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 474KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 25.9MB - Virtual size: 25.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47c32ee192f332ced5b16130b25ee2b5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

steam_api64

gfsdk_shadowlib.win64

version

dsound

bink2w64

ws2_32

winmm

psapi

mf

mfplat

msdmo

mfreadwrite

propsys

crypt32

wintrust

wtsapi32

d3d9

d3dcompiler_43

gfsdk_txaa_alpharesolve.win64

imm32

dinput8

xinput1_3

rpcrt4

iphlpapi

shlwapi

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 24.2MB - Virtual size: 24.2MB

BINK Size: 3KB - Virtual size: 3KB

BINKBSS Size: - Virtual size: 96B

.rdata Size: 3.6MB - Virtual size: 3.6MB

.data Size: 2.3MB - Virtual size: 17.2MB

.pdata Size: 1000KB - Virtual size: 1000KB

.tls Size: 2KB - Virtual size: 2KB

BINKCONS Size: 512B - Virtual size: 512B

.rsrc Size: 183KB - Virtual size: 183KB

.reloc Size: 474KB - Virtual size: 474KB

.text Size: 25.9MB - Virtual size: 25.9MB

.text
Size: 24.2MB - Virtual size: 24.2MB

BINK
Size: 3KB - Virtual size: 3KB

BINKBSS
Size: - Virtual size: 96B

.rdata
Size: 3.6MB - Virtual size: 3.6MB

.data
Size: 2.3MB - Virtual size: 17.2MB

.pdata
Size: 1000KB - Virtual size: 1000KB

.tls
Size: 2KB - Virtual size: 2KB

BINKCONS
Size: 512B - Virtual size: 512B

.rsrc
Size: 183KB - Virtual size: 183KB

.reloc
Size: 474KB - Virtual size: 474KB

.text
Size: 25.9MB - Virtual size: 25.9MB