GTAIV-Vanilla[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

GTAIV-Vanilla.exe
Size

13.2MB
MD5

e72f2bca8f5192259aa1725901ec48e1
SHA1

7f55e131ff3784fe1b6ed83f8db975b247aa608f
SHA256

9b97e454eb445e6467a70c1867c532e4de328d1dc35b2261ff35f669eb409873
SHA512

de520688a8cd2068484c8756930f4ccabb0674050533bfe32624c69be71b0910337e7e289c885926c83b421fe1be1be0d2f5e4c7d29731e4572c8c7607953b28
SSDEEP

196608:s/bLofn6R71ahFoaPZ7b8CN/0daQX+Nq/Z8Wz4:l6R71eohCOfem4

Score

1^/10

Malware Config

Signatures

Files

GTAIV-Vanilla.exe
.exe windows:4 windows x86 arch:x86

f31573551763ace95ffe6ab6379c2a6a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:56:41:0e:7a:8c:f2:6e:7f:1f:30:6f:fc:e6:70:cc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

22/09/2008, 00:00

Not After

22/09/2009, 23:59

Subject

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York City,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9a:98:6d:81:6b:e9:a3:86:6f:65:4c:52:43:4e:ca:94:d1:bb:7d:26
Signer

Actual PE Digest

9a:98:6d:81:6b:e9:a3:86:6f:65:4c:52:43:4e:ca:94:d1:bb:7d:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

x:\gta\build\GTAIV.pdb

Imports

user32

GetParent
MessageBoxA
PostMessageA
ReleaseCapture
MessageBoxW
wsprintfA
GetTopWindow
SetForegroundWindow
GetWindow
GetFocus
SetCapture
EnableWindow
GetActiveWindow
GetForegroundWindow
GetCapture
IsWindowEnabled
FindWindowA
BringWindowToTop
SetActiveWindow
IsWindow
IsWindowUnicode
GetTitleBarInfo
CharLowerBuffA
GetWindowInfo
EnumDisplayDevicesA
DispatchMessageA
TranslateMessage
CreateWindowExW
GetDC
LoadCursorA
SetRect
ReleaseDC
PeekMessageA
AdjustWindowRect
IsIconic
LoadIconA
SetFocus
UpdateWindow
MoveWindow
ShowWindow
SetWindowTextA
GetDesktopWindow
RegisterClassW
UnregisterClassA
GetWindowRect
SetWindowPos
GetSystemMetrics
GetClientRect
ShowCursor
SetWindowLongA
DestroyWindow
DefWindowProcW
SendMessageA
ToAsciiEx
MapVirtualKeyExA
GetKeyboardLayout
LoadKeyboardLayoutA
GetKeyboardLayoutNameA
GetKeyboardType
GetKeyboardState
SendInput
GetMessageExtraInfo
SystemParametersInfoA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
DefWindowProcA
RegisterClassA
GetWindowTextA

wininet

InternetWriteFile
HttpSendRequestExA
InternetReadFile
InternetGetConnectedState
HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetCheckConnectionA
InternetQueryDataAvailable
InternetSetOptionA
InternetOpenA
InternetQueryOptionA
HttpAddRequestHeadersA
HttpEndRequestA
InternetCrackUrlA

crypt32

CertGetNameStringA
CertFindCertificateInStore
CryptMsgClose
CryptQueryObject
CryptMsgGetParam
CertCloseStore
CryptUnprotectData
CryptProtectData
CertFreeCertificateContext

psapi

GetModuleFileNameExA
EnumProcessModules
EnumProcesses

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

dsound

ord9
ord11
ord2

d3d9

Direct3DCreate9

xlive

ord5263
ord5264
ord5024
ord1082
ord5315
ord5022
ord5292
ord5311
ord5310
ord5254
ord4
ord66
ord63
ord75
ord5267
ord5324
ord5277
ord5276
ord5262
ord7
ord20
ord5036
ord5037
ord5035
ord5295
ord5034
ord5018
ord5019
ord69
ord72
ord5303
ord70
ord5344
ord5305
ord5345
ord5294
ord5265
ord5017
ord5016
ord1
ord52
ord2
ord51
ord14
ord24
ord3
ord5002
ord5
ord58
ord73
ord39
ord5251
ord5335
ord5256
ord651
ord5030
ord5270
ord5331
ord1083
ord12
ord9
ord5007
ord26
ord11
ord6
ord22
ord27
ord5005
ord5003
ord13
ord18
ord5318
ord5332
ord5329
ord5317
ord5333
ord5323
ord5327
ord5300
ord5336
ord5322
ord5325
ord5326
ord5330
ord5328
ord5316
ord57
ord5319
ord5215
ord5252
ord5214
ord5260
ord5286
ord5284
ord5281
ord5312
ord5280
ord5278
ord5008
ord5314
ord5337
ord15
ord5261
ord5038
ord5297
ord38
ord84

wintrust

WinVerifyTrust

atl80

ord41
ord42

shlwapi

PathStripPathW
PathFileExistsA
PathAppendA
PathAppendW

wmvcore

WMCreateReader
WMCreateSyncReader

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod
waveOutSetVolume
waveOutReset
waveOutWrite
waveOutOpen
waveOutClose
waveOutPrepareHeader

powrprof

CallNtPowerInformation

kernel32

GetSystemDirectoryA
GlobalFree
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
VirtualQuery
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryA
LCMapStringW
LCMapStringA
RtlUnwind
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
IsDebuggerPresent
UnhandledExceptionFilter
GetStdHandle
SetLastError
TlsFree
GetModuleFileNameW
OpenFileMappingW
TerminateThread
DuplicateHandle
CompareStringA
GlobalAlloc
CompareStringW
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
GetTimeZoneInformation
WideCharToMultiByte
GetSystemTimeAsFileTime
GetFullPathNameA
GetDriveTypeA
GetStartupInfoA
ExitProcess
RaiseException
GetSystemTimes
TerminateProcess
WaitForMultipleObjects
CreateEventA
Sleep
OpenFile
MultiByteToWideChar
GetModuleHandleA
LoadLibraryA
GetProcAddress
LoadLibraryW
FreeLibrary
GetUserDefaultUILanguage
GetVersionExA
CloseHandle
CreateProcessA
WaitForSingleObject
HeapFree
GetCurrentProcessId
HeapAlloc
GetProcessHeap
GlobalMemoryStatusEx
OpenProcess
SetThreadPriorityBoost
CreateSemaphoreA
SetEvent
GetSystemInfo
CreateMutexA
SetThreadPriority
ReleaseSemaphore
GetCurrentThreadId
ReleaseMutex
ResetEvent
ResumeThread
CreateThread
GetUserDefaultLangID
GetLastError
TryEnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetThreadPriority
GetCurrentProcess
QueryPerformanceFrequency
GetCurrentThread
QueryPerformanceCounter
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
InterlockedExchangeAdd
GetProcessAffinityMask
GetLocalTime
GetTimeFormatA
GetModuleFileNameA
VirtualFree
GetDateFormatA
VirtualAlloc
CreateFileA
FormatMessageA
SetFileTime
WriteFile
CreateDirectoryA
FindNextFileA
GetFileSizeEx
FindFirstFileA
RemoveDirectoryA
SetFilePointer
SetFileAttributesA
GetFileAttributesA
FindClose
SetEndOfFile
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
DeleteFileA
ReadFile
MoveFileA
CreateFileW
GetFileAttributesW
SetErrorMode
GlobalMemoryStatus
SetUnhandledExceptionFilter
GetWindowsDirectoryA
GetDiskFreeSpaceExA
DeleteFileW
CopyFileA
CreateDirectoryW
FoldStringW
lstrlenA
lstrcatA
lstrcpyA
HeapSetInformation
GetFileSize
UnmapViewOfFile
GetProcessId
MapViewOfFile
CreateFileMappingA
GetTickCount
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
GetCommandLineA
SetThreadAffinityMask
ExpandEnvironmentStringsA
OpenThread
CreateToolhelp32Snapshot
LocalAlloc
Process32First
Process32Next

gdi32

CreateDCA
ExtEscape
DeleteDC
GetStockObject
GetDeviceCaps

advapi32

RegOpenKeyExA
CryptAcquireContextA
RegCloseKey
RegQueryValueExA
RegEnumKeyA
CryptDestroyHash
RegOpenKeyA
CryptHashData
CryptReleaseContext
CryptGetHashParam
CryptCreateHash

shell32

ShellExecuteExA
SHCreateDirectoryExA
SHGetFolderPathW
SHGetFolderPathA
ShellExecuteA

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
OleUninitialize
OleDraw
OleInitialize
CLSIDFromString

oleaut32

SafeArrayCopy
SysFreeString
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
SafeArrayGetVartype
VariantClear
SysAllocString

binkw32

_BinkGetKeyFrame@12
_BinkShouldSkip@4
_BinkRegisterFrameBuffers@8
_BinkNextFrame@4
_BinkSetVolume@12
_BinkWait@4
_BinkGoto@12
_BinkPause@8
_BinkOpenDirectSound@4
_BinkSetSoundSystem@8
_BinkGetSummary@8
_BinkClose@4
_BinkGetFrameBuffersInfo@8
_BinkDoFrame@4
_BinkOpen@8
_BinkSetMemory@8

ws2_32

getsockname
shutdown
inet_ntoa
WSAGetLastError
gethostname
select
__WSAFDIsSet
WSACleanup
sendto
recv
socket
closesocket
gethostbyname
send
connect
recvfrom
ntohl
inet_addr
htonl
htons
ntohs

dinput8

DirectInput8Create

Sections

.text
Size: 8.9MB - Virtual size: 8.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 708KB - Virtual size: 707KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 780KB - Virtual size: 777KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f31573551763ace95ffe6ab6379c2a6a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

0c:56:41:0e:7a:8c:f2:6e:7f:1f:30:6f:fc:e6:70:ccCertificate

Extended Key Usages

Key Usages

9a:98:6d:81:6b:e9:a3:86:6f:65:4c:52:43:4e:ca:94:d1:bb:7d:26Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

wininet

crypt32

psapi

version

dsound

d3d9

xlive

wintrust

atl80

shlwapi

wmvcore

winmm

powrprof

kernel32

gdi32

advapi32

shell32

ole32

oleaut32

binkw32

ws2_32

dinput8

Sections

.text Size: 8.9MB - Virtual size: 8.9MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 1.1MB - Virtual size: 10.4MB

.tls Size: 4KB - Virtual size: 1KB

.rsrc Size: 708KB - Virtual size: 707KB

.reloc Size: 780KB - Virtual size: 777KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

0c:56:41:0e:7a:8c:f2:6e:7f:1f:30:6f:fc:e6:70:cc
Certificate

9a:98:6d:81:6b:e9:a3:86:6f:65:4c:52:43:4e:ca:94:d1:bb:7d:26
Signer

.text
Size: 8.9MB - Virtual size: 8.9MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 1.1MB - Virtual size: 10.4MB

.tls
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 708KB - Virtual size: 707KB

.reloc
Size: 780KB - Virtual size: 777KB