GTA5[.]exe | Triage

Resubmissions

20/08/2024, 12:53

240820-p4vkmswgpm 1

20/08/2024, 12:50

240820-p3febswfrl 4

Sharing

Copy URL

Twitter E-mail

General

Target

GTA5.exe
Size

69.4MB
MD5

4969170d5492c6ab0b7b8e32e85b8fe2
SHA1

0ca34032eb939765252fefba33d8fcdb317ca732
SHA256

9ff48d2f22dd3ba3d0c3793be228169fc2c757375af1eb6e228a096bc56826a6
SHA512

a289df100227b1813937eb9ec3c82d6c88dd56280c60db30c351a0bb08962f6762088a2316d40d0b80575cd15a484189a0b7f38626aacff7141a35cb636dfbd6
SSDEEP

1572864:9MDayFoogEc3mTmLZmtnRpNYJRCGQ6nkiBJYb9U+rJ:9MDbyn+m18JckiBqbS8

Score

1^/10

Malware Config

Signatures

Files

GTA5.exe
.exe windows:5 windows x64 arch:x64

e65af0b4f2acb4188b709506dbf03cfe

Code Sign

d3:7a:a6:dd:b5:cc:32:da:00:00:00:00:4c:18:16:3e
Certificate

Issuer

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Not Before

09/11/2017, 16:27

Not After

09/11/2020, 16:57

Subject

CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

38:63:e2:e2
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

10/09/2009, 21:59

Not After

10/09/2019, 22:29

Subject

CN=Entrust Code Signing Certification Authority - L1D,OU=www.entrust.net/rpa is incorporated by reference+OU=(c) 2009 Entrust\, Inc.,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10/06/2015, 13:46

Not After

10/11/2030, 14:16

Subject

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3e
Certificate

Issuer

CN=Entrust Code Signing CA - OVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

09/03/2017, 22:04

Not After

20/03/2020, 22:34

Subject

CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c5:ee:74:95:60:6d:3a:a5:19:f5:df:13:1a:f6:ac:be:5f:47:a8:79
Signer

Actual PE Digest

c5:ee:74:95:60:6d:3a:a5:19:f5:df:13:1a:f6:ac:be:5f:47:a8:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

x:\gta5\titleupdate\dev_ng_Live\game_win64_steammaster.pdb

Imports

kernel32

UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
FlushFileBuffers
GetCurrentDirectoryW
GetConsoleMode
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetConsoleCP
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsProcessorFeaturePresent
IsDebuggerPresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStartupInfoW
GetFileType
GetStdHandle
SetLastError
FindFirstFileExW
HeapReAlloc
HeapSize
GetFullPathNameA
GetDriveTypeW
GetTimeZoneInformation
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
DecodePointer
EncodePointer
ResetEvent
GetFileTime
VerifyVersionInfoW
VerSetConditionMask
InitializeCriticalSection
GetSystemTimeAsFileTime
CreateFileA
LoadLibraryExW
GetOverlappedResult
GetSystemDefaultUILanguage
VerifyVersionInfoA
OutputDebugStringA
SetThreadExecutionState
WerSetFlags
QueryPerformanceCounter
CreateSemaphoreA
CreateMutexA
GetSystemInfo
ReleaseMutex
ReleaseSemaphore
SetEvent
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
ResumeThread
GetThreadPriority
SetThreadPriorityBoost
SetThreadPriority
GetThreadId
GetCurrentThreadId
ReadConsoleW
SetStdHandle
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
OutputDebugStringW
CreateThread
GetProcessAffinityMask
GetProcessHeap
HeapFree
HeapAlloc
VirtualProtect
VirtualFree
VirtualAlloc
MoveFileExW
GetFileAttributesExW
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
LoadLibraryW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
WriteConsoleW
SetEnvironmentVariableA
CreateProcessW
GetSystemDirectoryW
lstrcmpA
GetTempPathW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLocalTime
GetConsoleWindow
GetModuleHandleExW
GetModuleHandleA
SetFileTime
SetFilePointerEx
OpenProcess
GetCurrentProcessId
ExitProcess
CloseHandle
GetModuleFileNameA
GetModuleFileNameW
GetCommandLineA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetDiskFreeSpaceExA
DeleteFileW
GetFileSize
WriteFile
ReadFile
FindClose
lstrcpyA
lstrcpyW
lstrcatW
lstrlenA
CreateFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
MultiByteToWideChar
WaitForMultipleObjects
GetDiskFreeSpaceExW
FindFirstChangeNotificationA
FindNextChangeNotification
FindCloseChangeNotification
WaitForSingleObject
FreeLibrary
GetProcAddress
GlobalMemoryStatusEx
GetSystemFirmwareTable
SetHandleInformation
GetNativeSystemInfo
CreatePipe
LoadLibraryA
CreateProcessA
GetEnvironmentVariableA
GetWindowsDirectoryA
GetVolumeInformationA
QueryPerformanceFrequency
GetVersionExA
WideCharToMultiByte
GetUserDefaultUILanguage
GetSystemDefaultLocaleName
VirtualQueryEx
ReadProcessMemory
GetModuleHandleExA
LocalAlloc
LocalFree
GetCurrentProcess
RaiseException
GetCurrentThread
GetThreadContext
DeleteFileA
Sleep
SetFilePointer
CreateEventA
TerminateProcess
GetLastError
SetEndOfFile
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQuery

user32

ShowWindow
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
DefWindowProcW
GetDesktopWindow
RegisterRawInputDevices
GetRawInputData
ClientToScreen
GetCursorPos
SetCursorPos
ShowCursor
MapVirtualKeyExW
MapVirtualKeyW
MapVirtualKeyA
GetKeyState
GetDoubleClickTime
SendMessageW
GetKeyboardLayout
GetKeyboardLayoutList
UnloadKeyboardLayout
ActivateKeyboardLayout
LoadKeyboardLayoutW
GetMonitorInfoA
LockSetForegroundWindow
LoadIconA
LoadCursorA
SystemParametersInfoA
GetWindowLongPtrA
MessageBoxW
GetWindowLongA
AdjustWindowRect
GetWindowRect
GetParent
ClipCursor
GetForegroundWindow
GetSystemMetrics
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetCapture
SetFocus
CreateWindowExW
RegisterClassW
PostMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
GetCursorInfo
SetWindowLongPtrA
UpdateWindow
GetClientRect
SetWindowPos

steam_api64

SteamAPI_RegisterCallback
SteamInternal_ContextInit
SteamAPI_GetHSteamUser
SteamAPI_GetHSteamPipe
SteamAPI_RestartAppIfNecessary
SteamAPI_Init
SteamAPI_UnregisterCallback
SteamAPI_RunCallbacks
SteamInternal_CreateInterface

gfsdk_shadowlib.win64

?NV_ShadowLib_RenderBufferUsingExternalMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_ExternalMapDesc@@PEAUID3D11ShaderResourceView@@PEAIPEAUNV_ShadowLib_BufferRenderParams@@@Z
?NV_ShadowLib_AddBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_BufferDesc@@PEAPEAI@Z
?NV_ShadowLib_FinalizeBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAPEAUID3D11ShaderResourceView@@@Z
?NV_ShadowLib_OpenDX@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@QEIAUNV_ShadowLib_Ctx@@QEIAUID3D11Device@@QEIAUID3D11DeviceContext@@PEAUgfsdk_new_delete_t@@@Z
?NV_ShadowLib_GetVersion@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@@Z
?NV_ShadowLib_DevModeToggleDebugEyeViewZShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_DevModeToggleDebugCascadeShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_RemoveBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAPEAI@Z
?NV_ShadowLib_ModulateBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@Ugfsdk_float3@@@Z
?NV_ShadowLib_ClearBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI@Z

ws2_32

recv
send
setsockopt
gethostname
WSAGetLastError
__WSAFDIsSet
getsockopt
recvfrom
listen
sendto
shutdown
freeaddrinfo
htonl
WSAAddressToStringA
getnameinfo
ntohl
inet_addr
getsockname
getpeername
bind
ioctlsocket
accept
ntohs
getaddrinfo
WSAStartup
gethostbyname
socket
htons
select
closesocket
connect
WSACleanup

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

dsound

ord9
ord8
ord1
ord3
ord6

bink2w64

BinkSetFrameRate
BinkShouldSkip
BinkDoFrameAsyncWait
BinkOpenDirectSound
BinkSetSoundSystem
BinkSetIO
BinkDoFrameAsync
BinkSetSoundTrack
BinkStartAsyncThread
BinkRequestStopAsyncThread
BinkWaitStopAsyncThread
BinkOpen
BinkSetVolume
BinkGetKeyFrame
BinkGoto
BinkPause
BinkClose
BinkWait
BinkNextFrame
BinkRegisterFrameBuffers
BinkGetFrameBuffersInfo
BinkSetMemory

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

psapi

EnumProcessModules
GetModuleBaseNameA
GetModuleInformation
GetModuleFileNameExA

mf

MFCreateASFProfile
MFCreateASFMediaSinkActivate
MFGetService
MFCreateSourceResolver
MFShutdownObject
MFCreateASFContentInfo
MFCreatePresentationClock

mfplat

MFGetSystemTime
MFCreateSample
MFCreateMemoryBuffer
MFCreateSystemTimeSource
MFInitAMMediaTypeFromMFMediaType
MFCreateAttributes
MFShutdown
MFStartup
MFCreateMediaType
MFTEnum

msdmo

MoFreeMediaType

mfreadwrite

MFCreateSourceReaderFromMediaSource
MFCreateSinkWriterFromURL

propsys

PropVariantToUInt32
PropVariantGetStringElem
PSStringFromPropertyKey
PropVariantToUInt64
PropVariantToInt64
PropVariantToStringWithDefault

crypt32

CertGetNameStringA
CryptMsgGetParam
CryptQueryObject
CertFindCertificateInStore

wintrust

WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

d3d9

D3DPERF_EndEvent
D3DPERF_BeginEvent

d3dcompiler_43

D3DReflect

gfsdk_txaa_alpharesolve.win64

TxaaOpenDX
TxaaResolveDX

imm32

ImmGetContext
ImmReleaseContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmGetConversionStatus
ImmSetConversionStatus

dinput8

DirectInput8Create

xinput1_3

ord3
ord2

rpcrt4

UuidCreateSequential

iphlpapi

GetIpAddrTable
GetBestRoute
GetIpForwardTable

shlwapi

SHStrDupW

gdi32

GetDeviceCaps
DeleteDC
CreateDCA
GetStockObject
ExtEscape

advapi32

GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExW
CryptAcquireContextA
RegCloseKey

shell32

ShellExecuteW
SHCreateDirectoryExW
ShellExecuteExA
ShellExecuteA
SHGetFolderPathW

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemFree
PropVariantClear
CoUninitialize
CoInitialize
CoLockObjectExternal

oleaut32

SysAllocStringByteLen
VariantClear
VariantInit
SysStringLen
SysFreeString
SysAllocString

Sections

.text
Size: 24.5MB - Virtual size: 24.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINK
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

BINKBSS
Size: - Virtual size: 96B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.3MB - Virtual size: 18.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1018KB - Virtual size: 1018KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BINKCONS
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 481KB - Virtual size: 481KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 37.3MB - Virtual size: 37.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

e65af0b4f2acb4188b709506dbf03cfe

Code Sign

d3:7a:a6:dd:b5:cc:32:da:00:00:00:00:4c:18:16:3eCertificate

Extended Key Usages

Key Usages

38:63:e2:e2Certificate

Key Usages

43:c1:0b:1c:00:00:00:00:51:d3:73:daCertificate

Extended Key Usages

Key Usages

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3eCertificate

Extended Key Usages

Key Usages

c5:ee:74:95:60:6d:3a:a5:19:f5:df:13:1a:f6:ac:be:5f:47:a8:79Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

steam_api64

gfsdk_shadowlib.win64

ws2_32

version

dsound

bink2w64

winmm

psapi

mf

mfplat

msdmo

mfreadwrite

propsys

crypt32

wintrust

wtsapi32

d3d9

d3dcompiler_43

gfsdk_txaa_alpharesolve.win64

imm32

dinput8

xinput1_3

rpcrt4

iphlpapi

shlwapi

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 24.5MB - Virtual size: 24.5MB

BINK Size: 3KB - Virtual size: 3KB

BINKBSS Size: - Virtual size: 96B

.rdata Size: 3.6MB - Virtual size: 3.6MB

.data Size: 2.3MB - Virtual size: 18.0MB

.pdata Size: 1018KB - Virtual size: 1018KB

.tls Size: 2KB - Virtual size: 2KB

BINKCONS Size: 512B - Virtual size: 512B

.rsrc Size: 183KB - Virtual size: 183KB

.reloc Size: 481KB - Virtual size: 481KB

.text Size: 37.3MB - Virtual size: 37.3MB

d3:7a:a6:dd:b5:cc:32:da:00:00:00:00:4c:18:16:3e
Certificate

38:63:e2:e2
Certificate

43:c1:0b:1c:00:00:00:00:51:d3:73:da
Certificate

e4:9e:47:11:1f:ec:98:cd:00:00:00:00:55:66:2b:3e
Certificate

c5:ee:74:95:60:6d:3a:a5:19:f5:df:13:1a:f6:ac:be:5f:47:a8:79
Signer

.text
Size: 24.5MB - Virtual size: 24.5MB

BINK
Size: 3KB - Virtual size: 3KB

BINKBSS
Size: - Virtual size: 96B

.rdata
Size: 3.6MB - Virtual size: 3.6MB

.data
Size: 2.3MB - Virtual size: 18.0MB

.pdata
Size: 1018KB - Virtual size: 1018KB

.tls
Size: 2KB - Virtual size: 2KB

BINKCONS
Size: 512B - Virtual size: 512B

.rsrc
Size: 183KB - Virtual size: 183KB

.reloc
Size: 481KB - Virtual size: 481KB

.text
Size: 37.3MB - Virtual size: 37.3MB