gta_sa[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gta_sa.exe
Size 13.7MB
Sample260720-wnf6mscs9v
SHA256 f01a00ce950fa40ca1ed59df0e789848c6edcf6405456274965885d0929343ac
MD5 2b5066bd4097ac2944ce6a9cf8fe5677
SHA1 8c23ceffafa9fd88ea567be7926a33413b8e3c00
SHA512 eee8ca9a762168607f9820c7779e7831cad778f35708845ab57c9c88a12d79ee5d67dc6d2981085fd69859b248912a49122b2c3dae700232894b6d3a04ec020f
SSDEEP 196608:qYQnnDbxRXCeeVJGfp/N+AYqyL3TTrbJvvAi80JFCC:qXnDbnyeeVJGfJN+n1r
TLSH
T13DE6F4AB5B65D6FAC75D2932D493E13F4E3808F3CD153E23E166E909B872793902B181
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gta_sa.exe

File Explorer

gta_sa.exe

.exe 13.7MB

gta_sa.exe

IMPHASH 83fa14dca08906691b3ff3778b54b308
SHA256 f01a00ce950fa40ca1ed59df0e789848c6edcf6405456274965885d0929343ac
MD5 2b5066bd4097ac2944ce6a9cf8fe5677
SHA1 8c23ceffafa9fd88ea567be7926a33413b8e3c00
SHA512 eee8ca9a762168607f9820c7779e7831cad778f35708845ab57c9c88a12d79ee5d67dc6d2981085fd69859b248912a49122b2c3dae700232894b6d3a04ec020f
SSDEEP 196608:qYQnnDbxRXCeeVJGfp/N+AYqyL3TTrbJvvAi80JFCC:qXnDbnyeeVJGfJN+n1r
TLSH
T13DE6F4AB5B65D6FAC75D2932D493E13F4E3808F3CD153E23E166E909B872793902B181
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4343152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeEndPeriod timeGetTime timeBeginPeriod timeGetDevCaps

vorbisfile

ov_open_callbacks ov_clear ov_time_total ov_time_tell ov_read ov_info ov_time_seek

ws2_32

recv send closesocket htons inet_addr connect WSAGetLastError WSAStartup WSACleanup socket

eax

ord6

kernel32

VirtualProtect GetOEMCP GetACP IsBadCodePtr IsBadReadPtr GetStringTypeW GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetCPInfo GetDateFormatA VirtualQuery GetTickCount GetModuleHandleA GetProcAddress LoadLibraryA GetFileSize CloseHandle LocalFree WaitForSingleObjectEx GetOverlappedResult WaitForSingleObject ReleaseSemaphore SetFilePointer GetLastError ReadFile SetLastError CreateFileA ResumeThread SetThreadPriority GetThreadPriority GetCurrentThread CreateThread LocalAlloc CreateSemaphoreA GetDiskFreeSpaceA Sleep QueryPerformanceCounter InterlockedIncrement InterlockedDecrement lstrcpyA lstrcatA lstrlenA DeleteCriticalSection SuspendThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSection MultiByteToWideChar DeleteFileA TerminateThread FindClose FindNextFileA GetFileAttributesA FindFirstFileA FreeLibrary QueryPerformanceFrequency OutputDebugStringA GetLocalTime CreateDirectoryA GetUserDefaultLCID SetStdHandle CreateEventA GetVolumeInformationA GetDriveTypeA GetLogicalDriveStringsA SetErrorMode GlobalMemoryStatus GetVersionExA GetCommandLineA GetFullPathNameA WideCharToMultiByte lstrcmpiA GetSystemInfo IsProcessorFeaturePresent LockResource LoadResource SizeofResource FindResourceA FindResourceW MapViewOfFile CreateFileMappingA CreateFileW UnmapViewOfFile ReleaseMutex CreateMutexA GetCurrentProcessId GetSystemDirectoryA GetModuleFileNameA FreeEnvironmentStringsA UnhandledExceptionFilter IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy GetFileType GetStdHandle SetHandleCount FlushFileBuffers LCMapStringW LCMapStringA WriteFile FatalAppExitA SetUnhandledExceptionFilter HeapSize TlsAlloc TlsGetValue TlsSetValue GetCurrentThreadId TlsFree GetStartupInfoA HeapReAlloc HeapAlloc HeapFree GetSystemTimeAsFileTime GetCurrentProcess TerminateProcess ExitProcess RtlUnwind RaiseException InterlockedExchange FreeEnvironmentStringsW GetEnvironmentStringsW SetConsoleCtrlHandler GetTimeFormatA CompareStringA CompareStringW SetEnvironmentVariableA GetTimeZoneInformation SetEndOfFile GetLocaleInfoW GetCurrentDirectoryA GetSystemDefaultLCID SetCurrentDirectoryA GetEnvironmentStrings

user32

wsprintfA IsIconic GetWindowLongA GetMenu AdjustWindowRectEx SystemParametersInfoA DestroyWindow SetWindowLongA ShowWindow LoadIconA LoadCursorA RegisterClassA ReleaseCapture GetWindowPlacement SetTimer ClipCursor PostQuitMessage SetCursor SetCapture DefWindowProcA MapVirtualKeyA UpdateWindow GetKeyState FindWindowA SetForegroundWindow PeekMessageA DispatchMessageA TranslateMessage GetKeyboardLayout DialogBoxParamA EndDialog GetDlgItem SetFocus SendMessageA SetWindowPos AdjustWindowRect CreateWindowExA ShowCursor GetWindowRect MessageBoxA SetWindowTextA ClientToScreen SetCursorPos GetClientRect

gdi32

DeleteObject

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegOpenKeyA RegSetValueExA

ole32

CoCreateInstance CoInitialize CoUninitialize

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_rwcseg

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

301KB

Virtual Size

304KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

256KB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_TEXT_HA

Size

67KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_rwdseg

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.init

Size

22KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.HOODLUM

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

gta_sa.exe

winmm

vorbisfile

ws2_32

eax

kernel32

user32

gdi32

advapi32

ole32

generic