4b9ae35b6dc174b58019ea9f6fc39c77d1c3f6b3fd279bdbce85848f19675d47

Sharing

Copy URL Twitter E-mail

General

Target
4b9ae35b6dc174b58019ea9f6fc39c77d1c3f6b3fd279bdbce85848f19675d47
Size 545KB
Sample260804-qdgrja1enc
SHA256 4b9ae35b6dc174b58019ea9f6fc39c77d1c3f6b3fd279bdbce85848f19675d47
MD5 06631f43a6dce509dc7bfc82844db07d
SHA1 75765db907fb457f24fae1be9c3f6e622126ff7f
SHA512 6381c53bde6d08585b715d49b4394e0631d8541a19a7568c8ea72c9b6ca694e3fb99443571333e9ec3c0f48c11cf10b25fe839fbd049452f20ed3e7b137be6f4
SSDEEP 6144:xGF7iSVW/mSD8TFLdvUKQbDejq8LtPKDVYiykBWTifQeM9b37GVCPA+4Bcyhb5rQ:Y7xo/m8gFLdvU9DejRMVs9UZ
TLSH
T1A0C40741A61D0196F17A6238C49ED673B6B27C105BE19ACB02D07D3B3E3D6E77C392A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
4b9ae35b6dc174b58019ea9f6fc39c77d1c3f6b3fd279bdbce85848f19675d47

File Explorer

4b9ae35b6dc174b58019ea9f6fc39c77d1c3f6b3fd279bdbce85848f19675d47

.exe 545KB

4b9ae35b6dc174b58019ea9f6fc39c77d1c3f6b3fd279bdbce85848f19675d47

IMPHASH 47e752eb9a0687deef00ca59f6617af3
SHA256 4b9ae35b6dc174b58019ea9f6fc39c77d1c3f6b3fd279bdbce85848f19675d47
MD5 06631f43a6dce509dc7bfc82844db07d
SHA1 75765db907fb457f24fae1be9c3f6e622126ff7f
SHA512 6381c53bde6d08585b715d49b4394e0631d8541a19a7568c8ea72c9b6ca694e3fb99443571333e9ec3c0f48c11cf10b25fe839fbd049452f20ed3e7b137be6f4
SSDEEP 6144:xGF7iSVW/mSD8TFLdvUKQbDejq8LtPKDVYiykBWTifQeM9b37GVCPA+4Bcyhb5rQ:Y7xo/m8gFLdvU9DejRMVs9UZ
TLSH
T1A0C40741A61D0196F17A6238C49ED673B6B27C105BE19ACB02D07D3B3E3D6E77C392A1
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

e7:11:8c:8d:61:ee:96:b1:d7:8a:0b:3c:dd:85:48:c2:f3:a2:52:40

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

Chains

Jul 31, 2026

CN=Rockstar Games\, Inc.,OU=Rockstar Games,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

Major OS version

Entry point

540976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GlobalFree LoadResource FindResourceW GlobalLock GlobalUnlock DeleteCriticalSection GetLocalTime InitializeCriticalSection LeaveCriticalSection InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcess GlobalAlloc EnterCriticalSection RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetProcAddress WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount RegisterWaitForSingleObject MoveFileW UnregisterWaitEx GetCurrentThreadId GetCurrentProcessId CreateEventW SetFilePointer LockResource SizeofResource Sleep GetModuleHandleW GetUserDefaultLocaleName SetUnhandledExceptionFilter SetThreadUILanguage GetExitCodeProcess CloseHandle GetLastError GetFileSizeEx OutputDebugStringW IsDebuggerPresent WriteFile FormatMessageA SetLastError WideCharToMultiByte CreateFileW WaitForSingleObject UnhandledExceptionFilter FileTimeToLocalFileTime FileTimeToSystemTime CreateDirectoryW DeleteFileW GetFileAttributesW RemoveDirectoryW GetTempPathW ReleaseMutex CreateMutexW GetSystemTime SystemTimeToFileTime MultiByteToWideChar GetModuleFileNameW

user32

EndPaint BeginPaint UpdateWindow DispatchMessageW GetDesktopWindow PostQuitMessage MessageBoxIndirectW PeekMessageW SystemParametersInfoW DefWindowProcW PostMessageW DestroyWindow SetWindowLongPtrW FillRect CreateWindowExW SendMessageW GetWindowLongPtrW RegisterClassExW ShowWindow MoveWindow TranslateMessage LoadStringW LoadIconW LoadCursorW GetClientRect DrawTextW

gdi32

CreateFontW SetTextColor SetBkMode DeleteObject CreateSolidBrush SelectObject

advapi32

RegSetValueExW RegCreateKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

CommandLineToArgvW ShellExecuteExW ShellExecuteW SHGetKnownFolderPath

ole32

CreateStreamOnHGlobal CoTaskMemFree

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@PEB_W_J@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?good@ios_base@std@@QEBA_NXZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ _Xtime_get_ticks ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ

shlwapi

PathRemoveFileSpecW

winmm

timeGetTime

winhttp

WinHttpReceiveResponse WinHttpReadData WinHttpCrackUrl WinHttpConnect WinHttpQueryOption WinHttpSetStatusCallback WinHttpSendRequest WinHttpCloseHandle WinHttpOpen WinHttpSetOption WinHttpOpenRequest WinHttpQueryHeaders

gdiplus

GdipCreateFromHDC GdipDeleteGraphics GdipFree GdipDisposeImage GdiplusStartup GdiplusShutdown GdipCloneImage GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI

uxtheme

EndBufferedPaint BeginBufferedPaint SetWindowTheme

comctl32

InitCommonControlsEx

crypt32

CertGetNameStringW CertFreeCertificateContext

wintrust

WinVerifyTrust WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain

version

GetFileVersionInfoSizeW VerQueryValueA GetFileVersionInfoW

vcruntime140

_CxxThrowException memcpy memmove memset memchr strchr _purecall __C_specific_handler __std_terminate wcschr __CxxFrameHandler3 __std_exception_copy __std_exception_destroy memcmp

api-ms-win-crt-stdio-l1-1-0

fgetwc __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vsnprintf_s __p__commode fputwc __stdio_common_vswprintf_s _get_stream_buffer_pointers _set_fmode _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fgetc fclose fflush fputc __stdio_common_vswprintf ungetwc

api-ms-win-crt-convert-l1-1-0

_wtoi strtol

api-ms-win-crt-string-l1-1-0

_stricmp wcsncmp wcscat_s strcpy_s tolower toupper towlower towupper _strnicmp strncpy_s strcat_s strncmp wcscpy_s

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _crt_atexit _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm_e exit _exit _invalid_parameter_noinfo_noreturn _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table terminate _initterm

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

312KB

Virtual Size

311KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

53KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

4b9ae35b6dc174b58019ea9f6fc39c77d1c3f6b3fd279bdbce85848f19675d47

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

msvcp140

shlwapi

winmm

winhttp

gdiplus

uxtheme

comctl32

crypt32

wintrust

version

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic