GTA5[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
GTA5.exe
Size 52.4MB
Sample260805-16d68ahj21
SHA256 35269ac593041043230e21db9e5b643e6182acbe65c0b42853ea61bf42ed199a
MD5 e9e3085bc583fde633e560c53afca711
SHA1 060f38c52fcd7264ba3826a09736423d4c861244
SHA512 25ecc39c2eb79f053262abd52d22ca1677bf35c7e8137ded3dbb9ab000d9e5fbfe67eda8f16950cb06b038c1e249cd89cced2d956fd7c933a98dd0be5afea798
SSDEEP 1572864:siKNsNJCb5S4Kn04u1DgxgNUpsJ1UTWsZ:svOCW0rgxgNUi2
TLSH
T123C71206B602DDD6F50B9A7188ABDB918766BC718E9147173298333F9F7D3ACCDA0058
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
GTA5.exe

File Explorer

GTA5.exe

.exe 52.4MB

GTA5.exe

IMPHASH d4b1e3e7490983f01fa29329838dfde7
SHA256 35269ac593041043230e21db9e5b643e6182acbe65c0b42853ea61bf42ed199a
MD5 e9e3085bc583fde633e560c53afca711
SHA1 060f38c52fcd7264ba3826a09736423d4c861244
SHA512 25ecc39c2eb79f053262abd52d22ca1677bf35c7e8137ded3dbb9ab000d9e5fbfe67eda8f16950cb06b038c1e249cd89cced2d956fd7c933a98dd0be5afea798
SSDEEP 1572864:siKNsNJCb5S4Kn04u1DgxgNUpsJ1UTWsZ:svOCW0rgxgNUi2
TLSH
T123C71206B602DDD6F50B9A7188ABDB918766BC718E9147173298333F9F7D3ACCDA0058
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

97:14:7f:77:1c:9c:0a:1b:03:3c:40:8f:ef:c7:09:07:58:6f:b5:8c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Chains

Sep 2, 2015

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Subject

CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

4c:17:93:3f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2014 - Dec 10, 2017

Subject

Serial Number

38:63:e2:e2

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 10, 2009 - Sep 10, 2019

Subject

Serial Number

4c:0e:8c:3a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 11, 2011 - Nov 12, 2021

Subject

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Serial Number

4c:17:a7:7c

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 8, 2015 - May 10, 2016

Minor OS version

Major OS version

Entry point

23363356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

X:\gta5\titleupdate\dev_ng_live\game_win64_master.pdb

kernel32

GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FlushFileBuffers GetCurrentDirectoryW GetConsoleMode GetConsoleCP GetCPInfo GetOEMCP GetACP IsValidCodePage IsProcessorFeaturePresent IsDebuggerPresent GetEnvironmentStringsW GetStartupInfoW GetFileType GetStdHandle SetLastError FindFirstFileExW HeapReAlloc GetModuleHandleExW HeapSize GetFullPathNameA GetDriveTypeW GetTimeZoneInformation RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader DecodePointer EncodePointer ResetEvent GetSystemTimeAsFileTime GetFileTime VerifyVersionInfoW VerSetConditionMask GetThreadContext InitializeCriticalSection CreateFileA LoadLibraryExW GetOverlappedResult GetSystemDefaultUILanguage VerifyVersionInfoA OutputDebugStringA SetThreadExecutionState WerSetFlags QueryPerformanceCounter ReadConsoleW SetStdHandle GetFileInformationByHandle PeekNamedPipe GetFullPathNameW OutputDebugStringW LoadLibraryW CreateSemaphoreA CreateMutexA GetSystemInfo ReleaseMutex ReleaseSemaphore SetEvent DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection ResumeThread GetStringTypeW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW WriteConsoleW SetEnvironmentVariableA CreateProcessW GetSystemDirectoryW lstrcmpA GetThreadPriority SetThreadPriorityBoost SetThreadPriority GetConsoleWindow FreeEnvironmentStringsW GetModuleHandleA GetThreadId GetCurrentThreadId OpenProcess GetCurrentProcessId ExitProcess CloseHandle GetModuleFileNameA GetCommandLineA CreateToolhelp32Snapshot Process32First Process32Next GetDiskFreeSpaceExA DeleteFileW GetFileSize WriteFile ReadFile FindClose lstrcpyA lstrcpyW lstrcatW lstrlenA CreateFileW GetFileAttributesW FindFirstFileW FindNextFileW MultiByteToWideChar WaitForMultipleObjects GetDiskFreeSpaceExW FindFirstChangeNotificationA FindNextChangeNotification FindCloseChangeNotification WaitForSingleObject FreeLibrary GetProcAddress GlobalMemoryStatusEx LocalAlloc LocalFree GetSystemFirmwareTable GetCurrentProcess SetHandleInformation GetNativeSystemInfo CreatePipe LoadLibraryA CreateProcessA GetEnvironmentVariableA GetWindowsDirectoryA GetVolumeInformationA QueryPerformanceFrequency GetVersionExA WideCharToMultiByte GetUserDefaultUILanguage GetSystemDefaultLocaleName GetWriteWatch ResetWriteWatch VirtualQueryEx ReadProcessMemory GetModuleFileNameW GetModuleHandleExA DeleteFileA Sleep SetFilePointer CreateEventA TerminateProcess GetLastError SetEndOfFile SetFilePointerEx SetFileTime GetLocalTime FileTimeToLocalFileTime FileTimeToSystemTime GetTempPathW CreateDirectoryW RemoveDirectoryW SetFileAttributesW GetFileAttributesExW MoveFileExW VirtualAlloc VirtualFree VirtualProtect HeapAlloc HeapFree GetProcessHeap GetProcessAffinityMask CreateThread GetCurrentThread AddVectoredExceptionHandler RemoveVectoredExceptionHandler VirtualQuery

user32

ShowWindow SetWindowsHookExA UnhookWindowsHookEx CallNextHookEx RegisterRawInputDevices GetRawInputData ClientToScreen GetCursorPos SetCursorPos ShowCursor MapVirtualKeyExW MapVirtualKeyW MapVirtualKeyA GetKeyState GetDoubleClickTime SendMessageW GetKeyboardLayout GetKeyboardLayoutList UnloadKeyboardLayout ActivateKeyboardLayout LoadKeyboardLayoutW GetMonitorInfoA LockSetForegroundWindow LoadIconA LoadCursorA GetParent ClipCursor GetForegroundWindow GetSystemMetrics KillTimer SetTimer ReleaseCapture SetCapture GetCapture SetFocus CreateWindowExW RegisterClassW PostMessageA PeekMessageW DispatchMessageW TranslateMessage GetCursorInfo SetWindowLongPtrA UpdateWindow SetWindowPos GetClientRect GetWindowRect AdjustWindowRect GetWindowLongA MessageBoxW GetWindowLongPtrA SystemParametersInfoA GetDesktopWindow DefWindowProcW

gfsdk_shadowlib.win64

?NV_ShadowLib_OpenDX@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@QEIAUNV_ShadowLib_Ctx@@QEIAUID3D11Device@@QEIAUID3D11DeviceContext@@PEAUgfsdk_new_delete_t@@@Z ?NV_ShadowLib_GetVersion@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@@Z ?NV_ShadowLib_DevModeToggleDebugEyeViewZShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z ?NV_ShadowLib_RemoveBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAPEAI@Z ?NV_ShadowLib_ClearBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI@Z ?NV_ShadowLib_AddBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_BufferDesc@@PEAPEAI@Z ?NV_ShadowLib_RenderBufferUsingExternalMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_ExternalMapDesc@@PEAUID3D11ShaderResourceView@@PEAIPEAUNV_ShadowLib_BufferRenderParams@@@Z ?NV_ShadowLib_FinalizeBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAPEAUID3D11ShaderResourceView@@@Z ?NV_ShadowLib_ModulateBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@Ugfsdk_float3@@@Z ?NV_ShadowLib_DevModeToggleDebugCascadeShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

dsound

ord8 ord6 ord9 ord3 ord1

bink2w64

BinkSetSoundTrack BinkDoFrameAsyncWait BinkDoFrameAsync BinkShouldSkip BinkSetVolume BinkSetIO BinkGoto BinkPause BinkClose BinkWait BinkNextFrame BinkSetFrameRate BinkGetKeyFrame BinkStartAsyncThread BinkRequestStopAsyncThread BinkWaitStopAsyncThread BinkOpen BinkGetFrameBuffersInfo BinkSetSoundSystem BinkSetMemory BinkOpenDirectSound BinkRegisterFrameBuffers

ws2_32

getpeername getsockname inet_addr listen recv send setsockopt socket gethostbyname gethostname WSAStartup ioctlsocket WSAGetLastError __WSAFDIsSet recvfrom select sendto shutdown getaddrinfo freeaddrinfo getnameinfo ntohs htons connect closesocket bind WSACleanup accept

winmm

timeEndPeriod timeBeginPeriod timeGetTime

psapi

GetModuleFileNameExA EnumProcessModules

mf

MFShutdownObject MFCreatePresentationClock MFGetService MFCreateSourceResolver MFCreateASFProfile MFCreateASFMediaSinkActivate MFCreateASFContentInfo

mfplat

MFTEnum MFCreateSystemTimeSource MFCreateSample MFGetSystemTime MFCreateMemoryBuffer MFInitAMMediaTypeFromMFMediaType MFCreateAttributes MFShutdown MFCreateMediaType MFStartup

msdmo

MoFreeMediaType

mfreadwrite

MFCreateSourceReaderFromMediaSource MFCreateSinkWriterFromURL

propsys

PropVariantToInt64 PropVariantGetStringElem PSStringFromPropertyKey PropVariantToStringWithDefault PropVariantToUInt64

crypt32

CryptMsgGetParam CertFindCertificateInStore CryptQueryObject CertGetNameStringA

wintrust

WinVerifyTrust WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

d3d9

D3DPERF_EndEvent D3DPERF_BeginEvent

d3dcompiler_43

D3DReflect

gfsdk_txaa_alpharesolve.win64

TxaaOpenDX TxaaResolveDX

imm32

ImmGetContext ImmReleaseContext ImmGetCompositionStringW ImmSetCompositionStringW ImmGetCandidateListW ImmSetConversionStatus ImmGetConversionStatus

dinput8

DirectInput8Create

xinput1_3

ord2 ord3

rpcrt4

UuidCreateSequential

iphlpapi

GetIpAddrTable GetBestRoute

shlwapi

SHStrDupW

gdi32

GetDeviceCaps DeleteDC CreateDCA ExtEscape GetStockObject

advapi32

RegCloseKey RegQueryValueExA GetUserNameA RegQueryValueExW RegOpenKeyExW CryptAcquireContextA RegOpenKeyExA

shell32

ShellExecuteW SHCreateDirectoryExW ShellExecuteExA ShellExecuteA SHGetFolderPathW

ole32

CoCreateInstance CoInitializeEx CoLockObjectExternal PropVariantClear CoTaskMemFree CoInitialize CoSetProxyBlanket CoUninitialize CoInitializeSecurity

oleaut32

VariantInit VariantClear SysAllocString SysFreeString SysStringLen SysAllocStringByteLen

Name

.text

Size

23.4MB

Virtual Size

23.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINK

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

BINKBSS

Size

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.2MB

Virtual Size

16.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

975KB

Virtual Size

975KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BINKCONS

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

183KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

462KB

Virtual Size

462KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

21.7MB

Virtual Size

21.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

generic

count=2, id=156, productName=VS2010 build 30319, version=30319,

count=4, id=156, version=21202,

count=2, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=1, productName=Unmarked objects (old),

count=38, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=2, id=173, version=30319,

count=7, id=207, productName=VS2012 UPD4 build 61030, version=61030,

count=4, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=2, id=203, version=50929,

count=2, id=199, version=41118,

count=35, id=205, version=50929,

count=88, id=207, version=50929,

count=278, id=206, version=50929,

count=61, id=206, productName=VS2012 UPD1 build 51106, version=51106,

count=2, id=136, version=30729,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=9, id=135, version=30729,

count=55, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=454, id=1, productName=Unmarked objects,

count=144, id=207, productName=VS2012 UPD1 build 51106, version=51106,

count=1, id=201, productName=VS2012 UPD1 build 51106, version=51106,

count=1, id=204, productName=VS2012 UPD1 build 51106, version=51106,