gta_sa[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
gta_sa.exe
Size 15.1MB
Sample260806-rn459ashpf
SHA256 af63c3b85c5a30a1fb4318ede6add911933ccc63ddac2f57eb63b7fbe212b8e2
MD5 a2929a61e4d63dd3c15749b2b7ed74ae
SHA1 3a184bf69104e52e8396261432d9324211ef74bc
SHA512 99aa7fc8d89779aae8ef18819927070d93a380fe5991b1dc949c03dda45351b889adfb7d834f92ed8bff3d0b66b6522be5f37078eaeae993d78e04ae463c772b
SSDEEP 196608:B/DilPG7k1Cv4CJmV/UT5c2dFmSfyL3cC5kjzC5TnZHCtpAdjOAZ/ss:B/ulPG7wCACJmV/UTa0pLPMZ/X
TLSH
T1F7F649679B2592F9C66D2972D4E7E13E8E3409A3CF153ED3E195E909B9327D3903B080
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
gta_sa.exe

File Explorer

gta_sa.exe

.exe 15.1MB

gta_sa.exe

IMPHASH 94d2e3e9ed67b3408c90b8ce6e445946
SHA256 af63c3b85c5a30a1fb4318ede6add911933ccc63ddac2f57eb63b7fbe212b8e2
MD5 a2929a61e4d63dd3c15749b2b7ed74ae
SHA1 3a184bf69104e52e8396261432d9324211ef74bc
SHA512 99aa7fc8d89779aae8ef18819927070d93a380fe5991b1dc949c03dda45351b889adfb7d834f92ed8bff3d0b66b6522be5f37078eaeae993d78e04ae463c772b
SSDEEP 196608:B/DilPG7k1Cv4CJmV/UT5c2dFmSfyL3cC5kjzC5TnZHCtpAdjOAZ/ss:B/ulPG7wCACJmV/UTa0pLPMZ/X
TLSH
T1F7F649679B2592F9C66D2972D4E7E13E8E3409A3CF153ED3E195E909B9327D3903B080
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4346672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeEndPeriod timeGetTime timeBeginPeriod timeGetDevCaps

vorbisfile

ov_open_callbacks ov_clear ov_time_total ov_time_tell ov_read ov_info ov_time_seek

ws2_32

recv send closesocket htons inet_addr connect WSAGetLastError WSAStartup WSACleanup socket

eax

ord6

kernel32

VirtualProtect GetOEMCP GetACP IsBadCodePtr IsBadReadPtr GetStringTypeW GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetCPInfo GetDateFormatA VirtualQuery GetTickCount GetModuleHandleA GetProcAddress LoadLibraryA GetFileSize CloseHandle LocalFree WaitForSingleObjectEx GetOverlappedResult WaitForSingleObject ReleaseSemaphore SetFilePointer GetLastError ReadFile SetLastError CreateFileA ResumeThread SetThreadPriority GetThreadPriority GetCurrentThread CreateThread LocalAlloc CreateSemaphoreA GetDiskFreeSpaceA Sleep QueryPerformanceCounter InterlockedIncrement InterlockedDecrement lstrcatA lstrcpyA lstrlenA DeleteCriticalSection SuspendThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSection MultiByteToWideChar DeleteFileA TerminateThread FindClose FindNextFileA GetFileAttributesA FindFirstFileA FreeLibrary QueryPerformanceFrequency OutputDebugStringA GetLocalTime CreateDirectoryA GetUserDefaultLCID SetStdHandle CreateEventA GetVolumeInformationA GetDriveTypeA GetLogicalDriveStringsA SetErrorMode GlobalMemoryStatus GetVersionExA GetCommandLineA GetFullPathNameA WideCharToMultiByte lstrcmpiA GetSystemInfo IsProcessorFeaturePresent LockResource LoadResource SizeofResource FindResourceA FindResourceW MapViewOfFile CreateFileMappingA CreateFileW UnmapViewOfFile ReleaseMutex CreateMutexA GetCurrentProcessId GetSystemDirectoryA GetModuleFileNameA FreeEnvironmentStringsA UnhandledExceptionFilter IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy GetFileType GetStdHandle SetHandleCount FlushFileBuffers LCMapStringW LCMapStringA WriteFile FatalAppExitA SetUnhandledExceptionFilter HeapSize TlsAlloc TlsGetValue TlsSetValue GetCurrentThreadId TlsFree GetStartupInfoA HeapReAlloc HeapAlloc HeapFree GetSystemTimeAsFileTime GetCurrentProcess TerminateProcess ExitProcess RtlUnwind RaiseException InterlockedExchange FreeEnvironmentStringsW GetEnvironmentStringsW SetConsoleCtrlHandler GetTimeFormatA CompareStringA CompareStringW SetEnvironmentVariableA GetTimeZoneInformation SetEndOfFile GetLocaleInfoW GetCurrentDirectoryA GetSystemDefaultLCID SetCurrentDirectoryA GetEnvironmentStrings

user32

wsprintfA IsIconic GetWindowLongA GetMenu AdjustWindowRectEx SystemParametersInfoA DestroyWindow SetWindowLongA ShowWindow LoadIconA LoadCursorA RegisterClassA ReleaseCapture GetWindowPlacement SetTimer ClipCursor PostQuitMessage SetCursor SetCapture DefWindowProcA MapVirtualKeyA UpdateWindow GetKeyState FindWindowA SetForegroundWindow PeekMessageA DispatchMessageA TranslateMessage GetKeyboardLayout DialogBoxParamA EndDialog GetDlgItem SetFocus SendMessageA SetWindowPos AdjustWindowRect CreateWindowExA ShowCursor GetWindowRect MessageBoxA SetWindowTextA ClientToScreen SetCursorPos GetClientRect

gdi32

DeleteObject

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegOpenKeyA RegSetValueExA

ole32

CoCreateInstance CoInitialize CoUninitialize

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_rwcseg

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

300KB

Virtual Size

304KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

261KB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_TEXT_HA

Size

66KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_rwdseg

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

5.1MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dev1

Size

585KB

Virtual Size

12.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dev2

Size

1.7MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=8, id=39, version=9162,

count=49, id=64, productName=VS2002 (.NET) build 9466, version=9466,

count=165, id=28, productName=VS2002 (.NET) build 9466, version=9466,

count=2, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=5, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=2, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,

count=5, id=28, version=9178,

count=15, id=25, version=9210,

count=218, id=1, productName=Unmarked objects,

count=3, id=42, version=8803,

count=6, id=18, version=8444,

count=48, id=29, version=9178,

count=121, id=48, version=9044,

count=2, productName=Unmarked objects (old),

count=469, id=29, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=69, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,