PlayGTAIV[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
PlayGTAIV.exe
Size 257KB
Sample261001-x3fdbsxcnc
SHA256 42a9990a25f2bf393817a48a31787f2c305841e52cf4b372ff0071a9abce471c
MD5 669a87f7cd1042f3f686a5674be7efac
SHA1 12f2aafc63104dd149a1cf4d4730723e80979f72
SHA512 8d8dd81b90c0bd829cb09a5d6add3a2ea61117f5ff56c9bd21e421b5a44defd56ee86e9d8a0cd851257b9bdcd47923e32d1d31c26748c6a325c0bff6f39b92fb
SSDEEP 6144:D/ebg3pXZPA68WpZ375iu8fqK612vKwDlzEG/4J1zuFSkb:D/ew9ZPUWZnCocX
TLSH
T1DA44F85677F801A8F2B7AB78A9B51541DAB77812AB30C6CF0311126D1E72ED0EE35723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
PlayGTAIV.exe

File Explorer

PlayGTAIV.exe

.exe 257KB

PlayGTAIV.exe

IMPHASH b45c435dd2b75c5f518acebcbfd0d023
SHA256 42a9990a25f2bf393817a48a31787f2c305841e52cf4b372ff0071a9abce471c
MD5 669a87f7cd1042f3f686a5674be7efac
SHA1 12f2aafc63104dd149a1cf4d4730723e80979f72
SHA512 8d8dd81b90c0bd829cb09a5d6add3a2ea61117f5ff56c9bd21e421b5a44defd56ee86e9d8a0cd851257b9bdcd47923e32d1d31c26748c6a325c0bff6f39b92fb
SSDEEP 6144:D/ebg3pXZPA68WpZ375iu8fqK612vKwDlzEG/4J1zuFSkb:D/ew9ZPUWZnCocX
TLSH
T1DA44F85677F801A8F2B7AB78A9B51541DAB77812AB30C6CF0311126D1E72ED0EE35723
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

bb:47:e5:98:1a:f0:c6:d7:6e:a8:63:67:85:ff:f5:80:e2:d7:60:e7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Rockstar Games\, Inc.,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

Chains

Feb 28, 2024

CN=Rockstar Games\, Inc.,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Rockstar Games\, Inc.,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Rockstar Games\, Inc.,O=Rockstar Games\, Inc.,L=New York,ST=New York,C=US

Serial Number

0d:88:c0:8f:56:6d:2b:1f:0c:19:4d:b1:f8:ca:c9:a9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 18, 2023 - Jan 20, 2026

Minor OS version

Major OS version

Entry point

112360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

X:\rgsc_streams\rgl\main\build\stub\ReleaseMetadata\RglStub.pdb

kernel32

GetModuleHandleW VerSetConditionMask GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW CloseHandle WaitForSingleObject GetExitCodeProcess GetModuleFileNameW VerifyVersionInfoW OutputDebugStringW IsDebuggerPresent WriteFile FormatMessageA K32GetModuleFileNameExW K32EnumProcessModules Process32NextW Process32FirstW CreateToolhelp32Snapshot OpenProcess GetCurrentProcessId SystemTimeToFileTime GetSystemTime CreateMutexW ReleaseMutex SetLastError GetTempPathW SetFileAttributesW RemoveDirectoryW ReadFile GetFileSizeEx GetFileAttributesExW GetFileAttributesW DeleteFileW CreateFileW CreateDirectoryW WideCharToMultiByte MultiByteToWideChar LoadLibraryExA GetProcAddress FreeLibrary VirtualQuery VirtualProtect GetSystemInfo GetLastError RaiseException SetFilePointer CreateEventW GetCurrentThreadId UnregisterWaitEx MoveFileW RegisterWaitForSingleObject InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetEvent GetLocalTime ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead

user32

MessageBoxW MessageBoxIndirectW LoadStringW

shell32

ShellExecuteW ShellExecuteExW SHGetKnownFolderPath CommandLineToArgvW

msvcp140

?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Xtime_get_ticks ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xbad_function_call@std@@YAXXZ ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ??Bid@locale@std@@QEAA_KXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z

shlwapi

PathFindFileNameW

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptDestroyKey BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty

vcruntime140

__std_exception_destroy strchr _purecall wcsstr memset memmove memcpy __current_exception_context _CxxThrowException __current_exception __std_exception_copy __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

exit _invalid_parameter_noinfo_noreturn _initterm_e _register_thread_local_exe_atexit_callback _initterm _crt_atexit _get_wide_winmain_command_line _c_exit _seh_filter_exe terminate _exit _register_onexit_function _initialize_onexit_table _initialize_wide_environment _set_app_type abort _cexit _errno _configure_wide_argv _invoke_watson _invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

ungetc setvbuf fwrite _fseeki64 fsetpos fread fputc fgetpos __stdio_common_vsnprintf_s fflush fclose _get_stream_buffer_pointers ungetwc fputwc fgetwc __stdio_common_vsscanf __stdio_common_vswscanf __stdio_common_vswprintf_s fgetc __p__commode _set_fmode __stdio_common_vsprintf_s

api-ms-win-crt-string-l1-1-0

_wcsicmp _strnicmp strncmp strncpy_s strcpy_s strcat_s tolower toupper towlower towupper

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ole32

CoTaskMemFree

Sharing

General

Malware Config

Signatures

File Explorer

PlayGTAIV.exe

kernel32

user32

shell32

msvcp140

shlwapi

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ole32

generic