GTASymlinkGenerator[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
GTASymlinkGenerator.exe
Size 540KB
Sample261107-thhfeaztey
SHA256 7fe1ce58ae2e1f2e9d6e552b5aac0521ef27e3f085c6b2e3a34f3182d9b3eba4
MD5 bc269d75bff2bcdc590c0dc7d9f12d6a
SHA1 c4ca4b08eac467083cebca17667b4ffea163b127
SHA512 4403f138a129dcdd2de9b6aa3e192feff80e7b00cf6cd3fc3ec74d00332e7ab88a394dcc38b42f92bf1285b584d5a351354290043afcb130662d06e458fbc605
SSDEEP 3072:utQLTygkql7w5jfkH5cXnO63IrU9gIq0ft5+V:utJjfmuXUw9f2V
TLSH
T1B1C43C12B395C062D1444AF1486ADBF54764EC346F6166C37BC1BFAF3E3A2C3286592B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GTASymlinkGenerator.exe

File Explorer

GTASymlinkGenerator.exe

.exe 540KB

GTASymlinkGenerator.exe

IMPHASH e53e23ee0b2cded0ddb5ec5be78b645c
SHA256 7fe1ce58ae2e1f2e9d6e552b5aac0521ef27e3f085c6b2e3a34f3182d9b3eba4
MD5 bc269d75bff2bcdc590c0dc7d9f12d6a
SHA1 c4ca4b08eac467083cebca17667b4ffea163b127
SHA512 4403f138a129dcdd2de9b6aa3e192feff80e7b00cf6cd3fc3ec74d00332e7ab88a394dcc38b42f92bf1285b584d5a351354290043afcb130662d06e458fbc605
SSDEEP 3072:utQLTygkql7w5jfkH5cXnO63IrU9gIq0ft5+V:utJjfmuXUw9f2V
TLSH
T1B1C43C12B395C062D1444AF1486ADBF54764EC346F6166C37BC1BFAF3E3A2C3286592B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\GTA_Symlink_Generator\GTA_Symlink_Generator\Release\GTASymlinkGenerator.pdb

kernel32

SizeofResource GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle GetLastError LockResource LoadResource FindResourceW SetConsoleCP CreateSymbolicLinkW SetConsoleOutputCP CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 AreFileApisANSI CloseHandle DeviceIoControl GetModuleHandleW CopyFile2 GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx IsProcessorFeaturePresent SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead

msvcp140

?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?fail@ios_base@std@@QBE_NXZ ?good@ios_base@std@@QBE_NXZ ??Bios_base@std@@QBE_NXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z

vcruntime140

_CxxThrowException __current_exception_context __current_exception memset memmove _except_handler4_common __std_terminate __std_exception_copy __std_exception_destroy __CxxFrameHandler3 memcpy

api-ms-win-crt-heap-l1-1-0

free _callnewh _set_new_mode malloc

api-ms-win-crt-runtime-l1-1-0

_exit exit _initterm_e _initterm __p___argv _c_exit _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate _register_thread_local_exe_atexit_callback _controlfp_s __p___argc abort _get_initial_narrow_environment system

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode