× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: 20621d8bf346e8940c8a74135841970784d63637d54a8f92ed3a619ec563f08e
File name: 143459-star-wars-baby-walker-gtaiv.exe
Detection ratio: 0 / 54
Analysis date: 2015-07-22 02:38:25 UTC ( 3 years, 4 months ago ) View latest
Antivirus Result Update
Ad-Aware 20150722
AegisLab 20150721
Yandex 20150721
AhnLab-V3 20150721
Alibaba 20150722
ALYac 20150722
Antiy-AVL 20150722
Arcabit 20150722
Avast 20150722
AVG 20150721
Avira (no cloud) 20150721
AVware 20150722
Baidu-International 20150720
BitDefender 20150722
ByteHero 20150722
CAT-QuickHeal 20150721
ClamAV 20150721
Comodo 20150721
Cyren 20150722
DrWeb 20150721
Emsisoft 20150722
ESET-NOD32 20150722
F-Prot 20150722
F-Secure 20150722
Fortinet 20150722
GData 20150722
Ikarus 20150721
Jiangmin 20150720
K7AntiVirus 20150721
K7GW 20150721
Kaspersky 20150722
Kingsoft 20150722
Malwarebytes 20150721
McAfee 20150722
McAfee-GW-Edition 20150721
Microsoft 20150722
eScan 20150722
NANO-Antivirus 20150722
nProtect 20150721
Panda 20150721
Qihoo-360 20150722
Rising 20150721
Sophos AV 20150722
SUPERAntiSpyware 20150722
Symantec 20150722
Tencent 20150722
TheHacker 20150721
TotalDefense 20150721
TrendMicro 20150722
TrendMicro-HouseCall 20150722
VBA32 20150721
VIPRE 20150722
Zillya 20150721
Zoner 20150722
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Copyright
www.GameModding.net

Publisher Game Modding
Product ModInstall
File version 3.1.0.0
Description ModInstall 3.0
Signature verification Signed file, verified signature
Signing date 3:41 AM 7/11/2015
Signers
[+] Game Modding
Status Valid
Issuer None
Valid from 1:00 AM 3/18/2015
Valid to 12:59 AM 3/18/2016
Valid usage Code Signing
Algorithm 1.2.840.113549.1.1.11
Thumbprint 37B077EEBE71E29FF70504626DD0D0FC442348BB
Serial number 2F 58 2A B7 6F CB F8 45 DC 89 8C CA 29 99 42 E8
[+] COMODO RSA Code Signing CA
Status Valid
Issuer None
Valid from 1:00 AM 5/9/2013
Valid to 12:59 AM 5/9/2028
Valid usage Code Signing
Algorithm 1.2.840.113549.1.1.12
Thumbprint B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47
Serial number 2E 7C 87 CC 0E 93 4A 52 FE 94 FD 1C B7 CD 34 AF
[+] COMODO
Status Valid
Issuer None
Valid from 1:00 AM 1/19/2010
Valid to 12:59 AM 1/19/2038
Valid usage Server Auth, Client Auth, Email Protection, Code Signing, Timestamp Signing, EFS, IPSEC Tunnel, IPSEC User
Algorithm 1.2.840.113549.1.1.12
Thumbprint AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4
Serial number 4C AA F9 CA DB 63 6F E0 1F F7 4E D8 5B 03 86 9D
Counter signers
[+] GlobalSign TSA for MS Authenticode - G2
Status Valid
Issuer None
Valid from 1:00 AM 2/3/2015
Valid to 1:00 AM 3/3/2026
Valid usage Timestamp Signing
Algorithm SHA1
Thumbrint B36308B4D4CDED4FCFBD66B955FAE3BFB12C29E6
Serial number 11 21 06 A0 81 D3 3F D8 7A E5 82 4C C1 6B 52 09 4E 03
[+] GlobalSign Timestamping CA - G2
Status Valid
Issuer None
Valid from 11:00 AM 4/13/2011
Valid to 1:00 PM 1/28/2028
Valid usage All
Algorithm SHA1
Thumbrint C0E49D2D7D90A5CD427F02D9125694D5D6EC5B71
Serial number 04 00 00 00 00 01 2F 4E E1 52 D7
[+] GlobalSign
Status Valid
Issuer None
Valid from 1:00 PM 9/1/1998
Valid to 1:00 PM 1/28/2028
Valid usage Server Auth, Client Auth, Code Signing, Email Protection, Timestamp Signing, OCSP Signing, EFS, IPSEC Tunnel, IPSEC User, IPSEC IKE Intermediate
Algorithm SHA1
Thumbrint B1BC968BD4F49D622AA89A81F2150152A41D829C
Serial number 04 00 00 00 00 01 15 4B 5A C3 94
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2015-07-10 15:45:49
Entry Point 0x00001C6C
Number of sections 9
PE sections
Overlays
MD5 cd8c6d7694a1338343199320f498d23b
File type font/x-snf
Offset 3510784
Size 7450776
Entropy 7.99
PE imports
RegCreateKeyExW
RegCloseKey
RegRestoreKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteKeyW
RegQueryValueExW
RegFlushKey
OpenProcessToken
RegConnectRegistryW
RegOpenKeyExW
RegReplaceKeyW
GetTokenInformation
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
OpenThreadToken
InitiateSystemShutdownW
RegLoadKeyW
RegDeleteValueW
RegSetValueExW
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
RegSaveKeyW
EqualSid
RegUnLoadKeyW
ImageList_Merge
ImageList_BeginDrag
ImageList_SetBkColor
ImageList_GetImageInfo
FlatSB_SetScrollInfo
ImageList_SetImageCount
Ord(17)
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_DragMove
FlatSB_SetScrollProp
ImageList_Remove
ImageList_GetDragImage
ImageList_DrawEx
ImageList_SetIconSize
ImageList_Write
ImageList_GetImageCount
ImageList_Replace
ImageList_SetOverlayImage
ImageList_Destroy
ImageList_AddMasked
ImageList_Draw
ImageList_GetIconSize
ImageList_DragLeave
ImageList_GetBkColor
ImageList_GetIcon
FlatSB_SetScrollPos
ImageList_ReplaceIcon
ImageList_DragEnter
ImageList_Add
InitializeFlatSB
ImageList_LoadImageW
FlatSB_GetScrollPos
ImageList_DragShowNolock
ImageList_Create
ImageList_Read
ImageList_Copy
Ord(8)
ImageList_EndDrag
ChooseColorA
GetSaveFileNameW
GetOpenFileNameW
SetDIBits
GetTextMetricsW
SetMapMode
GetWindowOrgEx
ResizePalette
GetPaletteEntries
PathToRegion
CopyEnhMetaFileW
SetPixel
EndDoc
IntersectClipRect
AngleArc
GetTextExtentPointW
CreatePalette
CreateDIBitmap
CreateEllipticRgnIndirect
GetEnhMetaFileBits
StretchBlt
StretchDIBits
ArcTo
Pie
Arc
ExtCreatePen
GetFontData
SetWinMetaFileBits
SetRectRgn
GetDIBColorTable
DeleteEnhMetaFile
CombineRgn
TextOutW
CreateFontIndirectW
OffsetRgn
EnumFontsW
GetCurrentPositionEx
TextOutA
CreateRectRgnIndirect
EndPath
GetBitmapBits
GetBrushOrgEx
ExcludeClipRect
SetBkMode
BitBlt
FillRgn
SetAbortProc
FrameRgn
CreateBrushIndirect
SelectPalette
SetBkColor
ExtSelectClipRgn
StartDocW
SetROP2
EndPage
GetNearestPaletteIndex
SetDIBColorTable
BeginPath
DeleteObject
CreatePenIndirect
SetGraphicsMode
PatBlt
CreatePen
GetClipBox
Rectangle
GetDeviceCaps
LineTo
DeleteDC
SetWorldTransform
SetEnhMetaFileBits
GetSystemPaletteEntries
StartPage
GetObjectW
CreateDCW
GetEnhMetaFileDescriptionW
CreatePatternBrush
ExtTextOutW
CreateBitmap
RectVisible
GetStockObject
PlayEnhMetaFile
ExtTextOutA
UnrealizeObject
GdiFlush
SelectClipRgn
RoundRect
GetWinMetaFileBits
RealizePalette
GetEnhMetaFileHeader
SetWindowOrgEx
SelectObject
GetTextExtentPoint32W
LPtoDP
CreatePolygonRgn
Polygon
CreateHalftonePalette
GetRgnBox
SaveDC
CreateICW
MaskBlt
GetEnhMetaFilePaletteEntries
RestoreDC
GetPixel
CreateDIBSection
SetTextColor
ExtFloodFill
MoveToEx
EnumFontFamiliesExW
SetViewportOrgEx
CreateRoundRectRgn
CreateCompatibleDC
PolyBezierTo
CreateFontW
SetStretchBltMode
PolyBezier
Chord
SetBrushOrgEx
CreateRectRgn
GetClipRgn
CreateCompatibleBitmap
CreateSolidBrush
Polyline
GetDIBits
AbortDoc
Ellipse
SetThreadLocale
GetStdHandle
FileTimeToDosDateTime
ReleaseMutex
FileTimeToSystemTime
GetFileAttributesA
SetEvent
GetPrivateProfileSectionNamesW
GetFileAttributesW
GetPrivateProfileStructW
CreatePipe
GetCurrentProcess
GetDriveTypeW
GetLocaleInfoA
LocalAlloc
GetVolumeInformationW
SetErrorMode
GetLocaleInfoW
EnumResourceLanguagesW
GetFileTime
IsDBCSLeadByteEx
GetCPInfo
lstrcmpiA
GetStringTypeA
GetDiskFreeSpaceW
InterlockedExchange
GetTempPathW
WaitForSingleObject
SetStdHandle
WritePrivateProfileStructW
GetStringTypeW
ResumeThread
EnumDateFormatsW
GetExitCodeProcess
LocalFree
FormatMessageW
GetThreadPriority
GetTimeZoneInformation
LoadResource
GlobalHandle
FindClose
InterlockedDecrement
QueryDosDeviceW
GetFullPathNameW
WritePrivateProfileStringW
GetEnvironmentVariableW
SetLastError
GetUserDefaultUILanguage
GetSystemTime
InitializeCriticalSection
GlobalFindAtomW
lstrcpynW
GetModuleFileNameW
TryEnterCriticalSection
Beep
IsDebuggerPresent
ExitProcess
lstrcpyW
SwitchToThread
GetModuleFileNameA
GetPriorityClass
InterlockedExchangeAdd
SetConsoleCtrlHandler
WritePrivateProfileSectionW
EnumSystemLocalesW
LoadLibraryExW
MultiByteToWideChar
EnumCalendarInfoW
GetPrivateProfileStringW
SetFilePointer
SetFileAttributesW
GlobalAddAtomW
CreateThread
GetSystemDirectoryW
MoveFileExW
GetSystemDefaultUILanguage
DeleteCriticalSection
GetExitCodeThread
CreateMutexW
MulDiv
ExitThread
SetPriorityClass
WaitForMultipleObjectsEx
TerminateProcess
GetVersion
SetCurrentDirectoryW
GlobalAlloc
LocalFileTimeToFileTime
VirtualQueryEx
SetEndOfFile
GetCurrentThreadId
LeaveCriticalSection
CreateToolhelp32Snapshot
HeapFree
EnterCriticalSection
SetHandleCount
TerminateThread
LoadLibraryW
GetVersionExW
GetOEMCP
QueryPerformanceCounter
GetTickCount
TlsAlloc
GetVersionExA
LoadLibraryA
RtlUnwind
FreeLibrary
GlobalSize
GetStartupInfoA
SetFileAttributesA
GetWindowsDirectoryW
GetFileSize
OpenProcess
DeleteFileA
GetDateFormatW
GetStartupInfoW
CreateDirectoryW
DeleteFileW
GetProcAddress
GetPrivateProfileIntW
GetProcessHeap
GetTempFileNameW
CompareStringW
WriteFile
RemoveDirectoryW
ExpandEnvironmentStringsW
lstrcmpA
FindNextFileW
lstrcpyA
CompareStringA
FindFirstFileW
IsValidLocale
DuplicateHandle
FindFirstFileExW
GetUserDefaultLCID
GetPrivateProfileSectionW
CreateEventW
CreateFileW
GetFileType
TlsSetValue
CreateFileA
HeapAlloc
InterlockedIncrement
GetLastError
SystemTimeToFileTime
GlobalDeleteAtom
GetShortPathNameW
GetSystemInfo
lstrlenA
GlobalFree
LCMapStringA
GetTimeFormatW
GetThreadLocale
GetEnvironmentStringsW
GlobalUnlock
VirtualQuery
lstrlenW
Process32NextW
VirtualFree
EnumTimeFormatsW
GetCPInfoExW
SizeofResource
CompareFileTime
GetCurrentProcessId
LockResource
GetCommandLineW
WideCharToMultiByte
InterlockedCompareExchange
Process32FirstW
GetCurrentThread
SuspendThread
GetSystemDefaultLangID
RaiseException
UnhandledExceptionFilter
TlsFree
GetModuleHandleA
ReadFile
CloseHandle
OpenMutexW
GetACP
GlobalLock
GetModuleHandleW
FreeResource
FileTimeToLocalFileTime
TlsGetValue
GetLocalTime
GetCurrentDirectoryW
FindResourceW
CreateProcessW
GetLongPathNameA
Sleep
SetThreadPriority
VirtualAlloc
ResetEvent
GradientFill
TransparentBlt
AlphaBlend
OleUninitialize
CoRegisterClassObject
CoInitialize
CoTaskMemAlloc
CoRevokeClassObject
CoLockObjectExternal
CoUninitialize
StringFromCLSID
CoCreateInstance
CLSIDFromProgID
RevokeDragDrop
CoDisconnectObject
IsEqualGUID
CoTaskMemFree
OleInitialize
CreateErrorInfo
VariantChangeType
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayPtrOfIndex
SysAllocStringLen
SafeArrayUnaccessData
VariantCopyInd
VariantClear
SafeArrayCreate
SysReAllocStringLen
SafeArrayGetUBound
VariantInit
VariantCopy
DispGetIDsOfNames
SysFreeString
SafeArrayPutElement
GetErrorInfo
SetErrorInfo
DragQueryFileW
SHBrowseForFolderW
DragAcceptFiles
SHFileOperationW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderPathA
DragQueryPoint
ShellExecuteExW
SHGetFileInfoW
ExtractIconW
Shell_NotifyIconW
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHGetMalloc
ShellExecuteA
DragFinish
SHGetFolderPathW
RedrawWindow
GetForegroundWindow
VkKeyScanExW
DrawTextW
EnableScrollBar
DestroyMenu
PostQuitMessage
GetMessagePos
DrawStateW
SetWindowPos
IsWindow
DispatchMessageA
EndPaint
CharUpperBuffA
WindowFromPoint
IntersectRect
PeekMessageA
CharUpperBuffW
SetMenuItemInfoW
SendMessageW
SetActiveWindow
GetDC
GetCursorPos
DrawTextA
GetMenuStringW
DefFrameProcW
EndMenu
TranslateMessage
OpenClipboard
SendMessageA
UnregisterClassW
GetClassInfoW
SetWindowContextHelpId
DefWindowProcW
CharLowerBuffA
LoadImageW
SetScrollPos
CallNextHookEx
IsClipboardFormatAvailable
MsgWaitForMultipleObjectsEx
GetClientRect
GetKeyboardState
keybd_event
GetActiveWindow
GetUpdateRgn
GetWindowTextW
EnumClipboardFormats
GetWindowTextLengthW
MsgWaitForMultipleObjects
GetTopWindow
GetKeyState
GetMenuContextHelpId
DestroyWindow
DrawEdge
GetParent
UpdateWindow
GetPropW
EqualRect
SetClassLongW
EnumWindows
GetMenuState
GetWindowContextHelpId
ShowWindow
DrawFrameControl
SetPropW
EnumDisplayMonitors
PeekMessageW
SetWindowsHookExW
EnableWindow
SetWindowPlacement
CharUpperW
LoadIconW
SetParent
IsWindowEnabled
GetWindow
ActivateKeyboardLayout
SetClipboardData
GetMenuItemID
GetIconInfo
GetQueueStatus
RegisterClassW
ScrollWindow
IsZoomed
GetWindowPlacement
LoadStringW
SetWindowLongW
GetKeyboardLayoutList
DrawMenuBar
EnableMenuItem
InvertRect
DrawFocusRect
GetDCEx
GetKeyboardLayout
FillRect
EnumThreadWindows
MonitorFromPoint
CreateAcceleratorTableW
GetSysColorBrush
IsWindowUnicode
CreateWindowExW
ReleaseDC
GetWindowLongW
CharNextW
IsChild
IsDialogMessageA
MapWindowPoints
RegisterWindowMessageW
GetMonitorInfoW
ReleaseCapture
EmptyClipboard
BeginPaint
OffsetRect
DefMDIChildProcW
GetScrollPos
CopyIcon
GetKeyboardLayoutNameW
KillTimer
MapVirtualKeyW
SetTimer
SetMenuContextHelpId
CheckMenuRadioItem
GetClipboardData
LoadBitmapW
GetSystemMetrics
IsIconic
SetScrollRange
BroadcastSystemMessage
GetWindowRect
InflateRect
SetCapture
DrawIcon
EnumChildWindows
GetScrollRange
GetMessageExtraInfo
CharLowerW
ShowOwnedPopups
PostMessageW
InvalidateRect
WaitMessage
CreatePopupMenu
CheckMenuItem
GetSubMenu
GetClassLongW
GetLastActivePopup
PtInRect
DrawIconEx
SetWindowTextW
CreateMenu
RemovePropW
FindWindowW
ClientToScreen
CountClipboardFormats
GetMenuItemCount
AttachThreadInput
DestroyAcceleratorTable
GetDesktopWindow
IsDialogMessageW
LoadCursorW
GetSystemMenu
FindWindowExW
DispatchMessageW
InsertMenuW
SetForegroundWindow
ExitWindowsEx
SetFocus
GetMenuItemInfoW
GetAsyncKeyState
wvsprintfW
CharLowerBuffW
DrawTextExW
GetScrollInfo
HideCaret
CreateIconIndirect
GetCapture
ScreenToClient
MessageBeep
RemoveMenu
GetWindowThreadProcessId
ShowScrollBar
MessageBoxW
GetMenu
MonitorFromRect
SetMenu
MoveWindow
LoadKeyboardLayoutW
MessageBoxA
GetWindowDC
DestroyCursor
AdjustWindowRectEx
TrackPopupMenu
GetSysColor
RegisterClipboardFormatW
SetScrollInfo
CopyImage
GetWindowRgn
DestroyIcon
IsWindowVisible
WinHelpW
SetCursorPos
SystemParametersInfoW
MonitorFromWindow
FrameRect
SetRect
DeleteMenu
GetKeyNameTextW
wsprintfA
CallWindowProcW
GetClassNameW
TranslateMDISysAccel
CreateIcon
ValidateRect
GetCursor
GetFocus
InsertMenuItemW
CloseClipboard
TranslateAcceleratorW
UnhookWindowsHookEx
SetCursor
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
timeKillEvent
timeSetEvent
timeGetTime
DocumentPropertiesW
OpenPrinterW
ClosePrinter
EnumPrintersW
Ord(203)
PE exports
Number of PE resources by type
RT_STRING 33
RT_GROUP_CURSOR 7
RT_CURSOR 7
RT_RCDATA 6
RT_ICON 1
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 39
ENGLISH US 14
RUSSIAN 4
PE resources
ExifTool file metadata
UninitializedDataSize
0

InitializedDataSize
903168

ImageVersion
0.0

ProductName
ModInstall

FileVersionNumber
3.1.0.0

LanguageCode
Russian

FileFlagsMask
0x003f

FileDescription
ModInstall 3.0

CharacterSet
Windows, Cyrillic

LinkerVersion
5.0

FileTypeExtension
exe

MIMEType
application/octet-stream

Subsystem
Windows GUI

FileVersion
3.1.0.0

TimeStamp
2015:07:10 16:45:49+01:00

FileType
Win32 EXE

PEType
PE32

ProductVersion
1.0.0.0

SubsystemVersion
5.0

OSVersion
4.0

FileOS
Win32

LegalCopyright
www.GameModding.net

MachineType
Intel 386 or later, and compatibles

CompanyName
www.GameModding.net

CodeSize
2609152

FileSubtype
0

ProductVersionNumber
3.1.0.0

EntryPoint
0x1c6c

ObjectFileType
Executable application

File identification
MD5 cf4c8eda57442d9f31a702612babfada
SHA1 f7e44aa469ee5540a2d1b6296fddab76ae3d5eff
SHA256 20621d8bf346e8940c8a74135841970784d63637d54a8f92ed3a619ec563f08e
ssdeep
196608:VeQSM10iHppsmnCQHyFxnZs9PIGIus0qexKlZiTfwxCjb:cHM1r7svQHyF8gGIeqMTrb

authentihash 785c81a1acf5d3d31711af6a7d507425a66cbfbdb6d3b00c379d2485aac0dc31
imphash ce0a6c543e6ad89f820816dac6c1d75a
File size 10.5 MB ( 10961560 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Windows screen saver (60.5%)
Win32 Executable (generic) (20.8%)
Generic Win/DOS Executable (9.2%)
DOS Executable Generic (9.2%)
VXD Driver (0.1%)
Tags
peexe signed overlay

VirusTotal metadata
First submission 2015-07-22 02:38:25 UTC ( 3 years, 4 months ago )
Last submission 2015-07-22 02:38:25 UTC ( 3 years, 4 months ago )
File names 143459-star-wars-baby-walker-gtaiv.exe
Advanced heuristic and reputation engines
Symantec reputation Suspicious.Insight
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Deleted files
Runtime DLLs