× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: fead3f36b50379bcdd63926bdf06fadcbbb0b60da6623cc3a768f1f8673eb1af
File name: 95830-realistichnyy-rozysk-mod-esconder-da-policia-v2-gtasa.exe
Detection ratio: 0 / 56
Analysis date: 2015-06-27 13:08:36 UTC ( 2 years, 2 months ago ) View latest
Antivirus Result Update
Ad-Aware 20150627
AegisLab 20150626
Yandex 20150626
AhnLab-V3 20150627
Alibaba 20150626
ALYac 20150627
Antiy-AVL 20150627
Arcabit 20150627
Avast 20150627
AVG 20150627
Avira (no cloud) 20150627
AVware 20150627
Baidu-International 20150627
BitDefender 20150627
Bkav 20150627
ByteHero 20150627
CAT-QuickHeal 20150627
ClamAV 20150626
Comodo 20150627
Cyren 20150627
DrWeb 20150627
Emsisoft 20150627
ESET-NOD32 20150627
F-Prot 20150627
F-Secure 20150627
Fortinet 20150627
GData 20150627
Ikarus 20150627
Jiangmin 20150626
K7AntiVirus 20150627
K7GW 20150627
Kaspersky 20150627
Kingsoft 20150627
Malwarebytes 20150627
McAfee 20150627
McAfee-GW-Edition 20150627
Microsoft 20150627
eScan 20150627
NANO-Antivirus 20150627
nProtect 20150626
Panda 20150627
Qihoo-360 20150627
Rising 20150627
Sophos AV 20150627
SUPERAntiSpyware 20150627
Symantec 20150627
Tencent 20150627
TheHacker 20150626
TotalDefense 20150627
TrendMicro 20150627
TrendMicro-HouseCall 20150627
VBA32 20150626
VIPRE 20150627
ViRobot 20150627
Zillya 20150627
Zoner 20150627
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block and FileVersionInfo properties
Copyright
www.GameModding.net

Publisher Game Modding
Product ModInstall
File version 3.1.0.0
Description ModInstall 3.0
Signature verification Signed file, verified signature
Signing date 8:13 AM 6/11/2015
Signers
[+] Game Modding
Status Valid
Issuer None
Valid from 1:00 AM 3/18/2015
Valid to 12:59 AM 3/18/2016
Valid usage Code Signing
Algorithm 1.2.840.113549.1.1.11
Thumbprint 37B077EEBE71E29FF70504626DD0D0FC442348BB
Serial number 2F 58 2A B7 6F CB F8 45 DC 89 8C CA 29 99 42 E8
[+] COMODO RSA Code Signing CA
Status Valid
Issuer None
Valid from 1:00 AM 5/9/2013
Valid to 12:59 AM 5/9/2028
Valid usage Code Signing
Algorithm 1.2.840.113549.1.1.12
Thumbprint B69E752BBE88B4458200A7C0F4F5B3CCE6F35B47
Serial number 2E 7C 87 CC 0E 93 4A 52 FE 94 FD 1C B7 CD 34 AF
[+] COMODO
Status Valid
Issuer None
Valid from 1:00 AM 1/19/2010
Valid to 12:59 AM 1/19/2038
Valid usage Server Auth, Client Auth, Email Protection, Code Signing, Timestamp Signing, EFS, IPSEC Tunnel, IPSEC User
Algorithm 1.2.840.113549.1.1.12
Thumbprint AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4
Serial number 4C AA F9 CA DB 63 6F E0 1F F7 4E D8 5B 03 86 9D
Counter signers
[+] Symantec Time Stamping Services Signer - G4
Status Valid
Issuer None
Valid from 1:00 AM 10/18/2012
Valid to 12:59 AM 12/30/2020
Valid usage Timestamp Signing
Algorithm SHA1
Thumbrint 65439929B67973EB192D6FF243E6767ADF0834E4
Serial number 0E CF F4 38 C8 FE BF 35 6E 04 D8 6A 98 1B 1A 50
[+] Symantec Time Stamping Services CA - G2
Status Valid
Issuer None
Valid from 1:00 AM 12/21/2012
Valid to 12:59 AM 12/31/2020
Valid usage Timestamp Signing
Algorithm SHA1
Thumbrint 6C07453FFDDA08B83707C09B82FB3D15F35336B1
Serial number 7E 93 EB FB 7C C6 4E 59 EA 4B 9A 77 D4 06 FC 3B
[+] Thawte Timestamping CA
Status Valid
Issuer None
Valid from 1:00 AM 1/1/1997
Valid to 12:59 AM 1/1/2021
Valid usage Timestamp Signing
Algorithm MD5
Thumbrint BE36A4562FB2EE05DBB3D32323ADF445084ED656
Serial number 00
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2015-02-17 09:14:27
Entry Point 0x00001D74
Number of sections 9
PE sections
Overlays
MD5 2d5707f7f8f89d0f21c289e9c32f3464
File type font/x-snf
Offset 3612160
Size 602760
Entropy 7.97
PE imports
RegCreateKeyExW
RegCloseKey
RegRestoreKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteKeyW
CryptHashData
RegQueryValueExW
CryptCreateHash
RegFlushKey
OpenProcessToken
RegConnectRegistryW
RegOpenKeyExW
RegReplaceKeyW
GetTokenInformation
CryptVerifySignatureW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
OpenThreadToken
InitiateSystemShutdownW
RegLoadKeyW
CryptAcquireContextW
RegDeleteValueW
RegSetValueExW
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
RegSaveKeyW
EqualSid
RegUnLoadKeyW
ImageList_Merge
ImageList_BeginDrag
ImageList_SetBkColor
ImageList_GetImageInfo
FlatSB_SetScrollInfo
ImageList_SetImageCount
Ord(17)
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_DragMove
FlatSB_SetScrollProp
ImageList_Remove
ImageList_GetDragImage
ImageList_DrawEx
ImageList_SetIconSize
ImageList_Write
ImageList_GetImageCount
ImageList_Replace
ImageList_SetOverlayImage
ImageList_Destroy
ImageList_AddMasked
ImageList_Draw
ImageList_GetIconSize
ImageList_DragLeave
ImageList_GetBkColor
ImageList_GetIcon
FlatSB_SetScrollPos
ImageList_ReplaceIcon
ImageList_DragEnter
ImageList_Add
InitializeFlatSB
ImageList_LoadImageW
FlatSB_GetScrollPos
ImageList_DragShowNolock
ImageList_Create
ImageList_Read
ImageList_Copy
Ord(8)
ImageList_EndDrag
ChooseColorA
GetSaveFileNameW
GetOpenFileNameW
SetDIBits
GetTextMetricsW
SetMapMode
GetWindowOrgEx
ResizePalette
GetPaletteEntries
CombineRgn
CopyEnhMetaFileW
SetPixel
EndDoc
IntersectClipRect
AngleArc
GetTextExtentPointW
CreatePalette
CreateDIBitmap
CreateEllipticRgnIndirect
GetEnhMetaFileBits
StretchBlt
StretchDIBits
ArcTo
Pie
Arc
ExtCreatePen
GetFontData
SetWinMetaFileBits
SetRectRgn
GetDIBColorTable
DeleteEnhMetaFile
TextOutW
CreateFontIndirectW
OffsetRgn
EnumFontsW
GetCurrentPositionEx
TextOutA
CreateRectRgnIndirect
LPtoDP
GetBitmapBits
GetBrushOrgEx
ExcludeClipRect
SetBkMode
BitBlt
FillRgn
SetAbortProc
FrameRgn
CreateBrushIndirect
SelectPalette
SetBkColor
ExtSelectClipRgn
StartDocW
SetROP2
EndPage
GetNearestPaletteIndex
SetDIBColorTable
DeleteObject
CreatePenIndirect
SetGraphicsMode
PatBlt
CreatePen
GetClipBox
Rectangle
GetDeviceCaps
LineTo
DeleteDC
SetWorldTransform
SetEnhMetaFileBits
GetSystemPaletteEntries
StartPage
GetObjectW
CreateDCW
RealizePalette
CreatePatternBrush
ExtTextOutW
CreateBitmap
RectVisible
GetStockObject
PlayEnhMetaFile
ExtTextOutA
UnrealizeObject
GdiFlush
RoundRect
GetWinMetaFileBits
GetEnhMetaFileDescriptionW
GetEnhMetaFileHeader
SetWindowOrgEx
GetTextExtentPoint32W
CreatePolygonRgn
Polygon
CreateHalftonePalette
GetRgnBox
SaveDC
CreateICW
MaskBlt
GetEnhMetaFilePaletteEntries
RestoreDC
GetPixel
CreateDIBSection
SetTextColor
ExtFloodFill
MoveToEx
EnumFontFamiliesExW
SetViewportOrgEx
CreateRoundRectRgn
CreateCompatibleDC
PolyBezierTo
SetStretchBltMode
PolyBezier
Chord
SetBrushOrgEx
CreateRectRgn
SelectObject
CreateCompatibleBitmap
CreateSolidBrush
Polyline
GetDIBits
AbortDoc
Ellipse
SetThreadLocale
GetStdHandle
FileTimeToDosDateTime
ReleaseMutex
FileTimeToSystemTime
GetFileAttributesA
SetEvent
GetPrivateProfileSectionNamesW
GetFileAttributesW
GetPrivateProfileStructW
CreatePipe
GetCurrentProcess
GetDriveTypeW
GetLocaleInfoA
LocalAlloc
GetVolumeInformationW
SetErrorMode
GetLocaleInfoW
SetFileAttributesA
GetFileTime
IsDBCSLeadByteEx
GetCPInfo
lstrcmpiA
GetStringTypeA
GetDiskFreeSpaceW
InterlockedExchange
GetTempPathW
WaitForSingleObject
SetStdHandle
WritePrivateProfileStructW
GetStringTypeW
ResumeThread
EnumDateFormatsW
GetExitCodeProcess
LocalFree
FormatMessageW
GetThreadPriority
GetTimeZoneInformation
LoadResource
GlobalHandle
FindClose
InterlockedDecrement
QueryDosDeviceW
GetFullPathNameW
WritePrivateProfileStringW
GetEnvironmentVariableW
SetLastError
GetUserDefaultUILanguage
GetSystemTime
InitializeCriticalSection
CopyFileW
lstrcpynW
GetModuleFileNameW
TryEnterCriticalSection
Beep
IsDebuggerPresent
ExitProcess
lstrcpyW
SwitchToThread
GetModuleFileNameA
GetPriorityClass
InterlockedExchangeAdd
SetConsoleCtrlHandler
WritePrivateProfileSectionW
EnumSystemLocalesW
LoadLibraryExW
MultiByteToWideChar
EnumCalendarInfoW
GetPrivateProfileStringW
SetFilePointer
SetFileAttributesW
GlobalAddAtomW
CreateThread
GetSystemDirectoryW
GetSystemDefaultUILanguage
DeleteCriticalSection
GetExitCodeThread
CreateMutexW
MulDiv
ExitThread
SetPriorityClass
WaitForMultipleObjectsEx
TerminateProcess
GetVersion
SetCurrentDirectoryW
GlobalAlloc
LocalFileTimeToFileTime
VirtualQueryEx
SetEndOfFile
GetCurrentThreadId
LeaveCriticalSection
CreateToolhelp32Snapshot
HeapFree
EnterCriticalSection
SetHandleCount
TerminateThread
LoadLibraryW
GetVersionExW
GetOEMCP
QueryPerformanceCounter
GetTickCount
TlsAlloc
GetVersionExA
LoadLibraryA
RtlUnwind
FreeLibrary
GlobalFindAtomW
GlobalSize
GetStartupInfoA
GetWindowsDirectoryW
GetFileSize
OpenProcess
DeleteFileA
GetDateFormatW
GetStartupInfoW
CreateDirectoryW
DeleteFileW
GetProcAddress
GetPrivateProfileIntW
GetProcessHeap
GetTempFileNameW
GetComputerNameW
CompareStringW
WriteFile
RemoveDirectoryW
ExpandEnvironmentStringsW
lstrcmpA
FindNextFileW
lstrcpyA
CompareStringA
FindFirstFileW
IsValidLocale
DuplicateHandle
FindFirstFileExW
GetUserDefaultLCID
GetPrivateProfileSectionW
CreateEventW
CreateFileW
GetFileType
TlsSetValue
CreateFileA
HeapAlloc
InterlockedIncrement
GetLastError
SystemTimeToFileTime
GlobalDeleteAtom
GetShortPathNameW
GetSystemInfo
lstrlenA
GlobalFree
LCMapStringA
GetTimeFormatW
GetThreadLocale
GetEnvironmentStringsW
GlobalUnlock
VirtualQuery
lstrlenW
WinExec
Process32NextW
VirtualFree
EnumTimeFormatsW
GetCPInfoExW
GetEnvironmentStrings
CompareFileTime
GetCurrentProcessId
LockResource
GetCommandLineW
WideCharToMultiByte
InterlockedCompareExchange
Process32FirstW
GetCurrentThread
SuspendThread
GetSystemDefaultLangID
RaiseException
UnhandledExceptionFilter
TlsFree
GetModuleHandleA
ReadFile
CloseHandle
OpenMutexW
GetACP
GlobalLock
GetModuleHandleW
FreeResource
FileTimeToLocalFileTime
SizeofResource
TlsGetValue
GetLocalTime
GetCurrentDirectoryW
FindResourceW
CreateProcessW
Sleep
SetThreadPriority
VirtualAlloc
ResetEvent
GradientFill
TransparentBlt
AlphaBlend
OleUninitialize
CoUninitialize
CoInitialize
CoTaskMemAlloc
CoCreateInstance
CLSIDFromProgID
RevokeDragDrop
IsEqualGUID
CoTaskMemFree
OleInitialize
VariantChangeType
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayPtrOfIndex
SysAllocStringLen
SafeArrayUnaccessData
VariantCopyInd
VariantClear
SafeArrayCreate
SysReAllocStringLen
SafeArrayGetUBound
VariantCopy
GetErrorInfo
SysFreeString
SafeArrayPutElement
VariantInit
DragQueryFileW
SHBrowseForFolderW
DragAcceptFiles
SHFileOperationW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderPathA
DragQueryPoint
ShellExecuteExW
SHGetFileInfoW
ExtractIconW
Shell_NotifyIconW
SHGetPathFromIDListA
SHGetSpecialFolderPathW
SHGetMalloc
ShellExecuteA
DragFinish
SHGetFolderPathW
RedrawWindow
GetForegroundWindow
VkKeyScanExW
DrawTextW
EnableScrollBar
DestroyMenu
PostQuitMessage
GetMessagePos
DrawStateW
SetWindowPos
IsWindow
DispatchMessageA
EndPaint
CharUpperBuffA
WindowFromPoint
IntersectRect
PeekMessageA
CharUpperBuffW
SetMenuItemInfoW
SendMessageW
SetActiveWindow
GetDC
GetCursorPos
DrawTextA
GetMenuStringW
DefFrameProcW
EndMenu
TranslateMessage
OpenClipboard
SendMessageA
UnregisterClassW
GetClassInfoW
SetWindowContextHelpId
DefWindowProcW
CharLowerBuffA
LoadImageW
SetScrollPos
CallNextHookEx
IsClipboardFormatAvailable
MsgWaitForMultipleObjectsEx
GetClientRect
GetKeyboardState
keybd_event
GetActiveWindow
GetUpdateRgn
GetWindowTextW
EnumClipboardFormats
GetWindowTextLengthW
MsgWaitForMultipleObjects
GetTopWindow
GetKeyState
GetMenuContextHelpId
DestroyWindow
DrawEdge
GetParent
UpdateWindow
GetPropW
EqualRect
SetClassLongW
EnumWindows
GetMenuState
GetWindowContextHelpId
ShowWindow
DrawFrameControl
SetPropW
EnumDisplayMonitors
PeekMessageW
SetWindowsHookExW
EnableWindow
SetWindowPlacement
CharUpperW
LoadIconW
SetParent
IsWindowEnabled
GetWindow
ActivateKeyboardLayout
SetClipboardData
GetMenuItemID
GetIconInfo
GetQueueStatus
RegisterClassW
ScrollWindow
IsZoomed
GetWindowPlacement
LoadStringW
SetWindowLongW
GetKeyboardLayoutList
DrawMenuBar
EnableMenuItem
InvertRect
DrawFocusRect
GetDCEx
GetKeyboardLayout
FillRect
EnumThreadWindows
MonitorFromPoint
CreateAcceleratorTableW
GetSysColorBrush
IsWindowUnicode
CreateWindowExW
ReleaseDC
GetWindowLongW
CharNextW
IsChild
IsDialogMessageA
MapWindowPoints
RegisterWindowMessageW
GetMonitorInfoW
ReleaseCapture
EmptyClipboard
BeginPaint
OffsetRect
DefMDIChildProcW
GetScrollPos
CopyIcon
GetKeyboardLayoutNameW
KillTimer
MapVirtualKeyW
SetTimer
SetMenuContextHelpId
CheckMenuRadioItem
GetClipboardData
LoadBitmapW
GetSystemMetrics
IsIconic
SetScrollRange
BroadcastSystemMessage
GetWindowRect
InflateRect
SetCapture
DrawIcon
EnumChildWindows
GetScrollRange
GetMessageExtraInfo
CharLowerW
ShowOwnedPopups
PostMessageW
InvalidateRect
WaitMessage
CreatePopupMenu
CheckMenuItem
GetSubMenu
GetClassLongW
GetLastActivePopup
DrawIconEx
SetWindowTextW
CreateMenu
RemovePropW
FindWindowW
ClientToScreen
CountClipboardFormats
GetMenuItemCount
AttachThreadInput
DestroyAcceleratorTable
GetDesktopWindow
IsDialogMessageW
LoadCursorW
GetSystemMenu
FindWindowExW
DispatchMessageW
InsertMenuW
SetForegroundWindow
ExitWindowsEx
SetFocus
GetMenuItemInfoW
GetAsyncKeyState
wvsprintfW
CharLowerBuffW
DrawTextExW
GetScrollInfo
HideCaret
CreateIconIndirect
GetCapture
ScreenToClient
MessageBeep
RemoveMenu
GetWindowThreadProcessId
ShowScrollBar
MessageBoxW
GetMenu
MonitorFromRect
SetMenu
MoveWindow
LoadKeyboardLayoutW
MessageBoxA
GetWindowDC
DestroyCursor
AdjustWindowRectEx
TrackPopupMenu
GetSysColor
RegisterClipboardFormatW
SetScrollInfo
CopyImage
GetWindowRgn
DestroyIcon
IsWindowVisible
WinHelpW
SetCursorPos
SystemParametersInfoW
MonitorFromWindow
FrameRect
SetRect
DeleteMenu
GetKeyNameTextW
wsprintfA
CallWindowProcW
GetClassNameW
TranslateMDISysAccel
CreateIcon
ValidateRect
GetCursor
GetFocus
InsertMenuItemW
CloseClipboard
TranslateAcceleratorW
UnhookWindowsHookEx
SetCursor
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
timeKillEvent
timeSetEvent
timeGetTime
DocumentPropertiesW
OpenPrinterW
ClosePrinter
EnumPrintersW
Ord(203)
PE exports
Number of PE resources by type
RT_STRING 36
RT_GROUP_CURSOR 7
RT_CURSOR 7
RT_RCDATA 6
RT_ICON 1
RT_MANIFEST 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
NEUTRAL 42
ENGLISH US 14
RUSSIAN 4
PE resources
ExifTool file metadata
SubsystemVersion
5.0

LinkerVersion
5.0

ImageVersion
0.0

FileSubtype
0

FileVersionNumber
3.1.0.0

UninitializedDataSize
0

LanguageCode
Russian

FileFlagsMask
0x003f

CharacterSet
Windows, Cyrillic

InitializedDataSize
911360

EntryPoint
0x1d74

MIMEType
application/octet-stream

LegalCopyright
www.GameModding.net

FileVersion
3.1.0.0

TimeStamp
2015:02:17 10:14:27+01:00

FileType
Win32 EXE

PEType
PE32

ProductVersion
1.0.0.0

FileDescription
ModInstall 3.0

OSVersion
4.0

FileOS
Win32

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
www.GameModding.net

CodeSize
2699264

ProductName
ModInstall

ProductVersionNumber
3.1.0.0

FileTypeExtension
exe

ObjectFileType
Executable application

File identification
MD5 e7bce83141e91e13ba563ba125803a0c
SHA1 5bc01b9a053cb60542be4ebaff914fc5de20f871
SHA256 fead3f36b50379bcdd63926bdf06fadcbbb0b60da6623cc3a768f1f8673eb1af
ssdeep
49152:XRmZZS8uxbh8lHC4avXrmI4rQcttCq1TFcs/TC7Z9kGouMSDTwiVIoZK/pr4J1N:hl8lHsy1p/TmJou3J1N

authentihash 949515f6629321bb26119dc08432ba0e1a17696231776cd40d6cb233c5db002b
imphash 3ca1822143d521837401028bf98e7665
File size 4.0 MB ( 4214920 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Windows screen saver (60.5%)
Win32 Executable (generic) (20.8%)
Generic Win/DOS Executable (9.2%)
DOS Executable Generic (9.2%)
VXD Driver (0.1%)
Tags
peexe signed overlay

VirusTotal metadata
First submission 2015-06-27 13:08:36 UTC ( 2 years, 2 months ago )
Last submission 2015-06-27 13:08:36 UTC ( 2 years, 2 months ago )
File names 95830-realistichnyy-rozysk-mod-esconder-da-policia-v2-gtasa.exe
Advanced heuristic and reputation engines
Symantec reputation Suspicious.Insight
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!
Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.
Opened files
Written files
Deleted files
Runtime DLLs