f2139278a370493cc99993b6bad4e033fe161dfb3a1b65e11bb87da4f188242d
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2020-Jun-01 15:33:36 |
| Detected languages |
English - United States
|
| Debug artifacts |
x:\gta\build\GTA4_Win32_Final.pdb
|
| CompanyName | Rockstar Games |
| FileDescription | Grand Theft Auto IV |
| FileVersion | 1.2.0.43 |
| InternalName | Grand Theft Auto IV |
| LegalCopyright | Rockstar Games Inc. (C) 2005-2020 Take Two Interactive. All rights reserved. |
| OriginalFilename | GTAIV.exe |
| ProductName | Grand Theft Auto IV |
| ProductVersion | 1.2.0.43 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 6.0 - 8.0 Microsoft Visual C++ Microsoft Visual C++ v6.0 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Accesses the WMI:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Microsoft's Cryptography API |
| Suspicious | The PE is possibly packed. |
Unusual section name found: .rkstr
Section .rkstr is both writable and executable. Unusual section name found: .tbm |
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Info | The PE's resources present abnormal characteristics. | Resource SPAFILE is possibly compressed or encrypted. |
| Suspicious | The file contains overlay data. |
7296 bytes of data starting at offset 0x109be00.
The overlay data has an entropy of 7.15926 and is possibly compressed or encrypted. |
| Safe | VirusTotal score: 0/70 (Scanned on 2026-05-22 18:22:52) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x148 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 9 |
| TimeDateStamp | 2020-Jun-01 15:33:36 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 11.0 |
| SizeOfCode | 0xa71c00 |
| SizeOfInitializedData | 0x1075e00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x009F8F2B (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0xa73000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 6.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x1be6400 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x10ace9e |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.tls
_RDATA
.rsrc
.reloc
.rkstr
.tbm
Imports
| USER32.dll |
SetCapture
IsWindowUnicode ReleaseCapture DefWindowProcW GetParent MessageBoxA wsprintfA IsWindow CharLowerBuffA ShowWindow DefWindowProcA MoveWindow RegisterClassA EnumDisplayDevicesA LoadCursorA AdjustWindowRect UpdateWindow SetWindowTextA DispatchMessageA GetDesktopWindow ReleaseDC PeekMessageA CreateWindowExA SetRect TranslateMessage GetDC SetFocus GetWindowInfo LoadIconA IsIconic GetSystemMetrics SetWindowPos UnregisterClassA SetWindowLongA ShowCursor GetClientRect DestroyWindow GetMessageExtraInfo SendInput LoadKeyboardLayoutA GetKeyboardLayoutNameA GetKeyboardLayout GetKeyboardState GetKeyboardType ToAsciiEx MapVirtualKeyExA ToUnicodeEx SystemParametersInfoA SendMessageA SetWindowsHookExA UnhookWindowsHookEx CallNextHookEx MessageBoxW |
|---|---|
| PSAPI.DLL |
EnumProcessModules
GetModuleInformation |
| binkw32.dll |
_BinkSetMemory@8
_BinkDoFrame@4 _BinkGoto@12 _BinkGetKeyFrame@12 _BinkOpen@8 _BinkClose@4 _BinkSetSoundSystem@8 _BinkGetSummary@8 _BinkRegisterFrameBuffers@8 _BinkNextFrame@4 _BinkGetFrameBuffersInfo@8 _BinkShouldSkip@4 _BinkWait@4 _BinkOpenDirectSound@4 _BinkSetVolume@12 _BinkPause@8 |
| VERSION.dll |
GetFileVersionInfoSizeW
GetFileVersionInfoW GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA |
| DSOUND.dll |
#3
#9 #11 #2 |
| WS2_32.dll |
WSAGetLastError
htons getsockname recv bind socket shutdown select WSAStartup WSACleanup ioctlsocket closesocket gethostbyname send getpeername listen accept gethostname connect freeaddrinfo getaddrinfo __WSAFDIsSet getsockopt sendto setsockopt recvfrom inet_addr |
| d3d9.dll |
Direct3DCreate9
|
| RPCRT4.dll |
UuidCreateSequential
|
| CRYPT32.dll |
CryptUnprotectData
CryptProtectData CryptQueryObject CertFindCertificateInStore CertGetNameStringA CryptMsgGetParam |
| SHLWAPI.dll |
PathFileExistsA
PathAppendW PathRemoveFileSpecA PathAppendA |
| WMVCore.DLL |
WMCreateSyncReader
WMCreateReader |
| WINMM.dll |
waveOutWrite
waveOutPrepareHeader waveOutClose timeEndPeriod timeBeginPeriod waveOutOpen waveOutSetVolume timeGetTime waveOutReset |
| POWRPROF.dll |
CallNtPowerInformation
|
| KERNEL32.dll |
LocalAlloc
GetOverlappedResult InitializeSListHead InterlockedPopEntrySList InterlockedFlushSList InterlockedPushEntrySList GetFileAttributesExW FindFirstFileExW GetFileInformationByHandle PeekNamedPipe GetSystemDirectoryA GlobalAlloc GlobalFree ReadConsoleW WriteConsoleW FlushFileBuffers SetStdHandle SetEnvironmentVariableA LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW OutputDebugStringW GetConsoleMode GetConsoleCP RtlUnwind GetStringTypeW GetCurrentDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetFileType HeapSize GetFullPathNameW EncodePointer LoadLibraryExW GetModuleFileNameW GetStdHandle GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError UnhandledExceptionFilter GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExA HeapReAlloc GetSystemTimeAsFileTime GetTimeZoneInformation GetFullPathNameA GetDriveTypeW IsProcessorFeaturePresent CreateEventA WaitForMultipleObjects Sleep CreateFileW ReadFile SetFilePointer CloseHandle HeapAlloc HeapFree GetProcessHeap OpenProcess GlobalMemoryStatusEx GetCurrentProcessId GetLastError CreateMutexA GetUserDefaultUILanguage WaitForSingleObject SetEvent GetCurrentThread CreateSemaphoreA SetThreadPriority ReleaseSemaphore ResetEvent SetThreadPriorityBoost GetSystemInfo GetCurrentThreadId ReleaseMutex ResumeThread CreateThread SwitchToThread TryEnterCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetCurrentProcess QueryPerformanceCounter GetThreadPriority QueryPerformanceFrequency InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange InterlockedExchangeAdd GetProcessAffinityMask CreateFileA FreeLibrary GetTimeFormatA VirtualFree GetDateFormatA GetProcAddress VirtualAlloc GetLocalTime LoadLibraryA GetModuleFileNameA SetEndOfFile SetFilePointerEx FormatMessageA SetFileTime WriteFile GetFileAttributesA FileTimeToSystemTime CreateDirectoryA GetFileSizeEx FindFirstFileA RemoveDirectoryA SetFileAttributesA FindClose MoveFileA FindNextFileA FileTimeToLocalFileTime LocalFree DeleteFileA LoadLibraryW MultiByteToWideChar GetModuleHandleA GetVersionExA CreateProcessA GetSystemTime SetUnhandledExceptionFilter GetWindowsDirectoryA GlobalMemoryStatus FindFirstFileW FindNextFileW GetFileAttributesW FoldStringW WideCharToMultiByte CreateDirectoryW DeleteFileW GetDiskFreeSpaceExA CopyFileA HeapSetInformation GetCommandLineA InitializeCriticalSectionAndSpinCount GetProcessId MapViewOfFile UnmapViewOfFile CreateFileMappingA ExpandEnvironmentStringsA SetThreadAffinityMask OpenThread OpenFile TerminateProcess GetSystemTimes RaiseException GetModuleHandleW VirtualQuery DecodePointer ExitProcess GetModuleHandleExW AreFileApisANSI IsDebuggerPresent |
| GDI32.dll |
DeleteDC
GetDeviceCaps GetStockObject CreateDCA ExtEscape |
| ADVAPI32.dll |
RegQueryValueExA
CryptAcquireContextA RegCloseKey RegOpenKeyExA RegOpenKeyA RegEnumKeyA |
| SHELL32.dll |
ShellExecuteA
SHGetFolderPathW SHCreateDirectoryExA SHGetFolderPathA |
| ole32.dll |
CoInitialize
CoCreateInstance CLSIDFromString CoSetProxyBlanket CoInitializeEx CoUninitialize |
| OLEAUT32.dll |
VariantClear
VariantInit SysAllocString SysFreeString SysStringLen |
| DINPUT8.dll |
DirectInput8Create
|
| WINTRUST.dll |
WTHelperProvDataFromStateData
WinVerifyTrust WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain |
Delayed Imports
SPAFILE
1
2
3
4
5
6
7
104
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.2.0.43 |
| ProductVersion | 1.2.0.43 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | English - United States |
| CompanyName | Rockstar Games |
| FileDescription | Grand Theft Auto IV |
| FileVersion (#2) | 1.2.0.43 |
| InternalName | Grand Theft Auto IV |
| LegalCopyright | Rockstar Games Inc. (C) 2005-2020 Take Two Interactive. All rights reserved. |
| OriginalFilename | GTAIV.exe |
| ProductName | Grand Theft Auto IV |
| ProductVersion (#2) | 1.2.0.43 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2020-Jun-01 15:33:36 |
| Version | 0.0 |
| SizeofData | 58 |
| AddressOfRawData | 0xbe8fd0 |
| PointerToRawData | 0xbe7fd0 |
| Referenced File | x:\gta\build\GTA4_Win32_Final.pdb |
IMAGE_DEBUG_TYPE_VC_FEATURE
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2020-Jun-01 15:33:36 |
| Version | 0.0 |
| SizeofData | 16 |
| AddressOfRawData | 0xbe900c |
| PointerToRawData | 0xbe800c |
TLS Callbacks
| StartAddressOfRawData | 0x1c9c000 |
|---|---|
| EndAddressOfRawData | 0x1c9c8f0 |
| AddressOfIndex | 0x17aba14 |
| AddressOfCallbacks | 0xe75614 |
| SizeOfZeroFill | 0 |
| Characteristics |
IMAGE_SCN_TYPE_REG
|
| Callbacks | (EMPTY) |
Load Configuration
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x1057f54 |
| SEHandlerTable | 0x102d6d0 |
| SEHandlerCount | 3 |
RICH Header
| XOR Key | 0x4879d76c |
|---|---|
| Unmarked objects | 0 |
| C objects (VS2008 SP1 build 30729) | 3 |
| Imports (50929) | 2 |
| Imports (VS2008 SP1 build 30729) | 4 |
| Imports (2179) | 2 |
| C objects (VS2003 (.NET) SP1 build 6030) | 5 |
| ASM objects (50929) | 55 |
| C++ objects (50929) | 73 |
| Imports (VS2012 build 50727 / VS2005 build 50727) | 4 |
| C++ objects (VS2012 UPD4 build 61030) | 653 |
| 188 (30716) | 3 |
| C++ objects (VS2003 (.NET) build 3077) | 1 |
| C++ objects (VS2012 build 50727 / VS2005 build 50727) | 1 |
| 190 (30716) | 3 |
| C++ objects (VS2010 build 30319) | 3 |
| Total imports | 420 |
| 185 (30716) | 35 |
| C objects (50929) | 227 |
| 211 (VS2012 UPD4 build 61030) | 796 |
| Resource objects (VS2012 UPD4 build 61030) | 1 |
| 151 | 2 |
| Linker (VS2012 UPD4 build 61030) | 1 |
Errors
Leave a comment
No comments yet.