home

gta_sa.exe

It runs as a scheduled task under the Windows Task Scheduler.
MD5:
8a3ff2c40e64ecb8ebe9a51d36b18b21

SHA-1:
7c53c5cac16de1637f3bae1ac29968f2f320f3c7

SHA-256:
92235acd70de7ffd5af55f9786b8ce4b71025f8a1c06f0df328c7c27d76dece4

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/17/2024 2:39:07 AM UTC  (today)

File size:
13.7 MB (14,380,032 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\rockstar games\gta san andreas\gta_sa.exe

File PE Metadata
Compilation timestamp:
4/28/2005 8:31:22 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.0

CTPH (ssdeep):
196608:1YQnnDbxRXCeeVJGfp/N+AYqyL3TTrbJvvAi80JFCC:1XnDbnyeeVJGfJN+n1r

Entry address:
0x424570

Entry point:
6A, 60, 68, 78, 80, 88, 00, E8, 64, 41, 00, 00, BF, 94, 00, 00, 00, 8B, C7, E8, E8, DA, FF, FF, 89, 65, E8, 8B, F4, 89, 3E, 56, FF, 15, 44, 81, 85, 00, 8B, 4E, 10, 89, 0D, 08, AC, C9, 00, 8B, 46, 04, A3, 14, AC, C9, 00, 8B, 56, 08, 89, 15, 18, AC, C9, 00, 8B, 76, 0C, 81, E6, FF, 7F, 00, 00, 89, 35, 0C, AC, C9, 00, 83, F9, 02, 74, 0C, 81, CE, 00, 80, 00, 00, 89, 35, 0C, AC, C9, 00, C1, E0, 08, 03, C2, A3, 10, AC, C9, 00, 33, F6, 56, 8B, 3D, 68, 80, 85, 00, FF, D7, 66, 81, 38, 4D, 5A, 75, 1F, 8B, 48, 3C, 03...
 
[+]

Entropy:
6.2290

Developed / compiled with:
Microsoft Visual C++ v7.0

Code size:
10.8 MB (11,304,960 bytes)

Scheduled Task
Task name:
{7E801B74-5630-4812-8C8D-6F6C2F244349}

Trigger:
Registration (Runs on registration)


The file gta_sa.exe has been discovered within the following programs.

Grand Theft Auto: San Andreas  by Rockstar Games
www.rockstargames.com
About 3% of users remove it
GTA San Andreas  by Rockstar Games Inc.
Grand Theft Auto: San Andreas is an open world action-adventure video game.
1% remove it
 
Powered by Should I Remove It?

The file gta_sa.exe has been seen being distributed by the following 11 URLs.

temp:GTA SA.EXE

http://dla.uloz.to/Ps;Hs;fid=54502156;cid=1844150580;rid=450677496;up=0;uip=217.119.127.122;tm=1480350961;ut=f;aff=uloz.to;did=uloz-to;He;ch=03487db6db2e46ca51e3cbe73c3b7d5d;Pe/.../gta-san-andreas-100-bez-viru-exe?bD&c=1844150580&De

https://docs.google.com/uc?id=0By9QQna6ro0XZ2hNekRGTjc0bVE&export=download

http://dla.uloz.to/Ps;Hs;fid=20335942;cid=1355731523;rid=929721526;up=0;uip=109.81.210.131;tm=1480177123;ut=f;aff=ulozto.cz;did=ulozto-cz;He;ch=4f63144d3caf28754eede7a2c9db8c9c;Pe/.../gta-san-andreas-crack-exe?bD&c=1355731523&De

https://downloader.disk.yandex.com/disk/b9177b82e8de6392c375d79131ef83b355a1fd79bb9c36b064c7fe21e2f2a267/57fbaf0b/os9PZv1PvUNjg-_Jv9IhonJcMMrT74iKUNWZol9xG1ToG_TxrvrGXGmJLgDsszuIq_Z_yFDLHnOLg4hdvNOBFg==?uid=0&filename=GTA_SA.EXE&disposition=attachment&hash=VkwDtBnVL9HUC Eg61jZqHPt2aHA1rpiE/.../x-msdownload&fsize=14380032&hid=2ae61a0d1872ed64a78c3d3954c6f2a2&media_type=executable&tknv=v2

http://dla.uloz.to/Ps;Hs;fid=20335942;cid=735977284;rid=888410620;up=0;uip=89.103.158.49;tm=1475860913;ut=f;aff=ulozto.cz;did=ulozto-cz;He;ch=6a114484668ac0c459f5243daaaeacab;Pe/.../gta-san-andreas-crack-exe/.../gta-san-andreas-crack-exe?bD&c=735977284&De

http://dla.uloz.to/Ps;Hs;fid=20335942;cid=1195697826;rid=1361451496;up=0;uip=195.28.75.18;tm=1466439204;ut=f;aff=uloz.to;did=uloz-to;He;ch=d4811318a5d09229a5620f9279e40374;Pe/.../gta-san-andreas-crack-exe?bD&c=1195697826&De

https://doc-0o-58-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/kupf0m7elrql6tr9utm9lhhvhu12s0oj/1464912000000/06291187822207184541/.../0B8L9E_4LmixHRy0yR2RhcEpuaFE?e=download

https://downloader.disk.yandex.com/disk/68124ec1ce6a15d368df924a45941e70d08ceda3ea7b711996b2a05775fc3b3a/56593157/os9PZv1PvUNjg-_Jv9IhonJcMMrT74iKUNWZol9xG1ToG_TxrvrGXGmJLgDsszuIq_Z_yFDLHnOLg4hdvNOBFg==?uid=0&filename=GTA_SA.EXE&disposition=attachment&hash=VkwDtBnVL9HUC Eg61jZqHPt2aHA1rpiE/.../x-msdownload&fsize=14380032&hid=2ae61a0d1872ed64a78c3d3954c6f2a2&media_type=executable&tknv=v2

https://downloader.disk.yandex.com/disk/b41b5747830c3f3ae87ec7868d26f679a80eb0cf3c4b4e0d526011659852b4f3/56beed37/os9PZv1PvUNjg-_Jv9IhonJcMMrT74iKUNWZol9xG1ToG_TxrvrGXGmJLgDsszuIq_Z_yFDLHnOLg4hdvNOBFg==?uid=0&filename=GTA_SA.EXE&disposition=attachment&hash=VkwDtBnVL9HUC Eg61jZqHPt2aHA1rpiE/.../x-msdownload&fsize=14380032&hid=2ae61a0d1872ed64a78c3d3954c6f2a2&media_type=executable&tknv=v2

https://doc-0s-3k-docs.googleusercontent.com/docs/securesc/tvj71jtsen2d6co1j2318ctqm2mfh7nt/6q4gs51aj46d5cpmon2qv7n73bhfpesj/1455213600000/01465635270484219781/.../0By9QQna6ro0XZ2hNekRGTjc0bVE?e=download&nonce=5cctk2q2t2pp6&user=03277864160731533731&hash=i6cirip300e075o76n8l40vsdj42cscm

Scan gta_sa.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.