N:\PRO\TrMonoHelper\Release\TrMonoClient.pdb
Static task
static1
Behavioral task
behavioral1
Sample
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/Tale.of.Wuxia.Plus.67.Trainer.V2.3.0-XiaoXing.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/Tale.of.Wuxia.Plus.67.Trainer.V2.3.0-XiaoXing.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/TrMonoClient.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/TrMonoClient.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/TrMonoServer.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/TrMonoServer.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/游戏大全.url
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/游戏大全.url
Resource
win10v2004-20240802-en
General
-
Target
d094663b449f0c15b55ae956fef6951e_JaffaCakes118
-
Size
2.7MB
-
MD5
d094663b449f0c15b55ae956fef6951e
-
SHA1
1aa618eddcbcbdc54b9a3775149602d4820066da
-
SHA256
23b7897c2f6abfc9b8838cf5067353c091b3ca2c27814b9faa92bac9d0bf50e7
-
SHA512
f19b01d8f53f91d6e780262ef9366ba666ecbc03a8d3ba2ec66381ff02724a2955680ef1d3a81d99198ec8c89bfd297d0eac3527f7574663ed0007a4f4a4cac7
-
SSDEEP
49152:KNLTGPrHqMptJOcm+E+5ehil6jvgEuajta3K325KFpjy+Hh2n2ykH8JXKxGpq:KYHTjEcmBH4YkPMBG5AM+Ha2yu8JXpq
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/Tale.of.Wuxia.Plus.67.Trainer.V2.3.0-XiaoXing.exe unpack001/侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/TrMonoClient.dll unpack001/侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/TrMonoServer.dll
Files
-
d094663b449f0c15b55ae956fef6951e_JaffaCakes118.rar
-
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/RoutineExp.txt
-
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/Tale.of.Wuxia.Plus.67.Trainer.V2.3.0-XiaoXing.exe.exe windows:4 windows x86 arch:x86
7c8100ffb31092a002cdbed49982479c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
htons
version
VerLanguageNameA
rasapi32
RasHangUpA
kernel32
QueryPerformanceCounter
user32
PeekMessageA
gdi32
ExcludeClipRect
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
GetUserNameA
shell32
ShellExecuteA
ole32
OleRun
oleaut32
VariantCopy
comctl32
ImageList_ReplaceIcon
wininet
InternetCanonicalizeUrlA
comdlg32
GetFileTitleA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 1.7MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/TrMonoClient.dll.dll windows:5 windows x86 arch:x86
1bd31ef4b0ba98bccc732f3bfe702ba2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
GetLastError
CreateFileA
Sleep
ReadFile
WriteFile
GetModuleHandleW
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
FlushFileBuffers
WriteConsoleW
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
HeapAlloc
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapSize
SetLastError
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
GetStringTypeW
SetStdHandle
CreateFileW
user32
MessageBoxA
Exports
Exports
CompileMonoMethod
ConnectTrMonoServer
InjectTrMonoServerDll
QueryMonoAssembly
QueryMonoDomain
Sections
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/TrMonoServer.dll.dll windows:5 windows x86 arch:x86
ac6cab2f9d05ef0d4cb7341a3faf9eb1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateNamedPipeA
GetLastError
ConnectNamedPipe
Sleep
ReadFile
WriteFile
CreateThread
LoadLibraryW
GetProcAddress
GetModuleHandleA
GetCurrentThread
FreeLibraryAndExitThread
GetCurrentProcessId
FlushFileBuffers
ReadConsoleW
GetCommandLineA
GetCurrentThreadId
EncodePointer
DecodePointer
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
HeapFree
SetLastError
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
HeapSize
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
HeapReAlloc
LCMapStringW
OutputDebugStringW
SetStdHandle
WriteConsoleW
GetStringTypeW
CreateFileW
user32
MessageBoxA
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/wuxia.ini
-
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/wuxia_Big5.ini
-
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/游戏大全.url.url
-
侠客风云传 六十七项修改器新武林多功能修改器V2.3.0/游戏说明.txt