N:\PRO\TrMonoHelper\Release\TrMonoClient.pdb
Static task
static1
Behavioral task
behavioral1
Sample
仙剑6七十二项修改器2.7.1/PAL6.Plus.72.Trainer.V2.7.1-XiaoXing.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
仙剑6七十二项修改器2.7.1/PAL6.Plus.72.Trainer.V2.7.1-XiaoXing.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
仙剑6七十二项修改器2.7.1/TrMonoClient.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
仙剑6七十二项修改器2.7.1/TrMonoClient.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
仙剑6七十二项修改器2.7.1/TrMonoServer.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
仙剑6七十二项修改器2.7.1/TrMonoServer.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
仙剑6七十二项修改器2.7.1/游迅网.url
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
仙剑6七十二项修改器2.7.1/游迅网.url
Resource
win10v2004-20241007-en
General
-
Target
3b0a6d95c657491c714e10f0f26bee8e_JaffaCakes118
-
Size
2.8MB
-
MD5
3b0a6d95c657491c714e10f0f26bee8e
-
SHA1
d3f3f9fbe59fbce2f45ac7879a0e35b3331594ad
-
SHA256
3cba9ec61d78351a20c22133b855a4c3a3f72f267df2f2d1c9267bf202b19d96
-
SHA512
8dc23616ec8f8bf5e499e8c23d90b907e806c411d5165b28361e80d0c41b614f410b359a9b0115d9cf4d8ff1cec2c1821f882f99ef005a281b522910a65aefad
-
SSDEEP
49152:7jh2lG/M5vVHZ1HVtfMqm4Jp0RLaSl65VbOGi2ztMdfVaRL7+AArB9fx51NBdW:7cU05vVHHVt3ia7aGiMtMdfkL75AF9ZI
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/仙剑6七十二项修改器2.7.1/PAL6.Plus.72.Trainer.V2.7.1-XiaoXing.exe unpack001/仙剑6七十二项修改器2.7.1/TrMonoClient.dll unpack001/仙剑6七十二项修改器2.7.1/TrMonoServer.dll
Files
-
3b0a6d95c657491c714e10f0f26bee8e_JaffaCakes118.rar
-
仙剑6七十二项修改器2.7.1/PAL6.Plus.72.Trainer.V2.7.1-XiaoXing.exe.exe windows:4 windows x86 arch:x86
7c8100ffb31092a002cdbed49982479c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamOut
ws2_32
htons
version
VerLanguageNameA
rasapi32
RasHangUpA
kernel32
QueryPerformanceCounter
user32
PeekMessageA
gdi32
ExcludeClipRect
msimg32
GradientFill
winspool.drv
OpenPrinterA
advapi32
GetUserNameA
shell32
ShellExecuteA
ole32
OleRun
oleaut32
VariantCopy
comctl32
ImageList_ReplaceIcon
wininet
InternetCanonicalizeUrlA
comdlg32
GetFileTitleA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 1.8MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
仙剑6七十二项修改器2.7.1/Pal6.ini
-
仙剑6七十二项修改器2.7.1/Pal6_Big5.ini
-
仙剑6七十二项修改器2.7.1/TrMonoClient.dll.dll windows:5 windows x86 arch:x86
1bd31ef4b0ba98bccc732f3bfe702ba2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
GetLastError
CreateFileA
Sleep
ReadFile
WriteFile
GetModuleHandleW
GetProcAddress
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
FlushFileBuffers
WriteConsoleW
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
HeapAlloc
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapSize
SetLastError
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
GetStringTypeW
SetStdHandle
CreateFileW
user32
MessageBoxA
Exports
Exports
CompileMonoMethod
ConnectTrMonoServer
InjectTrMonoServerDll
QueryMonoAssembly
QueryMonoDomain
Sections
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
仙剑6七十二项修改器2.7.1/TrMonoServer.dll.dll windows:5 windows x86 arch:x86
ac6cab2f9d05ef0d4cb7341a3faf9eb1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateNamedPipeA
GetLastError
ConnectNamedPipe
Sleep
ReadFile
WriteFile
CreateThread
LoadLibraryW
GetProcAddress
GetModuleHandleA
GetCurrentThread
FreeLibraryAndExitThread
GetCurrentProcessId
FlushFileBuffers
ReadConsoleW
GetCommandLineA
GetCurrentThreadId
EncodePointer
DecodePointer
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
HeapFree
SetLastError
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
HeapSize
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
HeapReAlloc
LCMapStringW
OutputDebugStringW
SetStdHandle
WriteConsoleW
GetStringTypeW
CreateFileW
user32
MessageBoxA
Sections
.text Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
仙剑6七十二项修改器2.7.1/使用方法.txt
-
仙剑6七十二项修改器2.7.1/游迅网.url.url
-
仙剑6七十二项修改器2.7.1/说明.txt