996c8c56b9a6bd505b9c6f463adf1c6f34360f46f90c840b82a2b053440b9fae

Sharing

Copy URL Twitter E-mail

General

Target
996c8c56b9a6bd505b9c6f463adf1c6f34360f46f90c840b82a2b053440b9fae
Size 2.9MB
Sample261030-d4d24sdb72
SHA256 996c8c56b9a6bd505b9c6f463adf1c6f34360f46f90c840b82a2b053440b9fae
MD5 2a8fbfd94e70a1898da90040d41083fa
SHA1 8c7accb29ccd5c7215675e2e431138ba382bd38c
SHA512 98ad94096af407683c233c18a61dfe92b9ba6bf4512124ecaed023bd3ce2960554cf549a1f03c3bfb4bcace8762864fb85f44d88aa2d8b23595cc8032999db0b
SSDEEP 49152:BxAgKHofblM38Ug16xxlv6Me9fqDptwwe9nChXm2YKzjXQQptXqNHJDJphh0Vomu:BOvALUgElvJe9CDptwwagtgQ34JJDwot
TLSH
T10FE53356F07960EE67D3180D42E6C3A3D379ACD2E489F15EABD863F470448D2E979B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Eldenring_Offline.Trainer.V1.1.1-XiaoXing.exe

File Explorer

996c8c56b9a6bd505b9c6f463adf1c6f34360f46f90c840b82a2b053440b9fae

.zip 2.9MB
Eldenring_Offline.Trainer.V1.1.1-XiaoXing.rar

.rar 2.9MB
Eldenring.ini

236KB
Eldenring_Offline.Trainer.V1.1.1-XiaoXing.exe

.exe 6.2MB
steam_appid.txt

14B
【必读】使用协议.txt

566B
使用方法.txt

1KB
离线模式运行方法.txt

948B

996c8c56b9a6bd505b9c6f463adf1c6f34360f46f90c840b82a2b053440b9fae

SHA256 996c8c56b9a6bd505b9c6f463adf1c6f34360f46f90c840b82a2b053440b9fae
MD5 2a8fbfd94e70a1898da90040d41083fa
SHA1 8c7accb29ccd5c7215675e2e431138ba382bd38c
SHA512 98ad94096af407683c233c18a61dfe92b9ba6bf4512124ecaed023bd3ce2960554cf549a1f03c3bfb4bcace8762864fb85f44d88aa2d8b23595cc8032999db0b
SSDEEP 49152:BxAgKHofblM38Ug16xxlv6Me9fqDptwwe9nChXm2YKzjXQQptXqNHJDJphh0Vomu:BOvALUgElvJe9CDptwwagtgQ34JJDwot
TLSH
T10FE53356F07960EE67D3180D42E6C3A3D379ACD2E489F15EABD863F470448D2E979B02
MD5 SHA1 SHA512 SSDEEP TLSH

Eldenring_Offline.Trainer.V1.1.1-XiaoXing.exe

IMPHASH 3015df76734efb35a6b96953a8c2a722
SHA256 59ec647df1c9b977e535be6b7310c14afba322e9c2c99d2621b53f72458992d5
MD5 6f07aa32f459f45db1757ae93b0ede5f
SHA1 a60ec9305bbf0edf58a33a0262413f5577b93a94
SHA512 d5935bea1275516c91ae19851437ee16ebb6ec81afc146ab4105c152cad019cb058e392fa1251bd05e7eb65e000c4dc7e7bb39bc1e455885dfcc80ab851421d2
SSDEEP 98304:p+pH8YP9f5OMU8yCTxZP8MMP6CjFLOAkGkzdnEVomFHKnP:pgP9xKCtZ0MK6CjFLOyomFHKnP
TLSH
T1AF56AE456FFC40E9E4B6D035C96BA52BE6B2BC5517314BDB00A0A69E5F337E10E39322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2375352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTimeZoneInformation LCMapStringW PeekNamedPipe GetFileInformationByHandle GetDriveTypeW SetConsoleCtrlHandler ExitProcess GetOEMCP QueryPerformanceFrequency HeapQueryInformation GetCommandLineW GetCommandLineA VirtualQuery VirtualAlloc GetSystemInfo SetFilePointerEx ExitThread RtlPcToFileHeader RtlUnwindEx FindNextFileW LoadLibraryA ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertFiberToThread DeleteFiber GetFileType GetEnvironmentVariableW GetStdHandle GetConsoleCP FindFirstFileExW IsValidCodePage FreeLibraryAndExitThread GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW WriteConsoleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetTempFileNameW GetProfileIntW SearchPathW GetWindowsDirectoryW FindResourceExW SetErrorMode SystemTimeToTzSpecificLocalTime GetFileTime GetACP GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime FileTimeToSystemTime VirtualProtect GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GlobalGetAtomNameW VerifyVersionInfoW VerSetConditionMask GetPrivateProfileIntW lstrcpyW GetVersionExW GetCurrentThread lstrcmpA GetThreadLocale lstrcmpiW DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers FindFirstFileW FindClose DeleteFileW ResumeThread SuspendThread SetThreadPriority WaitForSingleObject SetEvent GetCurrentProcessId InitializeCriticalSectionAndSpinCount CopyFileW FormatMessageW MulDiv LocalFree GlobalFree GlobalUnlock GlobalLock GlobalSize GlobalAlloc CompareStringW QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryW LoadLibraryExW GetProcAddress GetModuleHandleExW FreeResource FreeLibrary GetSystemDirectoryW GetCurrentThreadId SetLastError EncodePointer OutputDebugStringA GetFileAttributesW GetModuleHandleW GetModuleFileNameW CreateEventW GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc HeapSize InitializeCriticalSectionEx LeaveCriticalSection SizeofResource EnterCriticalSection HeapFree GetTickCount GetCurrentProcess DeviceIoControl CreateFileW CreateDirectoryW VirtualFreeEx WritePrivateProfileStringW GetTempPathW MultiByteToWideChar GetCurrentDirectoryW OpenProcess WriteProcessMemory ReadProcessMemory VirtualProtectEx VirtualAllocEx VirtualQueryEx Module32NextW Module32FirstW K32GetProcessImageFileNameW QueryDosDeviceW GetLogicalDriveStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot SetThreadUILanguage GetLastError CreateMutexW OutputDebugStringW WideCharToMultiByte Sleep CloseHandle CreateThread GetPrivateProfileStringW FindResourceW LoadResource LockResource SetStdHandle

user32

IntersectRect ShowOwnedPopups EnumDisplayMonitors SystemParametersInfoW SetLayeredWindowAttributes DrawIconEx IsRectEmpty InflateRect DrawFocusRect GetSysColorBrush SetWindowRgn DrawFrameControl DrawEdge MapDialogRect SetWindowContextHelpId PostQuitMessage WaitMessage GetMessageW SetRectEmpty SendDlgItemMessageA GetCursorPos ClientToScreen GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetDesktopWindow GetActiveWindow GetNextDlgTabItem EndDialog CreateDialogIndirectParamW ReleaseDC MapVirtualKeyW GetKeyNameTextW FillRect DrawStateW RemoveMenu AppendMenuW InsertMenuW GetMenuState GetMenuStringW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW SetWindowTextW IsWindowEnabled CheckDlgButton SetDlgItemTextW InvalidateRgn SetRect GetNextDlgGroupItem SetParent OpenClipboard CloseClipboard SetClipboardData EnableWindow MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW EmptyClipboard EqualRect CopyRect GetSysColor MapWindowPoints ScreenToClient GetMenuItemInfoW CopyImage RealChildWindowFromPoint GetAsyncKeyState TrackMouseEvent IsZoomed SetCapture ReleaseCapture GetSystemMenu DeleteMenu MessageBeep WindowFromPoint NotifyWinEvent CreatePopupMenu GetMenuDefaultItem GetWindowTextLengthW RemovePropW SetMenuDefaultItem UpdateLayeredWindow EnableScrollBar CopyAcceleratorTableW UnionRect MonitorFromPoint DestroyIcon LoadImageW CharNextW DestroyMenu SendMessageW GetWindowRect PostMessageW GetFocus GetParent GetWindow IsWindowVisible GetClassNameW GetWindowThreadProcessId GetWindowTextW EnumWindows MessageBoxW GetWindowLongW GetUserObjectInformationW GetProcessWindowStation CharUpperW LoadIconW GetClientRect GetDC SetTimer RegisterHotKey OffsetRect IsIconic GetSystemMetrics DrawIcon UnregisterHotKey KillTimer InvalidateRect SetCursor LoadCursorW PeekMessageW TranslateMessage DispatchMessageW UnregisterClassW LoadMenuW GetSubMenu RegisterWindowMessageW GetMessagePos GetMessageTime DefWindowProcW CallWindowProcW RegisterClassW GetClassInfoW GetClassInfoExW CreateWindowExW IsWindow IsMenu IsChild DestroyWindow SetWindowPos GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos GetDlgItem GetDlgCtrlID SetFocus GetKeyState GetCapture GetMenu SetMenu GetMenuItemID GetMenuItemCount TrackPopupMenu UpdateWindow SetActiveWindow GetForegroundWindow SetForegroundWindow BeginPaint SetCursorPos BringWindowToTop LockWindowUpdate GetDoubleClickTime EndPaint ValidateRect RedrawWindow ScrollWindow SetScrollPos GetScrollPos SetScrollRange GetScrollRange ShowScrollBar SetPropW GetPropW AdjustWindowRectEx GetIconInfo CopyIcon ModifyMenuW DestroyAcceleratorTable SetClassLongPtrW GetUpdateRect ToUnicodeEx GetKeyboardLayout GetKeyboardState LoadAcceleratorsW CreateAcceleratorTableW RegisterClipboardFormatW CharUpperBuffW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam FrameRect PostThreadMessageW HideCaret InvertRect SubtractRect IsClipboardFormatAvailable IsCharLowerW MapVirtualKeyExW DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel GetComboBoxInfo CreateMenu DestroyCursor GetWindowRgn PtInRect

gdi32

MoveToEx TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CombineRgn CreateEllipticRgn Ellipse GetBkColor GetTextColor GetTextExtentPoint32W CreatePolygonRgn Polygon Polyline GetTextMetricsW CreateCompatibleBitmap CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo GetMapMode SetRectRgn DPtoLP CreateRoundRectRgn GetRgnBox RealizePalette SetPixel StretchBlt SetDIBColorTable Rectangle OffsetRgn RoundRect CreatePalette GetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries LPtoDP ExtFloodFill SetPaletteEntries FillRgn FrameRgn GetBoundsRect PtInRegion GetViewportOrgEx GetWindowOrgEx SetPixelV GetTextFaceW SetROP2 SetPolyFillMode GetLayout SetLayout SetMapMode SetBkMode SelectPalette ExtSelectClipRgn SelectClipRgn SaveDC RestoreDC RectVisible PtVisible LineTo IntersectClipRect GetWindowExtEx GetViewportExtEx GetPixel GetObjectType GetClipBox SetTextAlign EnumFontFamiliesExW ExcludeClipRect Escape CreateRectRgn CreatePatternBrush CreatePen CreateHatchBrush CreateCompatibleDC BitBlt PatBlt CreateRectRgnIndirect DeleteObject CreateSolidBrush CreateDCW CopyMetaFileW CreateBitmap SetTextColor SetBkColor DeleteDC CreateFontIndirectW GetObjectW GetStockObject CreateDIBSection SelectObject GetDeviceCaps

msimg32

TransparentBlt AlphaBlend

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegCreateKeyExW RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW RegDeleteValueW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW CryptGenRandom OpenSCManagerW OpenServiceW ChangeServiceConfigW StartServiceW RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteKeyW DeleteService ControlService CloseServiceHandle QueryServiceStatus

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetFileInfoW SHGetMalloc SHBrowseForFolderW SHGetDesktopFolder SHAppBarMessage DragFinish DragQueryFileW ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCW PathFindExtensionW PathIsDirectoryW StrFormatKBSizeW PathRemoveFileSpecW PathFindFileNameW PathFileExistsW PathStripToRootW

uxtheme

IsAppThemed IsThemeBackgroundPartiallyTransparent GetThemePartSize GetWindowTheme DrawThemeText DrawThemeParentBackground GetCurrentThemeName GetThemeColor DrawThemeBackground CloseThemeData OpenThemeData GetThemeSysColor

ole32

CoRegisterMessageFilter CoRevokeClassObject IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleUninitialize OleInitialize CoFreeUnusedLibraries OleGetClipboard OleIsCurrentClipboard OleFlushClipboard CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CoDisconnectObject CLSIDFromProgID CLSIDFromString CoCreateGuid ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoSetProxyBlanket CoCreateInstance CoInitializeEx CoUninitialize CoInitialize DoDragDrop

oleaut32

SafeArrayDestroy VarBstrFromDate SysStringLen VariantChangeType SysAllocStringLen VariantClear VariantInit SysFreeString SysAllocString SystemTimeToVariantTime VariantTimeToSystemTime OleCreateFontIndirect VariantCopy LoadTypeLi

oledlg

OleUIBusyW

gdiplus

GdipAlloc GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipDeleteGraphics GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePalette GdipGetImagePaletteSize GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapUnlockBits GdipBitmapLockBits GdiplusShutdown

ws2_32

accept bind closesocket connect htonl htons inet_addr recv recvfrom select send sendto socket gethostbyname WSAStartup WSACleanup WSASetLastError WSAGetLastError WSAAsyncSelect

winmm

PlaySoundW

wininet

InternetOpenW InternetCloseHandle InternetReadFile InternetOpenUrlW

dnsapi

DnsQuery_W DnsFree

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

Sharing

General

Malware Config

Signatures

File Explorer

996c8c56b9a6bd505b9c6f463adf1c6f34360f46f90c840b82a2b053440b9fae

Eldenring_Offline.Trainer.V1.1.1-XiaoXing.rar

Eldenring.ini

Eldenring_Offline.Trainer.V1.1.1-XiaoXing.exe

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

winmm

wininet

dnsapi

crypt32

oleacc

imm32

generic

steam_appid.txt

【必读】使用协议.txt

使用方法.txt

离线模式运行方法.txt