Cheat Engine

GreyPaws · How do I cheat? Reputation: 0 Joined: 20 May 2016 Posts: 3

Hi,

I was hoping you guys could take a look at this trainer and let me know if it contains malicious code. The trainer is an EXE, and after doing some light research on this forum I realized that I couldn't simply open the file using CE to check for bad code. After running this file on my own PC, I noticed minor changes were made to my browser settings. I ran a full system sweep using Kaspersky and found a bunch of stuff:

Trojan.WinLNK.StartPage.gena
AdWare.Win32.Shopper.xgf
Trojan.Win32.Generic
Trojan.Win32.Addrop.c
AdWare.MSIL.Agent.aabh
AdWare.MSIL.Agent.abud
AdWare.Win32.ConvertAd.bdhc

A few others, but im sure you get where i'm coming from. There were other signs something wasnt right, it looked like something tried modifying the proxy settings on the browser, and a custom DNS entry. Please be careful when looking at this trainer, and thanks in advance.

I tried attaching the file to this post, I guess .RAR and .EXE are not allowed. Please use the links below to get the file from cloud storage, i included two hosts:

mgr.inz.Player

Trainer generated with official CE6.4 from 26 VI 2014.

I checked extracted folder. You can check it too here:
%TMP%\cetrainers\CET7D43.tmp\extracted

Launch trainer and use above path in file explorer. Both binaries properly signed (with DarkByte certificate).

Hack BBH v1.1.10.792_64Bit.exe - this is 64bit CE renamed
lua5.1-64.dll - this is Lua engine
defines.lua - a lua script which set variable constants

Also file "Hack BBH v1.1.10.792_64Bit.exe" in %TMP%\cetrainers\CET7D43.tmp\
is also a properly signed launcher.

About CET7D43.tmp folder name, yours will be different.

virustotal results:
https://www.virustotal.com/pl/file/ceef98de2a00034a24e049e740568bb3f964dbc1524063d070f8bdb4ccd6314b/analysis/1463757194/

Not bad. Only 17 / 56 hit ratio. I saw much bigger hit ratio for my own trainer generated with CE6.4 back then, trainer for STALKER:COP.

Those are true:
ESET-NOD32 - a variant of Win32/HackTool.CheatEngine.AF potentially unsafe
Malwarebytes - HackTool.CheatEngine
Yandex - HackTool.CheatEngine!h2lP7QG9eRI

The other scanner results are just false-positive, pure bullshit. Those scanners just detect launcher or CE itself, and don't give a fuck what script inside trainer really do.

trainer was generated with CheatEngine. If trainer was downloaded from other place than ce forums, it is potentially unsafe.

Are you sure you downloaded a trainer and not a uploaded.net file downloader.

atom0s · Posted: Fri May 20, 2016 11:18 am Post subject:

With the trainer fully dumped it uses:

GreyPaws · How do I cheat? Reputation: 0 Joined: 20 May 2016 Posts: 3

Thanks for checking on that for me, I just wanted to make sure this thing didnt do anything strange or hidden. I'm not a PC noob, I originally got the trainer from a cloud storage site using my own download manager. The only thing I can think of is that I did visit the web site advertised on the bottom of the trainer just to see what it was all about, I didnt download or click on anything on that site tho, so I'm still at a bit of a loss as to where the spyware came from. The logs show that everything was fine before the time stamp of when I first ran the trainer to see if it actually worked.

If I figure anything out, I will post an update here. I also dont care about the code or source or whatever, as I'm not into programming and CE was just a novel thing to play with for me. I learned the basic stuff I wanted to learn, like how to find and change the value for money on certain single player PC games like Starpoint Gemeni and other space trading games like that.

Thanks again to all those who took the time to look

STN · Posted: Fri May 20, 2016 3:00 pm Post subject:

Easy to know if the site is suspicious/spreading malware.

Blog types site with no ability for users to comment

Download links hidden behind url shortners/click tracking url shortners e.g bitly. Spammers use these to track the success of their spam campaign.

Sites leeching off other trainer makers e.g a site that goes by flingtrainers. Not always though

No author info

Youtube videos - I don't want to say this because i do youtube videos as my main traffic source but these malware videos will ALWAYS have likes/dislikes hidden and link to bitly/click tracking url shortners again for track the success of their spam campaign. Good thing is these videos do not stick for long so a video with age > 1 month or even 1 week is always going to be legit

GreyPaws · How do I cheat? Reputation: 0 Joined: 20 May 2016 Posts: 3