L2[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

L2.bin
Size

3.2MB
MD5

e2d0fea75a0609559750b3eed8506ff2
SHA1

2582f7d16eec6866b2a4d9fed9ed1076be3682da
SHA256

2fde9fd6ca51ca539e503b3bb7486d4edb2963c97ba20974f02fb22907d6ffc6
SHA512

45ef372c8831d88713de61be0fadaeb2e5fcc876236b3b57ddd9a0f486424eba42a0e3ac4253ba7cce7467e6003f205961fac90c98257f3fb8a2711d52ab79c5
SSDEEP

98304:VIKsdbabWWWWWv+fBvW5JDDt88+fSK2ftC:VlsdbabWWWWW2FW5JDXKSzC

Score

N/A

Malware Config

Signatures

Files

L2.bin
.exe windows x86

4a8a6960b597ed058a18bbf46d0ad338

Code Sign

7a:63:78:39:68:f1:da:fd:e3:1e:c5:88:23:99:c5:7a
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/08/2019, 00:00

Not After

22/08/2022, 23:59

Subject

CN=NCSOFT Corporation,O=NCSOFT Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27/05/2021, 09:55

Not After

28/06/2032, 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:63:78:39:68:f1:da:fd:e3:1e:c5:88:23:99:c5:7a
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/08/2019, 00:00

Not After

22/08/2022, 23:59

Subject

CN=NCSOFT Corporation,O=NCSOFT Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27/05/2021, 09:55

Not After

28/06/2032, 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:d8:ff:83:4c:e4:e0:0e:ce:b0:47:8d:c1:f5:a4:7c:61:d7:91:af:e9:8c:28:3c:60:1a:37:b8:ca:94:c3:ff
Signer

Actual PE Digest

33:d8:ff:83:4c:e4:e0:0e:ce:b0:47:8d:c1:f5:a4:7c:61:d7:91:af:e9:8c:28:3c:60:1a:37:b8:ca:94:c3:ff

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=NCSOFT Corporation,O=NCSOFT Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR

08/03/2022, 08:16
Valid: false

10:21:67:66:fe:b3:69:14:be:0c:c1:57:4e:8a:ab:8b:ff:5d:3d:bd
Signer

Actual PE Digest

10:21:67:66:fe:b3:69:14:be:0c:c1:57:4e:8a:ab:8b:ff:5d:3d:bd

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=NCSOFT Corporation,O=NCSOFT Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR

08/03/2022, 08:16
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy
GetTimeFormatW

comdlg32

GetSaveFileNameA

wsock32

WSAStartup

d3d9

Direct3DCreate9

ddraw

DirectDrawCreate

dsetup

ord11

core

?Flush@FOutputDevice@@UAEXXZ

engine

?StaticClass@URenderDevice@@SAPAVUClass@@XZ

window

?OnSize@WProperties@@UAEXKHH@Z

steam_api

SteamAPI_Shutdown

user32

EndPaint

gdi32

CombineRgn

shell32

ShellExecuteW

ole32

CoUninitialize

psapi

GetProcessMemoryInfo

Exports

Exports

GPackage
hs2ip
i2osp
i2ospsecond
mpadd
mpaddmul
mpaddsqrtrc
mpaddw
mpaddx
mpand
mpbaddmod_w
mpbcopy
mpbfree
mpbinit
mpbits
mpbmod_w
mpbmu_w
mpbmulmod_w
mpbnmulmod
mpbnpowmod
mpbnpowmodsld
mpbnrnd
mpbnsqrmod
mpbpowmod_w
mpbpowmodsld_w
mpbpprime_w
mpbrnd_w
mpbrndinv_w
mpbrndodd_w
mpbset
mpbsethex
mpbsqrmod_w
mpbsubmod_w
mpbsubone
mpbtwopowmod_w
mpbwipe
mpbzero
mpclrlsb
mpclrmsb
mpdivtwo
mpeq
mpeqmone
mpeqx
mpeven
mpextgcd_w
mpfill
mpfprint
mpfprintln
mpgcd_w
mpge
mpgex
mpgt
mpgtx
mpisone
mpistwo
mple
mpleone
mplex
mplsbset
mplshift
mplszcnt
mplt
mpltx
mpmod
mpmsbset
mpmszcnt
mpmul
mpmultwo
mpncopy
mpndivmod
mpne
mpneg
mpnex
mpnfree
mpngetintvalue
mpninit
mpninv
mpnorm
mpnot
mpnset
mpnsethex
mpnsetintvalue
mpnsetw
mpnsize
mpnwipe
mpnz
mpnzero
mpodd
mpor
mppmilrab_w
mppndiv
mpprint
mpprintln
mpprnd_w
mpprndconone_w
mpprndsafe_w
mpptrials
mprshift
mprshiftlsz
mpsdivtwo
mpsetlsb
mpsetmsb
mpsetmul
mpsetw
mpsize
mpsqr
mpsub
mpsubw
mpsubx
mpxor
mpz
mpzero
os2ip
rsakpCopy
rsakpFree
rsakpInit
rsakpMake
rsapri
rsapricrt
rsapub
rsavrfy

Sections

Size: 704KB - Virtual size: 704KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 828KB - Virtual size: 828KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sqwduufq
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ncfajyfm
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4a8a6960b597ed058a18bbf46d0ad338

Code Sign

7a:63:78:39:68:f1:da:fd:e3:1e:c5:88:23:99:c5:7aCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9fCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

7a:63:78:39:68:f1:da:fd:e3:1e:c5:88:23:99:c5:7aCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9fCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

33:d8:ff:83:4c:e4:e0:0e:ce:b0:47:8d:c1:f5:a4:7c:61:d7:91:af:e9:8c:28:3c:60:1a:37:b8:ca:94:c3:ffSigner

Signature Validations

Verification

08/03/2022, 08:16 Valid: false

10:21:67:66:fe:b3:69:14:be:0c:c1:57:4e:8a:ab:8b:ff:5d:3d:bdSigner

Signature Validations

Verification

08/03/2022, 08:16 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

comdlg32

wsock32

d3d9

ddraw

dsetup

core

engine

window

steam_api

user32

gdi32

shell32

ole32

psapi

Exports

Exports

Sections

Size: 704KB - Virtual size: 704KB

.rsrc Size: 828KB - Virtual size: 828KB

.idata Size: 1KB - Virtual size: 4KB

sqwduufq Size: 1.7MB - Virtual size: 1.7MB

ncfajyfm Size: 6KB - Virtual size: 12KB

7a:63:78:39:68:f1:da:fd:e3:1e:c5:88:23:99:c5:7a
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

7a:63:78:39:68:f1:da:fd:e3:1e:c5:88:23:99:c5:7a
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

33:d8:ff:83:4c:e4:e0:0e:ce:b0:47:8d:c1:f5:a4:7c:61:d7:91:af:e9:8c:28:3c:60:1a:37:b8:ca:94:c3:ff
Signer

08/03/2022, 08:16
Valid: false

10:21:67:66:fe:b3:69:14:be:0c:c1:57:4e:8a:ab:8b:ff:5d:3d:bd
Signer

08/03/2022, 08:16
Valid: false

.rsrc
Size: 828KB - Virtual size: 828KB

.idata
Size: 1KB - Virtual size: 4KB

sqwduufq
Size: 1.7MB - Virtual size: 1.7MB

ncfajyfm
Size: 6KB - Virtual size: 12KB