Static task
static1
Behavioral task
behavioral1
Sample
L2DT--1.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
L2DT--1.exe
Resource
win10v2004-20231023-en
General
-
Target
L2DT--1.exe
-
Size
1019KB
-
MD5
a95746a52623718467ef211b0ea69380
-
SHA1
24cca9792b2b143e368b60e78bd7b467a55f0605
-
SHA256
9bb4acb9ac3ea7c56d290b75167568d96d06239d65e3d5d40e306f0f8f87c85e
-
SHA512
15ee68d67b6bbaadc7c8b3e1788584a6f99a22f1c8acd5c04e9bba09baa4becbbe0aeefebb507aa7a3fdbfcd01351c5d5f387f03e7dee74009891dcc6f00e09f
-
SSDEEP
12288:A7Of0jzjJ3gAybTWW0hxgpiM1CvAivQtB6fUD1Cwvy4N/U+PRyaVc/JOCLN+pZwY:Aq8eAyfv0PTpvKVvrd0V/JOwsp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource L2DT--1.exe
Files
-
L2DT--1.exe.exe windows:5 windows x64 arch:x64
3cbabb38742bd2d82cefa7ad275ad312
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mfc100
ord7027
ord9701
ord11953
ord8250
ord9724
ord1188
ord776
ord3270
ord2359
ord4189
ord9171
ord3156
ord1895
ord1872
ord5617
ord5094
ord7924
ord3603
ord883
ord5819
ord8982
ord5236
ord4920
ord10790
ord2753
ord2851
ord2852
ord3355
ord10747
ord2285
ord5046
ord4971
ord6929
ord12098
ord11772
ord5562
ord8001
ord10794
ord2353
ord12181
ord5319
ord2659
ord2877
ord2878
ord10054
ord12138
ord10366
ord10754
ord7833
ord12358
ord2591
ord5887
ord12926
ord6807
ord12928
ord2573
ord3842
ord13605
ord3849
ord4246
ord4213
ord4209
ord4243
ord4264
ord4222
ord4251
ord4260
ord4230
ord4234
ord4238
ord4226
ord4255
ord4218
ord1492
ord1485
ord1487
ord1481
ord1474
ord10875
ord10877
ord12284
ord2754
ord8047
ord9688
ord5973
ord10841
ord7766
ord12920
ord10577
ord3275
ord10712
ord7931
ord13599
ord13598
ord13670
ord13687
ord13683
ord13685
ord13686
ord13684
ord2354
ord7057
ord2785
ord2788
ord12185
ord5321
ord2726
ord2839
ord6423
ord369
ord944
ord395
ord7283
ord1457
ord12710
ord3991
ord12752
ord11465
ord12619
ord7286
ord7213
ord11410
ord13393
ord4555
ord2116
ord11106
ord11107
ord12927
ord6806
ord12925
ord8182
ord3535
ord3477
ord11489
ord6823
ord1709
ord13700
ord10609
ord12808
ord11099
ord6868
ord13109
ord13106
ord3288
ord5031
ord10859
ord10867
ord3934
ord7063
ord9145
ord10871
ord10840
ord11470
ord4458
ord4722
ord4892
ord8135
ord4700
ord4895
ord4461
ord4597
ord4445
ord6640
ord6641
ord6631
ord4595
ord7065
ord8977
ord8000
ord5871
ord5769
ord10961
ord2018
ord12936
ord10984
ord12955
ord11005
ord6910
ord11775
ord13111
ord12111
ord12952
ord10977
ord5010
ord2454
ord12974
ord10602
ord1244
ord856
ord990
ord1202
ord924
ord3479
ord1948
ord13108
ord13107
ord13110
ord1863
ord6865
ord11197
ord12357
ord1209
ord814
ord1266
ord876
ord6580
ord9095
ord1245
ord857
ord4340
ord1461
ord3697
ord266
ord265
ord2024
ord2028
ord1415
ord2524
ord2530
ord7190
ord2538
ord305
ord5035
ord6745
ord2037
ord319
ord955
ord409
ord13745
ord13741
ord11774
ord1272
ord2441
ord4743
ord4050
ord4034
ord957
ord411
ord2022
ord1291
ord300
ord4124
ord316
ord12355
ord2586
ord2725
ord2110
ord2590
ord4162
ord262
ord4341
ord2049
ord1294
ord310
ord889
ord1274
msvcr100
__CxxFrameHandler3
memset
ceil
memcpy
_CxxThrowException
exit
_setmbcp
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
memcmp
_cexit
_ismbblead
_exit
strcpy_s
memmove
_mktime64
_localtime64_s
strncpy
memcpy_s
_time64
_mkdir
atoi
atol
__RTtypeid
ldiv
_purecall
__C_specific_handler
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_XcptFilter
kernel32
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
HeapAlloc
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
Sleep
DecodePointer
EncodePointer
WaitForSingleObject
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
FileTimeToSystemTime
GetFileTime
GetModuleFileNameA
MoveFileA
GetWindowsDirectoryA
GetDiskFreeSpaceA
GlobalMemoryStatus
MapViewOfFile
OpenFileMappingA
CloseHandle
UnmapViewOfFile
FlushViewOfFile
SetUnhandledExceptionFilter
SetErrorMode
GetLocalTime
OutputDebugStringA
user32
GetSystemMetrics
IsIconic
DrawIcon
SendMessageA
AppendMenuA
GetSystemMenu
LoadIconW
EnableWindow
GetClientRect
KillTimer
SetTimer
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
oleaut32
VariantTimeToSystemTime
SystemTimeToVariantTime
commem8_64
?FreeBlock@CBuddyPagePool@@QEAAHPEAX@Z
?BeginWrite@CWRLock@@QEAAKXZ
?EndWrite@CWRLock@@QEAAXXZ
?Add@CMyLog@@QEAAXV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?BuddyAlloc@@YAPEAXKPEAVCBuddyPagePool@@@Z
??1CMyClientSocket@@UEAA@XZ
?DeleteDataPtr@CMyServerSocket@@MEAAXPEAVCSockData@@@Z
?DeleteDataAll@CMyServerSocket@@MEAAXXZ
?GetGoodsBuf@CMyServerSocket@@UEAAPEAVCBuffer@@XZ
?GetCompress@CMyServerSocket@@UEAAHAEAPEAVCBuffer@@AEAPEAVCCompress@@@Z
?GetCompress@CMyServerSocket@@UEAAPEAVCBuffer@@XZ
?DecodeDataPack@CMyServerSocket@@UEAAHAEAVCDataHead@@AEAVCBuffer@@@Z
?IsIdle@CMyServerSocket@@UEAAHXZ
?DoSend@CMyServerSocket@@UEAAXPEAUCSockThreadData@@@Z
?DoClose@CMyServerSocket@@UEAAXXZ
?Initialize@CMyServerSocket@@UEAAXXZ
?GetGoodsBuf@CMyClientSocket@@UEAAPEAVCBuffer@@XZ
?GetCompress@CMyClientSocket@@UEAAHAEAPEAVCBuffer@@AEAPEAVCCompress@@@Z
?GetCompress@CMyClientSocket@@UEAAPEAVCBuffer@@XZ
?DecodeDataPack@CMyClientSocket@@UEAAHAEAVCDataHead@@AEAVCBuffer@@@Z
?EncodeDataPack@CMyClientSocket@@UEAAHPEAVCSockData@@AEAVCBuffer@@@Z
?AfterConnect@CMyServerSocket@@UEAAXXZ
??1CMyServerSocket@@UEAA@XZ
??0CMyServerSocket@@QEAA@XZ
??0CMyClientSocket@@QEAA@XZ
?GetGoodsBuf@CGoodsSockData@@IEAAPEAVCBuffer@@XZ
?AllocBuffer@CSockData@@IEAAPEAXK@Z
??0CGoodsSockData@@QEAA@XZ
?SetGoodsBuf@CGoodsSockData@@UEAAXPEAVCBuffer@@@Z
??1CGoodsSockData@@UEAA@XZ
?Send2GoodsBuf@CGoodsSockData@@MEAAHXZ
?Recv2GoodsBuf@CGoodsSockData@@MEAAHXZ
?Send@CSockData@@UEAAXAEAVCBuffer@@@Z
?Rollback@CBuffer@@QEAAII@Z
?DeleteEnd@CBuffer@@QEAAII@Z
?Delete@CBuffer@@QEAAII@Z
??0CCompressSockData@@QEAA@XZ
?SetCompress@CCompressSockData@@UEAAXPEAVCBuffer@@PEAVCCompress@@@Z
?GetCompress@CCompressSockData@@IEAAPEAVCBuffer@@XZ
??1CCompressSockData@@UEAA@XZ
?CompressAck2Buf@CCompressSockData@@MEAAXAEAVCBuffer@@@Z
?Compress2Buf@CCompressSockData@@MEAAXAEAVCBuffer@@G@Z
?RecvCompressData2@CCompressSockData@@UEAAHAEAVCBuffer@@@Z
?TryBeginRead@CWRLock@@QEAAKXZ
?RecvCompressData@CCompressSockData@@UEAAHAEAVCBuffer@@@Z
?SendCompressData@CCompressSockData@@UEAAHAEAVCBuffer@@@Z
?GetNewUnit@CMixedObjectPool@@QEAAPEAXXZ
?GetPoolByObjSize@CCommonObjectPool@@AEAAPEAVCMixedObjectPool@@H@Z
?ReleaseUnit@CMixedObjectPool@@QEAAHPEAX@Z
??1CBitStream@@UEAA@XZ
??0CBitStream@@QEAA@PEAVCBuffer@@H@Z
?Initialize@CCommonObjectPool@@QEAAXPEAXHHH@Z
??1CCompress@@UEAA@XZ
??0CCompress@@QEAA@XZ
??1CCommonObjectPool@@UEAA@XZ
??0CCommonObjectPool@@QEAA@XZ
??0CDataHead@@QEAA@XZ
?GetCompress@CMySocket@@UEAAHAEAPEAVCBuffer@@AEAPEAVCCompress@@@Z
?GetCompress@CMySocket@@UEAAPEAVCBuffer@@XZ
?GetGoodsBuf@CMySocket@@UEAAPEAVCBuffer@@XZ
?GetSysSecond@CMySocket@@MEAAKXZ
?SetSocket@CSockData@@UEAAXPEAVCMySocket@@@Z
?SetBuddyPool@CSockData@@UEAAXPEAVCBuddyPagePool@@@Z
?SetCompress@CSockData@@UEAAXPEAVCBuffer@@PEAVCCompress@@@Z
?SetGoodsBuf@CSockData@@UEAAXPEAVCBuffer@@@Z
?SendHeadOld@CSockData@@MEAAXAEAVCBuffer@@G@Z
?ThrowError@CSockData@@UEAAXXZ
?DeleteDataPtr@CMySocket@@MEAAXPEAVCSockData@@@Z
?DeleteDataAll@CMySocket@@MEAAXXZ
?SocketStat@CMySocket@@UEAAXXZ
?DecodeDataPack@CMySocket@@UEAAHAEAVCDataHead@@AEAVCBuffer@@@Z
?EncodeDataPack@CMySocket@@UEAAHPEAVCSockData@@AEAVCBuffer@@@Z
?IsIdle@CMySocket@@UEAAHXZ
?DeleteData@CMySocket@@UEAAXK@Z
?InsertData@CMySocket@@UEAAXPEAVCSockData@@@Z
?GetDataNum@CMySocket@@UEAAGXZ
?CheckData@CMySocket@@UEAAXXZ
?MakeSend@CMySocket@@UEAAHAEAVCBuffer@@@Z
?DoSend@CMySocket@@UEAAXPEAUCSockThreadData@@@Z
?DoRecv@CMySocket@@UEAAXPEAUCSockThreadData@@@Z
?DoClose@CMySocket@@UEAAXXZ
?GetSendBufferSize@CMySocket@@UEAAKXZ
?DoMessage@CMyClientThread@@UEAAHXZ
?DoThreadProc@CMyClientThread@@UEAAHXZ
?ClearBuffer@CBuffer@@QEAAXXZ
?SendHead@CSockData@@MEAAXAEAVCBuffer@@G@Z
?Add@CBuffer@@QEAAII@Z
?Recv@CSockData@@UEAAXAEAVCDataHead@@AEAVCBuffer@@@Z
?AddData@CMySocket@@UEAAXPEAVCSockData@@@Z
?AfterConnect@CMySocket@@UEAAXXZ
?BeforeClose@CMySocket@@UEAAXXZ
?Initialize@CMySocket@@UEAAXXZ
??1CMySocket@@UEAA@XZ
??0CMySocket@@QEAA@XZ
??0CMyClientThread@@QEAA@XZ
??1CSockData@@UEAA@XZ
??0CSockData@@QEAA@XZ
?DeleteSocketPool@CMyServerThread@@UEAAXXZ
?DoIdle@CMyServerThread@@UEAAXXZ
?DoMessage@CMyServerThread@@UEAAHXZ
?DeleteIdleSocket@CMyServerThread@@UEAAXXZ
?Select@CMyServerThread@@UEAAXXZ
?GetSocketNum@CMyServerThread@@UEAAGXZ
?DoThreadProc@CMyServerThread@@UEAAHXZ
??1CMyServerThread@@UEAA@XZ
??0CMyServerThread@@QEAA@XZ
?ActivateSocket@CMyServerThread@@UEAAHH@Z
?CreateSocketPool@CMyServerThread@@UEAAXPEAVCMyIOCPServer@@GK@Z
?DeleteThreads@CListenPort@@UEAAXXZ
?AfterRun@CMyThread@@UEAAXXZ
?BeforeRun@CMyThread@@UEAAXXZ
?SetEnd@CMyThread@@UEAAXXZ
?s_dwMaxBytesSendOnce@CMyServerSocket@@2KA
?s_wThreadWait@CMyServerThread@@2GA
?s_bGoodTime@CMyThread@@2HA
?s_dwSocketStatTick@CMySocket@@2KA
?m_bAutoFreeChunk@CBuddyPagePool@@2HA
??0CWRLock@@QEAA@XZ
?FileRead@CBuffer@@QEAAXAEBV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?EndRead@CWRGuard@@QEAAXXZ
?BeginRead@CWRGuard@@QEAAKK@Z
??0CListenPort@@QEAA@XZ
?GetBuffer@CBuffer@@QEAAPEAEI@Z
?GetBufferLen@CBuffer@@QEAAIXZ
?SetBuffer@CBuffer@@QEAAXPEAEI@Z
?End@CMyThread@@UEAAXXZ
?Start@CMyThread@@UEAAXH@Z
?Close@CMyLog@@QEAAXXZ
?s_pLog@CMySocket@@2PEAVCMyLog@@EA
?Open@CMyLog@@QEAAXXZ
?g_TermFunc@@YAJPEAU_EXCEPTION_POINTERS@@@Z
??1CBuddyPagePool@@UEAA@XZ
??0CBuddyPagePool@@QEAA@XZ
?EndWrite@CWRGuard@@QEAAXXZ
?BeginWrite@CWRGuard@@QEAAKK@Z
??1CMyClientThread@@UEAA@XZ
?Initialize@CBuddyPagePool@@QEAAHHHH_J@Z
?s_wDefaultPriority@CSockData@@2GA
??1CMyIOCPServer@@UEAA@XZ
??0CMyIOCPServer@@QEAA@XZ
??1CMyLog@@UEAA@XZ
??0CMyLog@@QEAA@XZ
??1CWRGuard@@UEAA@XZ
??0CWRGuard@@QEAA@XZ
??1CMyThread@@UEAA@XZ
??0CMyThread@@QEAA@XZ
?s_dwSysSecond@CMySocket@@2KA
?Initialize@CBuffer@@QEAAXI_NIPEAVCBuddyPagePool@@@Z
??1CBuffer@@UEAA@XZ
??0CBuffer@@QEAA@XZ
?SkipData@CBuffer@@QEAAIH@Z
?WriteXInt@CBuffer@@QEAAXVXInt32@@@Z
?ReadXInt@CBuffer@@QEAA?AVXInt32@@XZ
?WriteLong@CBuffer@@QEAAX_J@Z
?ReadLong@CBuffer@@QEAA_JXZ
?WriteShort@CBuffer@@QEAAXF@Z
?ReadShort@CBuffer@@QEAAFXZ
?WriteInt@CBuffer@@QEAAXH@Z
?ReadInt@CBuffer@@QEAAHXZ
?ReadChar@CBuffer@@QEAADXZ
?WriteChar@CBuffer@@QEAAXD@Z
?SetRawData@XInt32@@QEAAXH@Z
??YXInt32@@QEAA?AV0@_J@Z
?DecodeXInt32@CBitStream@@QEAAEAEAVXInt32@@PEAUCBitCode@@HPEAV2@H@Z
??0XInt32@@QEAA@_J@Z
?EncodeXInt32@CBitStream@@QEAAEVXInt32@@PEAUCBitCode@@HPEAV2@H@Z
??8XInt32@@QEAAHV0@@Z
?WriteBOOL@CBitStream@@QEAAEH@Z
?DecodeData@CBitStream@@QEAAEAEAKPEAUCBitCode@@HPEAKH@Z
?ReadDWORD@CBitStream@@QEAAKHH@Z
?EncodeData@CBitStream@@QEAAEKPEAUCBitCode@@HPEAKH@Z
?WriteDWORD@CBitStream@@QEAAEKH@Z
??4XInt32@@QEAA?AV0@_J@Z
?GetRawData@XInt32@@QEAAHXZ
?GetValue@XInt32@@QEAA_JXZ
?g_WaitForSingleObject@@YAKPEAXK@Z
?EndRead@CWRLock@@QEAAXXZ
?BeginRead@CWRLock@@QEAAKXZ
?TryBeginWrite@CWRLock@@QEAAKXZ
??4XInt32@@QEAA?AV0@V0@@Z
?AllocBlock@CBuddyPagePool@@QEAAPEAXH@Z
??BXInt32@@QEAA_JXZ
?WriteString@CBuffer@@QEAAIV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?ReadString@CBuffer@@QEAAIAEAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?Read@CBuffer@@QEAAIPEAXI@Z
?Write@CBuffer@@QEAAIPEBXI@Z
??0XInt32@@QEAA@XZ
??1CWRLock@@QEAA@XZ
?FileWrite@CBuffer@@QEAAXAEBV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
winmm
timeBeginPeriod
timeGetTime
timeEndPeriod
ws2_32
WSACleanup
inet_addr
WSAStartup
Sections
.text Size: 541KB - Virtual size: 540KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 188KB - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 39KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 218KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ