Static task
static1
Behavioral task
behavioral1
Sample
l2chat.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
l2chat.exe
Resource
win10v2004-20231215-en
General
-
Target
1e381df1c3940bf62c2dd7dd5533a4ba
-
Size
618KB
-
MD5
1e381df1c3940bf62c2dd7dd5533a4ba
-
SHA1
85df8feeba25cd345322e45dfc48c3d320a98206
-
SHA256
bc57a9280ad633fdb3d0540c2ef4c697b89ccdb3e437386d5b95aea1772b9c6a
-
SHA512
69a2b7c5c354d5f5462d0aadd24b9e3f1d4099b37e6fe0316a6d82840bc290bb100b7ff127b1c9f054539d757a7f6c752b3b244b51a28b4da984e1b2a8cebe82
-
SSDEEP
12288:Rkgdt2LJIoCCiSXzMzMM3Js8u7DdlrkMmvNJPMzCmVIVoi2LRpLnhCZs:R1wJIFCNX45S8u76j4eoiepbhCZs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/l2chat.exe
Files
-
1e381df1c3940bf62c2dd7dd5533a4ba.zip
-
l2chat.exe.exe windows:4 windows x86 arch:x86
3dd9c8c2d02632ba9a6636a108b21910
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
GetKeyboardType
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SysFreeString
version
VerQueryValueA
gdi32
UnrealizeObject
ole32
CoUninitialize
comctl32
ImageList_SetIconSize
winspool.drv
OpenPrinterA
shell32
Shell_NotifyIconA
comdlg32
GetSaveFileNameA
winmm
sndPlaySoundA
wsock32
__WSAFDIsSet
Sections
CODE Size: - Virtual size: 760KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 614KB - Virtual size: 613KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE