G:\L2Walker\L2Walker\L2WalkerII\LineageII\Release\L2Walker.pdb
Static task
static1
Behavioral task
behavioral1
Sample
L2Walker.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
L2Walker.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
L2Walker.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
L2Walker.exe
Resource
win10v2004-20240709-en
General
-
Target
65b06ce76f55dd751448e483a00949a6_JaffaCakes118
-
Size
2.5MB
-
MD5
65b06ce76f55dd751448e483a00949a6
-
SHA1
a17f3874d73c16c9a5b35b93533e685e256d1677
-
SHA256
2c5146f97797e31140845f0aaf91007a3c6f3b3ca5664976eccedeea1e7afb81
-
SHA512
f22914ebd8acaace240680c11fad3089a69108c3b6f5862c53b7a0a03db55d399abf976bff5c702b4795fefc648a2d356e75d62cddefdb2cb5a2043341f6d193
-
SSDEEP
49152:qFYQjkURxQyeeeulxbu0bjHAwLbDAealHApDlDwJhA8KJPQWp5OEknIJgAUK:aj9eeeuf/jwzhEZcfAnQ+O3IJgAUK
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/L2Walker.dll unpack001/L2Walker.exe
Files
-
65b06ce76f55dd751448e483a00949a6_JaffaCakes118.zip
-
L2InfoB.dat
-
L2Walker.dll.dll windows:4 windows x86 arch:x86
40c4d0e08db7a16e7e2c15173b3822cb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetTimeZoneInformation
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
SetUnhandledExceptionFilter
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
IsBadCodePtr
GetDriveTypeA
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
LockResource
GetDateFormatA
GetTimeFormatA
UnhandledExceptionFilter
IsBadWritePtr
HeapCreate
HeapDestroy
GetSystemInfo
VirtualAlloc
HeapSize
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
HeapReAlloc
CreateThread
ExitThread
HeapFree
HeapAlloc
GetFileTime
GetFileAttributesW
FindResourceExW
GetThreadContext
SetThreadContext
VirtualProtectEx
WriteProcessMemory
IsProcessorFeaturePresent
LoadResource
FindResourceW
SetErrorMode
GetModuleHandleW
GetProcAddress
Sleep
WaitForSingleObject
TerminateThread
VirtualProtect
FlushInstructionCache
GetCurrentProcess
IsBadReadPtr
VirtualQuery
GetVersionExW
lstrlenW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
WideCharToMultiByte
GetCurrentThreadId
LoadLibraryW
GetModuleHandleA
FreeLibrary
VirtualFree
GetModuleFileNameW
ExitProcess
GetVersion
TerminateProcess
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
CloseHandle
RaiseException
MultiByteToWideChar
CreateDirectoryW
FindFirstFileW
GetCurrentDirectoryW
WritePrivateProfileStringW
InterlockedIncrement
GlobalFlags
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
lstrcmpiW
FindNextFileW
FindClose
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
LocalAlloc
SuspendThread
InterlockedDecrement
lstrcpyW
FormatMessageW
LocalFree
MulDiv
SetLastError
lstrcpynW
FreeResource
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
lstrlenA
lstrcatW
lstrcmpW
GetVersionExA
GetPrivateProfileStringW
OpenFileMappingW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
ReleaseMutex
GetLastError
CreateMutexW
GetCurrentProcessId
CreateFileW
ReadFile
SetEvent
ResumeThread
UnmapViewOfFile
CreateProcessW
MapViewOfFile
CreateFileMappingW
LoadLibraryA
SizeofResource
user32
SetRectEmpty
GetTabbedTextExtentW
SetRect
IsClipboardFormatAvailable
DestroyIcon
LoadCursorW
GetSysColorBrush
CharUpperW
SetCursor
SetTimer
KillTimer
PostQuitMessage
GetMessageW
TranslateMessage
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetMenuState
GetMenuStringW
DestroyMenu
InflateRect
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
TabbedTextOutW
MoveWindow
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
GetDesktopWindow
GetActiveWindow
IsWindowEnabled
GetNextDlgTabItem
EndDialog
RegisterWindowMessageW
WinHelpW
GetCapture
CreateWindowExW
GetClassInfoExW
GetClassLongW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageW
SendDlgItemMessageA
GetClientRect
GetDC
ReleaseDC
GetSystemMetrics
GetWindowRect
SendMessageW
GetParent
CreatePopupMenu
AppendMenuW
ReleaseCapture
EnableWindow
LoadMenuW
GetSubMenu
GetCursorPos
IsChild
GetWindowTextLengthW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
IsRectEmpty
WindowFromPoint
TrackPopupMenu
GetKeyState
GetScrollPos
ShowScrollBar
UpdateWindow
GetMenu
AdjustWindowRectEx
EqualRect
SetCapture
SetParent
CreateDialogIndirectParamW
PostMessageW
CallNextHookEx
GetClassNameW
SetWindowsHookExW
wsprintfW
MessageBoxW
UnhookWindowsHookEx
PostThreadMessageW
SetActiveWindow
SetFocus
SystemParametersInfoW
LoadIconW
MapDialogRect
SetWindowRgn
DeferWindowPos
GetScrollInfo
SetScrollInfo
GetClassInfoW
RegisterClassW
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowPos
OffsetRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
FillRect
EnableMenuItem
GetMenuItemID
ModifyMenuW
GetMenuItemCount
EnumChildWindows
SetWindowTextW
GetWindowTextW
GetFocus
CheckMenuItem
RemoveMenu
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
DrawFocusRect
DrawTextW
DrawFrameControl
CopyRect
GetComboBoxInfo
PtInRect
UnregisterClassW
FrameRect
DrawStateW
RegisterClipboardFormatW
GetIconInfo
CreateIconIndirect
CopyIcon
DestroyCursor
GetCursor
LoadImageW
EnableScrollBar
RedrawWindow
GetWindowLongW
SetWindowLongW
SetLayeredWindowAttributes
GetSysColor
SetMenuDefaultItem
SetForegroundWindow
IsWindowVisible
ShowWindow
ShowCursor
GetAsyncKeyState
IsWindow
InvalidateRect
ScreenToClient
IntersectRect
gdi32
SelectClipRgn
GetPixel
PtVisible
RectVisible
TextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateBitmap
GetStockObject
GetDeviceCaps
CreatePen
CreateSolidBrush
CreateRectRgnIndirect
CombineRgn
GetMapMode
DPtoLP
StretchDIBits
GetBkColor
SetTextAlign
MoveToEx
LineTo
ExcludeClipRect
SetMapMode
SetStretchBltMode
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetObjectW
GetClipBox
GetTextMetricsW
GetTextExtentPoint32W
GetRgnBox
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
PatBlt
BitBlt
StretchBlt
Polygon
Rectangle
SetPixel
GetTextColor
EnumFontFamiliesExW
GetTextCharsetInfo
CreateDIBSection
GetDIBits
SetDIBits
SetPixelV
FillRgn
CreatePolygonRgn
FrameRgn
DeleteObject
Ellipse
PtInRegion
SetBkColor
SetTextColor
ExtTextOutW
msimg32
GradientFill
comdlg32
GetFileTitleW
ChooseFontW
GetOpenFileNameW
GetSaveFileNameW
winspool.drv
OpenPrinterW
DocumentPropertiesW
ClosePrinter
advapi32
RegCloseKey
RegOpenKeyW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegEnumKeyW
RegQueryValueW
RegOpenKeyA
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
shell32
Shell_NotifyIconW
comctl32
ord17
ImageList_Destroy
ImageList_Create
ImageList_Draw
_TrackMouseEvent
ImageList_Add
ImageList_GetIcon
PropertySheetW
CreatePropertySheetPageW
DestroyPropertySheetPage
shlwapi
PathFindFileNameW
PathStripToRootW
PathFindExtensionW
PathIsUNCW
ole32
CoDisconnectObject
oleaut32
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
SysFreeString
SysStringLen
VariantCopy
SysAllocString
LoadTypeLi
ws2_32
socket
connect
select
WSAGetLastError
WSACleanup
inet_addr
closesocket
recv
send
htons
WSAStartup
gethostbyname
winmm
sndPlaySoundW
timeGetTime
Sections
.text Size: 912KB - Virtual size: 910KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 236KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shd Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 148KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 120KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
L2Walker.exe.exe windows:4 windows x86 arch:x86
51aeecb8b79de37eb853ee8d9e7cd9e6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
G:\Programs\L2Walker\L2WalkerII\LineageIIExe\Release\LineageIIExe.pdb
Imports
kernel32
GetSystemInfo
VirtualQuery
HeapSize
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
IsBadWritePtr
SetUnhandledExceptionFilter
VirtualAlloc
GetOEMCP
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
IsBadReadPtr
IsBadCodePtr
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
VirtualProtect
HeapReAlloc
HeapAlloc
HeapFree
TerminateProcess
RtlUnwind
ExitProcess
GetSystemTimeAsFileTime
GetStartupInfoW
GetFileTime
GetFileAttributesW
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
GlobalReAlloc
LeaveCriticalSection
LocalAlloc
GlobalFlags
InterlockedIncrement
GetCurrentDirectoryW
GetFullPathNameW
GetVolumeInformationW
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
lstrcmpiW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GlobalGetAtomNameW
FormatMessageW
LocalFree
FindFirstFileW
GetLastError
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileW
FindClose
GlobalFindAtomW
lstrlenA
lstrcatW
GetVersionExA
MulDiv
SetLastError
lstrcpynW
InterlockedDecrement
GlobalAddAtomW
GlobalUnlock
GlobalFree
FreeResource
lstrlenW
GetCurrentThread
GetCurrentThreadId
GlobalLock
lstrcmpW
GlobalAlloc
FreeLibrary
GlobalDeleteAtom
WideCharToMultiByte
GetModuleHandleW
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
lstrcpyW
GetLocaleInfoW
LoadLibraryW
MultiByteToWideChar
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
LoadLibraryA
VirtualFree
ResumeThread
SetThreadContext
WriteProcessMemory
GetCurrentProcess
DuplicateHandle
VirtualAllocEx
GetProcAddress
GetModuleHandleA
ReadProcessMemory
GetThreadContext
CreateProcessW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
CloseHandle
CreateFileW
FindResourceW
LoadResource
LockResource
SizeofResource
GetTimeZoneInformation
GetModuleFileNameW
user32
CharUpperW
DeleteMenu
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
BringWindowToTop
SetMenu
TranslateAcceleratorW
WinHelpW
CreateWindowExW
GetClassInfoExW
GetClassLongW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageA
GetForegroundWindow
GetLastActivePopup
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
MessageBoxW
GetMenu
AdjustWindowRectEx
GetClassInfoW
RegisterClassW
UnregisterClassW
DefWindowProcW
CallWindowProcW
IntersectRect
SystemParametersInfoA
GetWindowPlacement
BeginPaint
GetWindowDC
FillRect
SetWindowPos
ShowWindow
MoveWindow
SetWindowLongW
GetDlgCtrlID
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SendDlgItemMessageW
CheckDlgButton
GetMenuStringW
WindowFromPoint
GetMenuItemInfoW
wsprintfW
GetWindowTextLengthW
GetWindow
SetFocus
UnhookWindowsHookEx
ShowOwnedPopups
SetCursor
SetWindowsHookExW
CallNextHookEx
TranslateMessage
IsWindowVisible
ValidateRect
SetMenuItemBitmaps
GetFocus
GetMenuState
EnableMenuItem
GetMenuCheckMarkDimensions
LoadIconW
GetSystemMenu
AppendMenuW
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
SendMessageW
GetWindowRect
CreatePopupMenu
CheckMenuItem
EnableWindow
LoadBitmapW
GetSysColor
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
PostQuitMessage
ModifyMenuW
GetMenuItemCount
SetWindowTextW
GetWindowTextW
SetActiveWindow
GetSysColorBrush
SetRect
RedrawWindow
DrawAnimatedRects
EnumChildWindows
FindWindowW
GetClassNameW
GetMenuItemID
TrackPopupMenu
SetForegroundWindow
SetMenuDefaultItem
DestroyIcon
LoadImageW
RegisterWindowMessageW
ReleaseDC
LockWindowUpdate
DestroyMenu
GetDCEx
DrawFocusRect
DrawStateW
RegisterClipboardFormatW
GetIconInfo
CopyIcon
CreateIconIndirect
DestroyCursor
OffsetRect
GetCapture
SetCapture
SetTimer
PtInRect
InvalidateRect
PeekMessageW
GetMessageW
GetDC
GetSubMenu
LoadMenuW
ClientToScreen
EndDeferWindowPos
BeginDeferWindowPos
DeferWindowPos
EqualRect
PostMessageW
GetKeyState
SetParent
GetParent
IsChild
IsWindow
UpdateWindow
SetRectEmpty
CopyRect
InflateRect
SystemParametersInfoW
IsRectEmpty
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
LoadCursorW
DestroyWindow
ScreenToClient
GetCursorPos
KillTimer
ReleaseCapture
DispatchMessageW
EndPaint
gdi32
GetDeviceCaps
SetRectRgn
CombineRgn
GetBkColor
GetStockObject
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
DeleteObject
SetViewportOrgEx
GetPixel
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
GetObjectW
CreateBitmap
PatBlt
CreateRectRgnIndirect
GetTextMetricsW
GetTextExtentPoint32W
CreatePen
CreateFontIndirectW
GetMapMode
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
Polygon
CreateSolidBrush
SelectObject
CreateCompatibleBitmap
GetTextColor
EnumFontFamiliesExW
GetTextCharsetInfo
SetPixel
CreateDIBSection
GetDIBits
SetDIBits
CreatePolygonRgn
GetRgnBox
CreateRectRgn
CreateCompatibleDC
BitBlt
SelectClipRgn
comdlg32
GetSaveFileNameW
GetFileTitleW
GetOpenFileNameW
winspool.drv
OpenPrinterW
DocumentPropertiesW
ClosePrinter
advapi32
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegQueryValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
shell32
SHAppBarMessage
DragFinish
DragQueryFileW
Shell_NotifyIconW
comctl32
_TrackMouseEvent
ImageList_Draw
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_Destroy
ImageList_Create
ImageList_LoadImageW
ImageList_Add
ord17
shlwapi
PathFindFileNameW
PathStripToRootW
PathFindExtensionW
PathIsUNCW
ole32
CoDisconnectObject
oleaut32
SysFreeString
SysStringLen
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
VariantCopy
SysAllocString
LoadTypeLi
ws2_32
htons
WSAStartup
WSACleanup
closesocket
socket
inet_addr
gethostbyname
WSAGetLastError
send
setsockopt
recv
connect
Sections
.text Size: 296KB - Virtual size: 295KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 76KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 444KB - Virtual size: 441KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vdata0 Size: 84KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
L2Walker.exe.manifest.xml
-
SCRIPT/QY-参拜者之庙.SEC
-
SCRIPT/QY-异教徒之墓.SEC
-
SCRIPT/QY-殉教者之庙.SEC
-
SCRIPT/QY-灾星之墓.SEC
-
SCRIPT/QY-烈士之庙.SEC
-
SCRIPT/QY-烙印之墓.SEC
-
SCRIPT/QY-神秘之墓.SEC
-
SCRIPT/QY-祭物之庙.SEC
-
SCRIPT/QY-苦行者之庙.SEC
-
SCRIPT/QY-邪道之墓.SEC
-
SCRIPT/QY-魔道之墓.SEC
-
SCRIPT/人类战士或法师打兽人和狼人的脚本.SEC
-
SCRIPT/兽人战士或法师打狼和盗墓哥布林的脚本.SEC
-
SCRIPT/圣者之庙.SEC
-
SCRIPT/巡礼者之庙.SEC
-
SCRIPT/白精蘑菇任务.SEC
-
SCRIPT/矮人练级.SEC
-
SCRIPT/邪教徒之墓.SEC
-
Set.Ini
-
行者脚本指令说明.txt