mϚ��m���{]�hK�W�j���'e�i��'+�P����Hڀ�3c�JJ;r���|Z��T�R!M��1�й����_��Z#���<{cU��|����є��9��RP����@��q4�<9� b���i��W�4�ѓިi��y�=��v�V� �܊o��h5&�E��d���b'�Uı?WLg�T���?��)ۛJ���Q@<ϕ9��uE�������/3h�|4����?�љ_MDhG���/�U�v(#����}wr���=-A0��&����-,`���~S�W�Ƃ6%?j���Ǧ���8j8��c��0` ��4���>׳S�#�B� ^O����R��`!h�5�Qk�K�m�@��4g�}�r�1k�;��=U`c[܅���Ӏ��Ҟ\��'�����x&J��(C���% .�V4ފ�Ԍ "����ѽH���^��BV�ǚs�xr룻��(�'wv�$O��L����ܜ��$*K����DP����QږP;��/�E,��Q�L�l�Ҽ�� �!@b�LKu�����������KT�i��ڄ�'�7]z�= ����̩��/q�k]�:�4l�ZqӢ��/l:���t��i#��^��N��=������J�P��f�izB[��P� �"�����t�[��]a���Z��v�j���;~�Y������tUϦ��2�����p�2�db���r��/-�$7$^}>9u��Ob�d����n6�k� ���KWw�f��뷽�vbh�,����!�H�o]��T�5��P�UK�cq�d3����=�-xɁ�釾� ��DH|O������;2Ul9�����d���v̇/�_����)P���,�W���<�8rg�����L>؆���+%a�C�e�Po��D���T���O���-�OuA����A�hA?�=]gA��$A��x��=]�R&��5u�����Ow豩A�;�� ���`�:�P D�袌چ�H��I�N���x_@�,]�F��]\����*���mB���T��v_�$Xze������P)y" ��D ��r��6����B�UKKtI2w�OҺf�|���ĐFK!�O"�Bi�:�*�����]d@ ����0R��;jq���JkO���^��ɩ�_!�J@�:���k�= p�,�`x"��X-4��� (����6_2�k��/�./����ĜvT��� B"w����p�h���Z�1�oU�Kˉ��ۜ� RL ˁ� <��S-���ΣK��e�*m��%�������������E��9x���%m$R����=�����F�����3Y���9��°��u���������0��e�����30��&�Y� �`���>Eܥ��!ƶ/��;�~��s�D�]�:@-���\^���=J�D�]����r���pxG�+6� ������t��d"�!~\�ei{��;R[F�Y-��6iQ�_�����ڡ�<`: �I��J/�9�PK=��<sr�Akg�6�!{�ܶ�H�|�fت���xh�lӌ���FḘ�Ҁ%���FA.�侓�ϡ��μ���&�;�wVk#@�\b�|�e�"ޙ7P�;C��#��m�b�@�?�z�n�������k+y=�$�"< ɠ�[���$_�҇ѱ ���zH�8.yl]p=S�R�A�$}3�Q)�`wY�O��*�zݦ�w#�\^����%TK!ê��~N�B W���� ����?8m��#�L�n����S�F ��a��0�NcN�Xz&�Ђ�;��\w������Z"��ATہ/ ���V��eɐ�;���3=�cycb������(���,F?1|`�vx��W�؆� #h������K�� �L����Gb �ї�JГC����IŲ``����!�)�u`XL�O��WW�>��-��P���E��{X&:_:�|?ﴄ5�5KJ�1w[�˄Y)���γ�g#�F^5��V6��)��H��|X�4zo2E~�p�\eh��Y�Z�H�'�p��W�~�m �Ĕ�M�8٨��z�4�IB��?*�������Q��&~�ZJ��1�aP�1FI��Y�K������ŭ�t�b�y4y?� ������wK/��ׯaVt�ja �>��v3@㢍�������9ȼ�px~�����9�@�1˯P)Y�9� /�wڊ�H�{�Qm����� }1��\�ˉk���b��P�B6^4�J��c7�p*[=�T���oR֒�@ ӗ�d��K��F ��^Z��2��ivcj��mN�k/��1���_�xr�<Z;��%�j��Ctn�ӻ'V��PQoN�����0��~`��#��4��-�H�>��x2M��d�8_���k�K�;|*�G�|�f?��&vb���b�12�j�� �ş��D�/7.Rn]_�d|�,��|Z֖���q�E{����Y�{G�g�^٨[�T�3��\�#��7Oҷ���ՠQ�=8�!'}�W�նEק�U��o�qzd&��_��'��"R��y BHDt��l��:���)����;w��^�J&���rܗe~e� L��M�~���+����d��O�!�Bf�r����*�I����֡��������EvYG���i��J7&��9�Ge�*��!�O�������D\*ށ������qZ�86 O�VZ��}Jm)lYՏ.1�D�l�����^����7=0G}��O~Z���דRϹf+�_ߔ�WC+�� ��cOvx�@_����ձ����&�f�r�(�"�Y*8���i��[.�k�yX�[�r�6���Q~R� h?5���xM ��U�rKZcS��҂����ܔ�?�͚"K�M8�ܧ2����5I�(������{ch���4Zŏ�#n���[{%K�N*��I��6�x-��#���3�P�k*O繓�p�"�Vb���+�!�c.��^$�� �1X#��N�O�C�Wg��V_��>�!K�#4|�"�~I-��q|�v��+�N�i��w���F���ڼH����O� k���%;�^M�i��V�.���O,ZE�L�zz�+�Y
Static task
static1
Behavioral task
behavioral1
Sample
event0_loader_protected.exe
Resource
win10v2004-20241007-en
General
-
Target
event0_loader_protected.exe
-
Size
6.5MB
-
MD5
bd8e6a8350640814fb91e77eac9010c7
-
SHA1
a5140566d22ee532a30509f523376a2c32c9a21f
-
SHA256
b8b5e051bb0256f6b52ffd2c0141e7809f3c94725fce3bae9fa198a008bbb170
-
SHA512
185d0c7034cf86e09e6ac1e8910e7a43b066419f62503ef4081a58e69d3579801a9c1a07081eca2f78014ccd08fbc36fecdfccc14d70efdd4501b643fec6f3c3
-
SSDEEP
196608:6k12o/b+ykPvZoYld7kXNBpgND7lyuCZpMvCs:5F/qyCpk3eRlyuws
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource event0_loader_protected.exe
Files
-
event0_loader_protected.exe.exe windows:6 windows x64 arch:x64
984410a728e4ef127e72ac4a5af0e46a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
ws2_32
WSAGetLastError
kernel32
CreateThread
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptCreateHash
imm32
ImmSetCandidateWindow
crypt32
CertGetNameStringW
wldap32
ord219
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 894KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ev0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ev1 Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ