<ŧr<=Q�A%���JH�����5���i�#ʑ�%6��Q���؎��K��H��+KU����M�L�YG���Mwk=��j6�Rd)��"PT�&|��z��<�[�7�f�[�[� �F1�G��-H�Į��*9�L�:e��|�.�-��h 1~hA�����n_����X��U�7��� �w�r-:ɴ����,� ���5��g�9]�e[���P�h�.��hW�z�^\�9��T��E�f�����"Of1����<�-��7klRc�0ĻY�y��a�9�B*Ţ�bH��KE}��:q�5�x%��^T����COܿ�"d�T0���/�)?R�d���7~�4V��������<�����)�����9�oV����%V�Lpp�G�\@ǴF������)_��*Fp�D���3N[�����^���8��r<��{+ dc�ubℎP��RQH��������.hj��"1\~l�E֏��Z��ޟb�<�b���jo�=�����a88o�m�F��:5�P,U�X`.���?H�2�%��J���m\�� ���s�W<�f��+dh��u/r�]k4ԵX���N�<M�H ���O"D� .:g�9��V�`�oV0�Kр}.�ӑ��nf�T����\��,�� �x���ퟻ�"��Z������f���u/�cX��p]$#��p� �M����i�~��;$s-pόN�]�JU��7j%�� x���#�����C��)��U��:��Y�\%���G9eާWc��uU����Odvp��K{�rA������)>��or���_�Yr��,u��G ;� yH���0::������d�'5c�Z�A C�J���$�]:��K9����!˭r�3���i�K=&�F�T���ٶq�[M_Ձў�i�ǒDj.�a!���"��'y�}G��[�~<�S�(k�]��>�������C�M �ж��w5�6ܒN::S���$��t�B�r�����h��T�-�%�� �T�dV� �$���G��khoC��"��ƙG����U#���=�k�u��Z�d�l�����0-����F�k������~1��',�m/���LͲ+��?u�t���'��=���Y�|��:ρQ��F9���kC/a�"�����R�5U��G�,������}��=��Y��ԇ�.V&s�.lEyyݚ�W�L���e�f����Yw���9d��d�j̭��=)�Xe�Ǖ�NK%7���õ�4 ����\5��QAM�ql�(��GW� �^i�~�5��8��B@E��o����� z�dVvqpӳ<���=�KF1W�gf��M5�+�Sb����Gi����O��M+xRr�m��uCR艷��/d1$�Us��v3ⵜr����Sz�=��jO�����r������3��/�J간���P&Y�S���Edo�H%FL�� �A6o�&����m����<n��/_p�1�Y�T���J)��� �����1�g������c :G�utP�h4�q�Ϊ�>�fxѦ.�Zt���p�H��j��Y��D�E��������N8��^(�9I��P+�.7Y���bki�ۍ M�#���X�!%�����}>��+Puwƌ�#^�]Hi�&�8D���,� ��t�>���e��� ��}J���c��L���p�����J���"�H�VM��Ĉ �na��1�(��3\�h|p\x%����a"(�i����2�97O�ZE�L���W������K��e��!�S��0�1�����ףs����P�j��DQ0E���*n�0I:k��)㵼��?4�ӭ�<�jr�g�0Kk��t�\�P�3*Y �Ӫ�~w����<h�(]�gSF@A���λv@�E�k ��Z`$��]��L F���T�f��ָ��ñ�u�R���i?��5�:7��ycFE�����pRo�|?��f��ُH���6/���j��c����L�&���h��`���bƕ�i"�ʱ�=��}.D;ΓR�jm�H�~�� �V�vZ�`��i���5#����4��w������n�My<�[$�Wܑ�2�ı/�fi7���%I�hs��]X��0��|�չ�Zl=��P���`9|���:�U�n��yQ���8��UAM�'7�/V��������'o�ѝ����G�M���������jy����<�SS�qhI����~Ko��n�����v=����m!��NW2�� ��7kl܇ϯ░ֆ̂�exJ��X,�����ӏ8�O�����$�Nܣw?1��~�kj9������ �fv&,�$N(��.�5��b'��/ޠ�l(KgB.�����O��O�4��!�lG�]�k���W�w���|�Sq胛'�����jƐm�Cz=��x��NW���B���싃��O����������+��E!M���S���l�����NMz�:�p3Sg4eý��� L@B��Bb�r���F;�wG�1T�g�X���"�&�������쾀io��B����k���D-jD���%$tpz�M�_�����!�<'7�x.��1��?�VP��^��&�/b7�ȱ՛V)�Ͷݪ�f椗�Q��C�;�7�|�� s�Ny�o��a��Ø��;���b�o���nn�ɼb���-k�u� �\���:l� �\�3�l��G�YB]L���XӪ�M�Tt_�����1��������&��ܲAFMMU��7�;�{]kVFK�5�����儿徔r����oL���y�U���:��e�m�d��0��$j)D|T���߾��ց�_�/l��R�S�҉���Z�/I6^v)_̕�{E%[]<���تD�����Ok��*J�|ծ+9/�}G�ۻ�Ǽ�Qe�iDA5��y� @$��rny5,�fw�mO)x��:or��keJ�m�׆�R���13ʉ_uTc?�i��������nJ��W[�?��I��Ú��UrN���]p����=d����D���K+F���$�<����o�d�.�}.��ݪ��$/����Tļh7im^�],�`M1H+qڍt��=�� bw -�ݵ���L%-9\Bj[���A�T�)�^�|o���.mK��#L$��
General
-
Target
trace da hood.exe
-
Size
9.8MB
-
MD5
99a9d95ddfa948fbfc5e47aff3fa9d0b
-
SHA1
3a7d245163408c92b499b88db43f7b566600bd8a
-
SHA256
b2dc02b60162f13cf5331b7bd933c8edafbdeb22fd8849ded39550740392e6f9
-
SHA512
4ca7935f68db44656d743550b4707882f38e31edbbeff1713f6930261c96eec984552f7f86a898d7a99ffa80974cd779973ccf4f8116c1751c286abb5f6bd9c3
-
SSDEEP
196608:DTkeBI1FYo6zHZiWIgNbStZaRfjJbaEa5EPSdVfNzT8x8ocao:DTkjP1OHKgNbvfVbxFP2fNM1o
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource trace da hood.exe
Files
-
trace da hood.exe.exe windows:6 windows x64 arch:x64
3c9e888affa43294e91766790a915e60
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateSolidBrush
advapi32
RegCreateKeyW
shell32
SHGetFolderPathW
msvcp140
_Query_perf_frequency
ntdll
RtlLookupFunctionEntry
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
acosf
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-runtime-l1-1-0
_set_app_type
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
_stricmp
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 595KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 9.8MB - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ