}�qQ��Mế���=��B�S���u$3�v�G�"� �;U>L;��S+�n��\��c��=��Q�������M���d����_s����dѮz�|�c��bx������~f�@���D3����8��[��"��ZU%�>$S�KCI�2.��JgZ�ےhi�1�^v&7���s��-{_�����\Ċ�_�C̢R`���\hM���4�x�ǃ�@ą\������i�����o��W�@u�Ѣ��2��2e���4�U�gʹ�S�+;���?��&�>��xz���=#ĥ��?�2䒬T��� ~e~�Ы�����R��&E����毁�o�cd�m��\�[w�q�C�6Y��c�I=*��X�꼮x�q��W���m���|�H� k�t�+E�[�#w�i��{^^9��v������V�^������U�S������Hj�V�d�ʵmP�x���L�`����g� Hq���M��b����-����:�&|�bUG#��S�̿Ǧ��DxNF�VJ��!�A�{���'g8��\�7(D��"�<�j�x����4���W������F_�^�J���A�������*y9���n`��*HZ(V���O��/ �Ҩ�̿+��"�x�س>�=8]Y�4�ɚLE�u2�<��0$ �ؾ��RB��HT�?T�ZЛF�*�?�K1���Ue~ L���;����e#�͠�~���UBQ&�zA�j:Κ(��ю�q��λS����������FF`���h/Ĝ-��B1�ꪤ+�iQ-p��;"�i���ͩ>R�q�:k[���F����w�kd��Y���P3��C��Wݬ�9���ݧ�}��)��%_�@`��ѭ��5���T���ua�̰ �$�B���P�=�-B;��������=5Båc���"���(_䧭^'����2��>Q�Uz��d�A㜣��2�������� Xiԗ`5�k���F�I���@�,.�>2I�ī`��/b�"D'_�t�[���r���R%� 5a[��!\۾T{ ��� P�?s���@iN�&���t��\s����4�{udR��Q��%ψ��G�ƨ,(MfU�$������{��#նDfп<��;�c�d{2I���6�a`��O �-IZ�c�����i��r�HNX�y/��u�Y����DLëP/C}�ʣ[9F�J�V��뾓Q1��\=p�y3et�h�O��%��7����;& �6�]��@2�]��Oм�`�a +�t���K4b���6�����e��Tuw#YSk4ߏ�<n�_Xg{;�U)97�&����M�9QRn�%4�R/�-*5&$gDّ���ьi(���Q�7�ȄU��/��圷���#���\�����[�&�_�37�~|ț���9�f��M�7Bh8�Q`z�A�U��Ts��AN�@�v���D�óሯ�BhLȬ��p���^�$�@n�;8�֑���z�A�[S����!�.�N���i&��W� K�U����/P��0u7��v����T�oh����>8U@U9 ���5Trt���bR)?���ѡ�ㄠ �/���h-ٗ�ǍO��ֿ����Nf<F�A ���_�ُ ? B#�f��s1�ɉ@(�����.�5���>�Tƪ�":�`E¸}&�Pbq��*�e/u�ލ�\W�V�ZV^� R�~�m�j|?��]zfk�`Z��y[ �z�Y�Z���5�b��}��3��G6���ތ$]���Y�;�UP|�^R*���i����i�jH#������b#����,�)�3�a�!f ��| ���� ��T���g���'�<2���ʼn��G,�`Z�jD��=j9��>� ɺ�錙R&�HV uw��<��� .zȹ�[^yj���=xT�T?8�� �<�������mpFzy���2nlA��d�f�~���� U,%heܑ/J��a�Z �xE�I�2�@m���<Xl�<z��v�o��H�ܷ�k�"�`h�]�0�{�EL�k����[��1�A�� ��nQ� (�y���rȒ��C?q���M������=��4.[L ˧�o6-4%,��<��� ���YS{k5�Q�3" ��ZVP��>��q�aP�Ad�vE^ᓎ���+`��PsC �,A����om-a�X ��w�|���IK����8�����]��p���aL���ML��]��l�̐7��ط��=�X�+��U��pІ���͔2��8b8�s cfp�eh���xh�$C4��a����K�������'MTF9�Nx�u���F���_��Ǐ{9Ym�� �5�}�+�,�H�{��^��Y��!�զ�3t!I���xt=빡���\��C}�E#�a�*P��4Rm���%�nCU�C}"J��K�F�gB��ղ��\b�� F⁚�W,� � }����⋈�l�a�v���Y��d5���ߟ�i�cpܦmCl&giJԛ<�_>��*�0�ۀb��_�p�X�����H.^>ǐ�����qhj���Zt��U����@�<S�d��1ϔs^��eJAd�����Tвa�BNfk($���%s�b�Dʎ�u��~�-ќ���U�z��p��ol��+�^��kpZ(�����̶>�@Y�r_�w��G�jx ��֗�����^S���@����@عH{�r�-t��E�B�&`�«*��c��*L����S����ם�q��`N�4�:�e:I�@���ب�)M0��X5�ա�p0�d!8q`� �. ��yh�/+!�Z��7�m�)+�DZ�R�0ts�Ҿ!��Rwڕ�2�j�"��=�`W��z5���!\��g��Z"@�� �4⊹(^+յ�7�c:F�okw���\8������� �CEM�+�P�t��c�"�ī��٧���J�7��X�f!��KҺ����A�q`�U��VG^��x��X�L�B/��z����1��\φ��}�ܒ���'NgD�� "@�m�=.�/���䚩˙�_l�.a_?m��o����bI%���ra��}?~�����o��>oc��X(G��V�+�!vY?t�q2��>�SZ�FI}z�ud�{����q1�U�D ��
Behavioral task
behavioral1
Sample
hangarspoofer.zip
Resource
win10-20230220-en
General
-
Target
hangarspoofer.zip
-
Size
16.7MB
-
MD5
4565d8c095266d3594fb17ae36e6a5c0
-
SHA1
ae3014aca7b21d016941d1651f48b30826b1f675
-
SHA256
dcb318d8a2833847235a4c07d71820ab80b74d3e0bd9a619ba4c8be1ab5c3001
-
SHA512
c356f18362fb277ecdfc897f833a14665046749d59c3dce5b08f11302134a27119ac6eba01b8829e26b78e718712cbda981043b8e12f1ac4d7e8fac31ba1e92d
-
SSDEEP
393216:spOHcVTpL2BvjBkSw4u0F17z+XYTSVdjYGedl2q4Yy:WOhBaSwxqHiwtGwl23t
Malware Config
Signatures
-
resource yara_rule static1/unpack001/hangarspoof.ldr vmprotect
Files
-
hangarspoofer.zip.zip
-
hangarspoof.ldr.exe windows x64
02ea107286a5a6a5158636abf853e350
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
BlockInput
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
psapi
GetModuleInformation
ntdll
RtlAdjustPrivilege
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertFreeCertificateChain
ws2_32
connect
rpcrt4
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-string-l1-1-0
strpbrk
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 481KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 9.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 11.9MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
loader.exe.exe windows x64
f72f2c07ee79d9af4961f011a982dbd2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32First
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowPos
CharUpperBuffW
vcruntime140
memcpy
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
�qezw�!��`�zd�Kl�K�''/��/o�FT�.),Sp#_ �&��p��k1e-�p$&�Ǥr��F���C�+���ԙ|4W��}�o�j��mO��FC�\r�A��f3R���H��� ��(��.vi����=L��7�?�i��3|:�@sԑ��_��A��6����!3r�.��p��DF�/��(��$Ec�����p��Oh�\Z�u�7��9�����䀀�HG�������렦��Ma��9*�͵��}�+�:ђ�5t�ܦ2�P��*r!�'m�{���ç�Ӏ �/���yBp?0����c�� Å�Y5Sx�x- �,�i0�V�� 0Md&�N6�P)��8�����;¨��i~m��s�=dS�O �P�P�'����?��Nc�,�OO���{������ۤ�B��yD����$�~� ��w/�4$��9'�A<������imik��b��"��8 ��T�g!w�fM�W�!�M�����.��'�U��;�{h�΅�d��i\d��D��S�1h�P��i`�RW�env�O��� ��t�M���|Q���<��LLXQ��zr�Û��5��/�q\�#Xǃ>�{�+ijF��C3�k5n��ؾ��4.��+��L�p4B� �/�����g� {����c�^�蚺�J;؇�V*������_,���MSt�������!�@��x��p���������r��m�+���p[?e=HU���35z���'�\+��v�&3���Ϊ���њ���C��Csf�&T�����Hո�d�<�'RE|2 ~����$G���*�(�j3���}8���Ñ٬����n������à�x���Z��C ='�d�f:NX�����Z�ck��ڪ��vJU��$��N�0��;��� ��7:��������L b9I�c 6��82N~�ϣۙ��%�l��p���ւr�#��1�c�y�]�윎tA�%����6C;-��UF)7�l̇��{(�_�V�9�T��R/<��h�e���a�B{?�S�8A��Q�UbN�<u��'Q�l'䬪l��(�_1�����A�1~�'i{�Yq����%������jIۍ#`��<6�V �S�g�6���"֯���)X˧yh�Չ�|)2��n��/�*����ɨ= dD�q.xnѼGu��K1f����Ҋ�A��Qpl �`�j )�[�`2X=h�5ɩڜC�f�Ć\+Q\�~X�]�6�!9��e�1_���O{3:���ɧ��.��f���F��@��eL�=��R�S݉��%r26K�Qڡށs�.n����`湀��.a���f&�����+8���s��ń`ijB�$z\��T��[�l��,�ԣׂ� �5'6�!,5�\.K��80hXH��|���T֘��@KӛOʲ����n�= ~�mA�qp�� @���ǽ�)�9����,�4��! "o�*�t���_�@��/˭p��������� �L%@��'�,�q1w� <����~�����f��������yڏD�.zd�̳\�'o8$WH?��̌�^�%-1U�;�͜.��! �Mt�3�>T�d���7���RN��&U?�@`lv7���e��CE�F�ə�s�vQ�O�ŀ 4B�����S�mܹ�~ֻAI��?g����?�2X^�����m���y��Ix��sM-S5�AL[0��ͶXpA#Q�8�w���?�����<z�P��ڗ�"�z'�]�[)�����5�w�4�N~�>�=��s��#+���\ ��!�μ]��B'�Z�Y���Ȳk��r���6&5y�� By?Zo� ��������g�~��'�]�;�/-�%�L���N6$������a���C h=�2�7���3�2��HN�Q1��2�a��@*��r��e#�m2*>a���W���M��2������ve�+����-����OS�� ������G�[oxu��z���P���������ߧ����\C5� ��f%���JT���5�\�8�%������Hނ� ��Ad��\��F/M�,B9��÷����G,����nb�{����#��ꎙL�UNӑӜ�j�qTY��\�" �UET1�r������.}L[�m�+|�zQ���l15GaR_�Z�NĄ�N�G�<�;]���e�/����"S+WN(�y���� OiX��0�tn�I�q^H���kw7�~S�2� �7�)�f�R:i\%<�~��'���4�&�4a��)d���� e"�l���h+��>`;uwhL�s���OJ���Bw���ޜv��8���*���10�)�� v��A$�[��VH�6G=�K��h��� ���U����� ���d�)i��p�8ZS�ZLj�O��A�#�MP����Kf^��ڒ��W���3K!�&�Ó�D9�E5�T�߾p_�~8���$B&^tl9]�P��rJNH��ç9#W��̅���o�{䫵� �O��4R�T]�O�������*����y5�Uf���yO�kpZa0x-����P�漏d` ���h���\�1���QB�$2�=B�j��S��Y����\6�\}��3����U]XS䜓���/��Xsj�sOQN��ʻKdCm��R=<~�-G*���X�%�/�C��V����AAKf���$|HPkXJ�`h�m�F��$�Xy�K�2N��-S�MxV�%�M:=yʛ��Z��PW�|�[#��#{��(�m���X�i�}��/FPm���O���`�ɹ�W���IL�B�������?H�An� �u�Q�E}��@W� ����ˢ�kD0���LEVZtpKP<�=?�$��1yE�Td nA�#���o �� Ꝏ'C�5n���X�e���������;QI��f�Ԙ� ��p%vqW�,��L�Rx3�a�ߥ�V�@���5�����"�vK xIqE�+������C�]?Z /�e��}Z��;5X��w�d�Ӵ[��cEY����ۢ���`�;&�3�+V�9C3��[����4T���ʠA �e�6�q�s���p�%��\�Ƀ�Zc�s��;�V 5.$D��2
Sections
.text Size: - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ