Behavioral task
behavioral1
Sample
101640-136-0x0000000000400000-0x000000000045E000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
101640-136-0x0000000000400000-0x000000000045E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
101640-136-0x0000000000400000-0x000000000045E000-memory.dmp
-
Size
376KB
-
MD5
014b785b375c4a3abc5e8ee508d119dc
-
SHA1
885f202ea9bd403b6f985bfd968943bdd3cb83b8
-
SHA256
e862ebc0c8de374292fb4a0827db164613bca482864b89c1cbf7bae578f4a021
-
SHA512
fb6a0f6e09b416e3c197f1dac1e6b37276ab2869386f1f885eab1f42d3879350ad53a7e62f0fdf6a9a98df6b33552acaccd845626580a97494ee17a08634f52c
-
SSDEEP
6144:ZTpd5Z66SC7r4PCP0ROgi+7ZYUIYe85x:nHA6SCH4e0RXvZy87
Malware Config
Extracted
vidar
55.2
915
https://t.me/slivetalks
https://c.im/@xinibin420
-
profile_id
915
Signatures
-
Vidar family
Files
-
101640-136-0x0000000000400000-0x000000000045E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ