General
-
Target
vidar.exe
-
Size
552KB
-
MD5
2bf210b26e0ecedd00006d8c02ffd39a
-
SHA1
3168a8eceb712163f43e6546a1f474b8af172ec9
-
SHA256
c9496cd297f5b3dd6b11abdd9c54b90e9fd5e89e6dafed089fdcc570262ebadc
-
SHA512
ee7f554fbe20392f9239cffde88f6ba9cdedf251fd12bf37c3d35f772489227dd7f26fd4957661ae0ae033c5c1ca71c46c56b5fa4324dbc4f4b645029a12321c
-
SSDEEP
12288:+pOqNA2cIzVWgwZPAxe+NWuVZYMK9fK4GSFbaZ3Tux3/O:WXNA21xGAhdZYnV/laZ3Tu
Malware Config
Extracted
vidar
30.7
664
http://korikanelolsa.tech/
-
profile_id
664
Files
-
vidar.exe.exe windows x86
d1c6f188e9ab2bdff1b4a161d227cad5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryA
GetLastError
CreateMutexA
CloseHandle
WriteFile
CreateFileA
MultiByteToWideChar
ReadFile
GetFileSize
GetVersionExA
GetFileSizeEx
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GetProcAddress
LoadLibraryA
FileTimeToSystemTime
FreeLibrary
GetPrivateProfileSectionNamesA
lstrcatA
GetFileAttributesW
InitializeCriticalSection
InterlockedCompareExchange
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
AreFileApisANSI
SetFilePointer
SetEndOfFile
FlushFileBuffers
UnlockFile
LockFile
LockFileEx
UnlockFileEx
GetFileAttributesA
GetFileAttributesExW
SetCurrentDirectoryA
QueryPerformanceCounter
GetTickCount
GetSystemTime
CopyFileW
UnmapViewOfFile
GetTempPathA
GetTempPathW
FormatMessageA
FormatMessageW
GetFullPathNameA
GetFullPathNameW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
CreateFileW
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GetComputerNameA
IsWow64Process
GetCurrentProcess
GlobalMemoryStatus
GetModuleHandleA
GetUserDefaultLocaleName
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
GetLocaleInfoA
GetFileInformationByHandle
SystemTimeToFileTime
GetLocalTime
CompareStringW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
GetStringTypeW
GetModuleFileNameA
GetCurrentProcessId
Sleep
DeleteFileA
ExitProcess
GetLogicalDriveStringsA
GetDriveTypeA
LoadLibraryW
CreateDirectoryW
lstrcpyW
lstrlenA
lstrcatW
FindFirstFileW
lstrcmpW
DeleteFileW
FindNextFileW
FindClose
HeapFree
GetProcessHeap
HeapAlloc
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetConsoleMode
GetConsoleCP
GetModuleFileNameW
IsValidCodePage
LocalFree
LocalAlloc
GetSystemTimeAsFileTime
GetOEMCP
GetACP
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
GetCPInfo
LCMapStringW
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapReAlloc
RtlUnwind
RaiseException
DecodePointer
EncodePointer
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
WriteConsoleW
user32
GetSystemMetrics
wsprintfA
EnumDisplayDevicesW
CharToOemA
GetDC
ReleaseDC
GetKeyboardLayoutList
GetDesktopWindow
gdi32
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
CreateDCA
GetDeviceCaps
CreateCompatibleDC
advapi32
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExA
GetUserNameA
GetCurrentHwProfileA
RegOpenKeyExW
RegGetValueW
RegCloseKey
RegGetValueA
RegEnumValueA
shell32
SHGetFolderPathA
ShellExecuteA
ole32
CoCreateInstance
CoUninitialize
shlwapi
PathMatchSpecW
crypt32
CryptStringToBinaryA
CryptUnprotectData
psapi
GetModuleFileNameExA
EnumProcessModules
GetModuleBaseNameA
wininet
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
InternetSetFilePointer
InternetReadFile
HttpQueryInfoA
HttpAddRequestHeadersA
InternetSetOptionA
InternetOpenA
InternetOpenUrlA
gdiplus
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
GdipCloneImage
GdipDisposeImage
GdipAlloc
GdipGetImageEncodersSize
GdipFree
bcrypt
BCryptDecrypt
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptOpenAlgorithmProvider
Sections
.text Size: 456KB - Virtual size: 455KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE