Behavioral task
behavioral1
Sample
788-66-0x0000000001120000-0x0000000001324000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
788-66-0x0000000001120000-0x0000000001324000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
788-66-0x0000000001120000-0x0000000001324000-memory.dmp
-
Size
2.0MB
-
MD5
9f1650c2cec0e67df074b9080358ff01
-
SHA1
f26f31a6d50caa0ca584794ed9fff4bc21719dc8
-
SHA256
3ffc2ef250f6d7f9b55ee5576c1dcfabce13c63e5824756400cb64cb18030377
-
SHA512
c435f91a5c216b8c2bcdca3cb88ee58d0f3105c0547e9f28f17856e9afb84b2d021ec94bc39db7c963001be2a9be830a3f60dcfa8b59a595b106b23a316fdbd1
-
SSDEEP
12288:tBjYbdbR84JvdEIUj52c+ZVMX2Mxvqc9JqhDV98tbe9:tARPc2caMX2Mx7Jgh9ubG
Malware Config
Signatures
-
Vidar family
Files
-
788-66-0x0000000001120000-0x0000000001324000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 375KB - Virtual size: 378KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.V7284 Size: 488KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.V7284 Size: 488KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.V7284 Size: 488KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ