Behavioral task
behavioral1
Sample
5064-228-0x0000000000400000-0x0000000000472000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5064-228-0x0000000000400000-0x0000000000472000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
5064-228-0x0000000000400000-0x0000000000472000-memory.dmp
-
Size
456KB
-
MD5
38d0a178d237c82a71b13e17bc63d151
-
SHA1
2c5665d6625de3aaee145da24df48e8d1e14ac39
-
SHA256
10bb56a348a636e130aee5ad59c5f349e763ae067293bd200bb9cb629456fd0f
-
SHA512
fbd8d27138492550414cb6e5fc7b4b87e237e188254b90c70dd3f7d8312963a8d769048ace1c0f4bc8611ea333bb9bd310141fa19fdc74e980409cd3c4894cd2
-
SSDEEP
6144:JHd2snwZDkCUbuu3zt3FrNPMXDuOYijvafUtfhDV9MUBilj2JC:JHd2sncDkC03JFlMXKujvafUBhDV9iP
Malware Config
Extracted
vidar
2.4
19
-
profile_id
19
Signatures
-
Vidar family
Files
-
5064-228-0x0000000000400000-0x0000000000472000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 273KB - Virtual size: 273KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ