Behavioral task
behavioral1
Sample
1504-298-0x0000000000400000-0x0000000000493000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1504-298-0x0000000000400000-0x0000000000493000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1504-298-0x0000000000400000-0x0000000000493000-memory.dmp
-
Size
588KB
-
MD5
9042abc08b7433021594504c4395bedc
-
SHA1
7ab7122133e94b190a8276cc7927d622fab160df
-
SHA256
33f0b2536770c762cd29aa3b9069e5dcc6e89bc6370782b0373150e08de54d01
-
SHA512
fa67a5eee422e433203dc0c0648d0e346192c9f4336b4e677f1b98e07f4d7138889ad0983a79c842bbb5d377d3ab57cea6cf8e2b2ceb495dfa79205ad8f9c595
-
SSDEEP
12288:fKqdEZLw/7zG83YdFvaVWjJYLrcGTXOu9CyVhr2xqw:fKLwe83YdFAWjqwGTXOu9CyTr2xq
Malware Config
Extracted
vidar
2.5
546
-
profile_id
546
Signatures
-
Vidar family
Files
-
1504-298-0x0000000000400000-0x0000000000493000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 273KB - Virtual size: 273KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 131KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ