Behavioral task
behavioral1
Sample
3196-237-0x0000000000400000-0x0000000000472000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3196-237-0x0000000000400000-0x0000000000472000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3196-237-0x0000000000400000-0x0000000000472000-memory.dmp
-
Size
456KB
-
MD5
9a6780156b267dae02629ff49295f167
-
SHA1
96cc0e7b79fbe6eae50f88f516d48683b0daed34
-
SHA256
4b9ab7ad3485faf169c96ddeed322ece5a94ece367bde61a347c6961ea24a8f6
-
SHA512
4d4f8646eb0490a724ec494b243a17c013b3a96b71785f0dadee3ce77a85e676facfff3542ad037939285c2ec3ccc73d6a7103a652ec4705496bbc2f9921ba61
-
SSDEEP
6144:6KpfzMTkFpYnOOeV4mR+OO83puRqHMFatWMYwzbkLsU5dCkJb:6KpfYTkFNv8H83w0MFatTJYLvp
Malware Config
Extracted
vidar
2.5
19
-
profile_id
19
Signatures
-
Vidar family
Files
-
3196-237-0x0000000000400000-0x0000000000472000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 273KB - Virtual size: 273KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ