Behavioral task
behavioral1
Sample
2004-56-0x0000000000400000-0x00000000009B9000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2004-56-0x0000000000400000-0x00000000009B9000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
2004-56-0x0000000000400000-0x00000000009B9000-memory.dmp
-
Size
5.7MB
-
MD5
dbeb8c58717de8309c144d00535dbcbe
-
SHA1
c53bc2278b3544845627f88f069b4b28bd61842f
-
SHA256
4d3a4701eeaaa6cab5849012a28c19fc3e5e347b81545353c14f52d3de738a81
-
SHA512
9c19600ff71803d817188c6170b704c8ab6c5a6fb57985b6be30707bd7b09da2be6348f4dc6dc57579c1cdf48a722050f7ea4522023a09e9ccf18259aa31c418
-
SSDEEP
98304:Dl+2vO65zU5ZWiGJAdUXtWlJQLE0asJ07bIeAFNNXP:Dz1zU76PXtWleasJQhmN
Malware Config
Extracted
vidar
2.5
813
-
profile_id
813
Signatures
-
Vidar family
Files
-
2004-56-0x0000000000400000-0x00000000009B9000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 3.1MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 149KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE