Behavioral task
behavioral1
Sample
1728-56-0x0000000000400000-0x00000000009AC000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1728-56-0x0000000000400000-0x00000000009AC000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1728-56-0x0000000000400000-0x00000000009AC000-memory.dmp
-
Size
5.7MB
-
MD5
8d15f2eb8f3373c4f26c6655a40c8ff9
-
SHA1
0c71a639b51b3f41a5fdb81e16666fe2445585a4
-
SHA256
9f42296117aa59883247ce93497803edc87f8f3a8a8daaf8145b75ceb2549ae1
-
SHA512
96318c2dd353d2272386ca33830df174be8ddb37bafbcfee020c2ed6738f65077ca06668b9f329685040bb38a11af95339c06aeb20b55df37b400e0faf26dd6b
-
SSDEEP
98304:MV1/e6+AD9/mS2qt3cax97hqfdApDZSh1isn3I3TOMxt1RhQhJMFi:MjGfe/ZDXhqiDsJIjtLyJMF
Malware Config
Extracted
vidar
2.6
813
-
profile_id
813
Signatures
-
Vidar family
Files
-
1728-56-0x0000000000400000-0x00000000009AC000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 3.1MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE