Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
8.1MB
-
MD5
c7f111001a30b8f8d8265b3f4fa31632
-
SHA1
83cd2963a317387c87151724d30b42d08d6195b9
-
SHA256
f5c86b853d5678219968d4afdc9c70dfa8f0a73712bd231d0d372bd9fd3fd800
-
SHA512
9170ef470a358a3fd8002cd0984d9f6a78c077fddeab0869fe338a2e9945c32091fe854d8d872e30234f677f202c2a80596af8454ba38373126f58d86e6e18fd
-
SSDEEP
196608:M+ZflgblwdrPq9hnj2/mB+kgNrZMRzoo0j0zZg4if7EvXW:1ZtOGrSnq/iKtMRzooo0z6RQX
Malware Config
Signatures
-
Vidar family
Files
-
file.exe.exe windows x86
6150db5cdd173483c1a999682bd3c654
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
ole32
CoCreateInstance
oleaut32
VariantInit
user32
CharUpperBuffW
Sections
.text Size: 269KB - Virtual size: 268KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
. 1D Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
._oB Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
./lM Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 350KB - Virtual size: 349KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ