Behavioral task
behavioral1
Sample
881665de76a80f3f05c2250e89ac81610acb6a3431adc15f686d0d941ac62d17.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
881665de76a80f3f05c2250e89ac81610acb6a3431adc15f686d0d941ac62d17.exe
Resource
win10v2004-20230220-en
General
-
Target
881665de76a80f3f05c2250e89ac81610acb6a3431adc15f686d0d941ac62d17.zip
-
Size
570KB
-
MD5
dc72658d6e8b0daf74e8a9745328b406
-
SHA1
126806d700ac19164707a6f8e57604874b844a2a
-
SHA256
0df9a740ba6871dba3486ed5c641306adb1586e6d5b6ed040ac5dc89fd3dce76
-
SHA512
9d65194c39a68900356403420f0cf1ede1d27076a5599073ec1a24f07f852bf0e782f76059db382a3db371f2ce00dfd6761b76a282da6325253251f6452b63d1
-
SSDEEP
12288:fOvFfX5D4TixqGkeW4bCLsxxA36TSXR9QjULkvFc+EH9uox:fsFPp4GqGk2bCLCxA3dDM9zEH9h
Malware Config
Signatures
-
Vidar Stealer 1 IoCs
resource yara_rule static1/unpack001/881665de76a80f3f05c2250e89ac81610acb6a3431adc15f686d0d941ac62d17 family_vidar -
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/881665de76a80f3f05c2250e89ac81610acb6a3431adc15f686d0d941ac62d17
Files
-
881665de76a80f3f05c2250e89ac81610acb6a3431adc15f686d0d941ac62d17.zip.zip
Password: infected
-
881665de76a80f3f05c2250e89ac81610acb6a3431adc15f686d0d941ac62d17.exe windows x86
Password: infected
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 725KB - Virtual size: 724KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE