vidar | 04803799[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

04803799.dmp
Size

784KB
MD5

aac434d9dba653f41aedc8efbb217682
SHA1

825bf6a8a52e48251ccbf69fe8ea29df39c1697f
SHA256

d7e5ae31ed905737080b41b547b6ff291f8ece238ac04ea1a0fb28c3da5bb84b
SHA512

c4eabd5eabae37abd5a7b7cb8082942c19aac3dbe066a49c58f4e6bc048654bea4994e6dbef061c4729c0953c5dcc1a1c7b35d422f2756ac79cc7de6624a0753
SSDEEP

6144:TBA0i2uim7rAPtf9w8zSRWBt9JPpr+hTLWzYcRh6paW7u1TL+:TG0iwj9w8zS4BPJPpr+PcY02

Score

10^/10

vidar

Malware Config

Signatures

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04803799.dmp

Files

04803799.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 250KB - Virtual size: 250KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ