Behavioral task
behavioral1
Sample
2576-202-0x0000000051980000-0x0000000051EDA000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2576-202-0x0000000051980000-0x0000000051EDA000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
2576-202-0x0000000051980000-0x0000000051EDA000-memory.dmp
-
Size
5.4MB
-
MD5
1cafe9d46cc36e8f45e4eb3390fc8ae8
-
SHA1
b9d9d4be96b4cd15b8f8991e7bc164eae5b28ada
-
SHA256
0ff6b342eb0164585978854910abb21a8aef139cd971237d45457b55fdde84a4
-
SHA512
3fbd1b7aaf1cf6630b08558220b9397111fd4a5306c0327d8bb14b9aecc18e8f265e93ac44543d5f62fcf91e57428109d33e303f6ffbb85dea093e82f8c7eb6e
-
SSDEEP
98304:pK4W3FoagtocvyAQhqPflKzo5zRNTwtrkSmVLNJ0B7sPn5NF2f:pK4zjvyA2qgzoNRKhkPLNJ0B7O5ng
Malware Config
Signatures
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2576-202-0x0000000051980000-0x0000000051EDA000-memory.dmp
Files
-
2576-202-0x0000000051980000-0x0000000051EDA000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 283KB - Virtual size: 282KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 188KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ