Extracted

• • Target

    Presentation info/Presentation info.exe

  • Size

    93.2MB

  • MD5

    e06a97f4714b6d0e62c51b3395a64a6e

  • SHA1

    870e5cc5a18acb41c1377c6a47b4cef76723a2e1

  • SHA256

    5e374fbc3960dd68c2cef4209851103f5623957e9815a0be720befd7899d3cc0

  • SHA512

    b0483408723e5bd786d8170c2b46c25d1f37f2bca9f0f6855c8b94a2acea914dd45a3e479299bd9aeb920d6966667b729e7cbe4a03126945d90e4f33c7169df7

  • SSDEEP

    1572864:UjA+Zh4QkjGuWsqebzyuGqNMnKuEqHhaPd5nC8DDkeZZZZZsOKa1pVeOKCr7ZPo:UjA+P43jRWshbzyuNMnlEqIPrzDkeZZs

  Score

  10^/10

  vidar86277575c381e1fefb9bf290d771e6f1spywarestealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2