Behavioral task
behavioral1
Sample
3728-18-0x0000000000D10000-0x0000000000D83000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3728-18-0x0000000000D10000-0x0000000000D83000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
3728-18-0x0000000000D10000-0x0000000000D83000-memory.dmp
-
Size
460KB
-
MD5
e2a4099374f65ab557969a611270e012
-
SHA1
aa58588be67fe0ecf1b9b50ae31223f41f0ba891
-
SHA256
5df003a8b79fab4bcfc6a862f59a2f81e5516871b628d45047bb337cee854189
-
SHA512
7e8e95d5be7078cf8e9155e8456ed3e13045e749240c9e8ca6e7c6aca5a65db4f3d8448e7db5734207108d6afe54011356388de34a235d49ba9b311031657175
-
SSDEEP
6144:DTyqkX48nyEHpgcwCNHsuJFQC3KKOWJCtsjUeQIbyC:DTy8GYcDZjJR3KKOqCeUIby
Malware Config
Signatures
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3728-18-0x0000000000D10000-0x0000000000D83000-memory.dmp
Files
-
3728-18-0x0000000000D10000-0x0000000000D83000-memory.dmp.exe windows:5 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 254KB - Virtual size: 253KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pwshwu Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE