vidar | 1236-65-0x000000001B980000-0x000000001BA00000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1236-65-0x000000001B980000-0x000000001BA00000-memory.dmp
Size

512KB
MD5

0820c99c9ebc3ea0d4a4c93d33be6eab
SHA1

df2d414fb5ad2029527d996d219f48bf568b7c5d
SHA256

09a1eca005964b1226a3e540c3b8c9db4bfc6bda681f88c723b2ace744f76b26
SHA512

1ea9dae73d875d1b6eb9d38ab42f461cb41f1b1ec83dda670811a412c5e36c655a16a8f07c9f03ef35ace5f320963363c00fe58d3f093e1886deca2f079b1607
SSDEEP

6144:HjZi5dyACB0iCHcbk8ukYGFOg1i5SvTzhLJqNpD:HjZgyAmk8uBGYg1i5SvTJJqv

Score

10^/10

vidar

Malware Config

Signatures

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1236-65-0x000000001B980000-0x000000001BA00000-memory.dmp

Files

1236-65-0x000000001B980000-0x000000001BA00000-memory.dmp
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 245KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ