vidar | 2784-0-0x0000000000CA0000-0x0000000000D06000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2784-0-0x0000000000CA0000-0x0000000000D06000-memory.dmp
Size

408KB
MD5

ccfcce78b5987eef3f6b5a127788d567
SHA1

6019219ff5e5367851f94243537b1081e6865660
SHA256

2a5ed63f09a78ed71d9535d6e9017d0333adacf26b99fb92ad9606e0da375ae6
SHA512

3327e3c64bacae8c7a893480542e45a1cd229f40e99ffecd087ba3f2606edeb2ed00ecb9fa3d162894543002ec870c2bce9ae9533f849fbc7fc4b199d2274781
SSDEEP

12288:ZhLvgxvQDvxNW5hVNaFFnj7F94UUOoCe:XLcvQbx45LSp94tHR

Score

10^/10

stealer vidar

Malware Config

Signatures

Detect Vidar Stealer 1 IoCs

resource	yara_rule
sample	family_vidar_v7

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2784-0-0x0000000000CA0000-0x0000000000D06000-memory.dmp

Files

2784-0-0x0000000000CA0000-0x0000000000D06000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 1024B - Virtual size: 962B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 211KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ