vidar | 1152-0-0x0000000001250000-0x00000000012B9000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1152-0-0x0000000001250000-0x00000000012B9000-memory.dmp
Size

420KB
MD5

b814d5ad002caa778d8509be668a3cab
SHA1

7dababc1858d6d51f5677a5f042ca77d2e041967
SHA256

b990b9db455e594433298ab50468d6ca4244bfe15566f177e96284908f0ceb8c
SHA512

d80b9f908ef8fa77984b9167adf8e6da467e309ecb69b64e29a0c0f56605615029e908c33835fe6e22e39d771b31e035dad2d3c5dda9d3759afb1b4949a17c08
SSDEEP

6144:8+TjblnS6cjs+hmrlSd6VSSDEBbAUUkFhfDs1w/u7rYjCQYphKy:fTjbl7vlSYPDRU7Hg1w/u7qVYpMy

Score

10^/10

stealer vidar

Malware Config

Signatures

Detect Vidar Stealer 1 IoCs

resource	yara_rule
sample	family_vidar_v7

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1152-0-0x0000000001250000-0x00000000012B9000-memory.dmp

Files

1152-0-0x0000000001250000-0x00000000012B9000-memory.dmp
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bsS
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ