Behavioral task
behavioral1
Sample
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
Resource
win10v2004-20240426-en
General
-
Target
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
-
Size
3.7MB
-
MD5
6de3da12ea83180aed2fa3dabc37cbe0
-
SHA1
c547617a266984c58743716a08f8662f3d8bb281
-
SHA256
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4
-
SHA512
4141a1544626bd94cd7fb153ae77420227bf14dbc369bce549dff7f021a21ccb4c2cf626fde6f5d10f87bd09e710784d6d7bcdf1df6733c31fff11a8b75f11c6
-
SSDEEP
49152:cYn2JVKh1VrdmC/1xpLzgYSHx4yzj8zow4ylvrFgn/y5q2DiAtGJqT5+GPd:c2FdzgYSHx4yzj8zowFdyotWAH
Malware Config
Signatures
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe
Files
-
d92cea79ef6057193ed6349af43aa25ff43b2e7340d1e3ed2aad3d8f384642b4.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.code Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ