Behavioral task
behavioral1
Sample
1476-41-0x0000000000600000-0x0000000000671000-memory.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1476-41-0x0000000000600000-0x0000000000671000-memory.exe
Resource
win10v2004-20240508-en
General
-
Target
1476-41-0x0000000000600000-0x0000000000671000-memory.dmp
-
Size
452KB
-
MD5
f64ccc85d5ea8b792ef39e3f3454ed62
-
SHA1
b826fe041483a2d9acca7e3f8f347bb726fe12c3
-
SHA256
d6a5ff115adffa48e34c4b20d26ba37583760c3a267af3d9acdfbe6a105d8050
-
SHA512
27fdd139ee570f033728a701805e89db993c098ef3cbfd8ff7b8b91ed67deddf7a6c05788078f27429e76b9d109cb3c2eafcc593e7436a971a247bba0fe57273
-
SSDEEP
6144:GmLEm87VHIUvOciQyMvgaw0ZYkFY1ckc+yFh+:JLEm87CAiawAYaY1ckc+yK
Malware Config
Signatures
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1476-41-0x0000000000600000-0x0000000000671000-memory.dmp
Files
-
1476-41-0x0000000000600000-0x0000000000671000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 245KB - Virtual size: 245KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 42KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ