vidar | 3052-0-0x0000000000400000-0x0000000000657000-memory[.]dmp | Triage

Sharing

General

Target

3052-0-0x0000000000400000-0x0000000000657000-memory.dmp
Size

2.3MB
MD5

212ae1897f67ce96fa9124ef5ed1c83e
SHA1

e4aa1a1e50c07635012d536665105a26169a31f1
SHA256

ceff52df5ffd49f39f02c261003672f453f26a03cb2d35eb6122eda3df1ace49
SHA512

1153b6c79205948322082ec5484384aff00092b2269168039325f183dd03b077fd19cd774d3159da52d3c540aae970a4b56a59442c532234573ccc19b39259a7
SSDEEP

3072:+GC9MbkR5GdiEnQBNIzAc1xwb27+cWN+EysofbxhCemXUq0fBp8HraPu9:4M4LGZnQjszwb2uZovu/a8Au

Score

10^/10

stealer vidar

Malware Config

Signatures

Detect Vidar Stealer 1 IoCs

resource	yara_rule
sample	family_vidar_v7

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3052-0-0x0000000000400000-0x0000000000657000-memory.dmp

Files

3052-0-0x0000000000400000-0x0000000000657000-memory.dmp
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ