Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
artifact.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
artifact.exe
Resource
win10v2004-20240802-en
General
-
Target
artifact.bin
-
Size
296KB
-
MD5
92f8d2da5a58ba3237b2302d53d8fd63
-
SHA1
73887545fe4499fe213dd2076d1b2bf7d60d7239
-
SHA256
a7dfa5d1f30140197392c7c9f0ad2c49d2403d81593ffe9dec5af19427b5e7cd
-
SHA512
e1970a6991311df804fd7641cf6b23abf52ec91cd36a4b7deea0df4d488248da5dd0eb2fc69f6de84006231bd53eb3e80c23dd689dc0b43cdad56fea1bc51427
-
SSDEEP
6144:y7pOFlpDofcQdKU8CvGJlcWwoKDL4YnUDAt:yUpMKbgWw5DcY
Malware Config
Extracted
vidar
1.8
600
https://t.me/year2023start
https://steamcommunity.com/profiles/76561199467421923
http://65.108.93.119:80
-
profile_id
600
Signatures
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource artifact.bin
Files
-
artifact.bin.exe windows:5 windows x86 arch:x86
a4ceef94abb25de9c95cbb8b9cac9ae7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAllocExNuma
Sleep
VirtualAlloc
LocalAlloc
GetProcAddress
LoadLibraryA
VirtualProtect
GetLogicalProcessorInformationEx
VirtualFree
FindNextFileW
CloseHandle
GetProcessHeap
GetCurrentProcess
FindFirstFileW
ExitProcess
SetEndOfFile
CreateFileW
CreateFileA
WriteConsoleW
SetStdHandle
LoadLibraryW
HeapReAlloc
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
EncodePointer
DecodePointer
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetLastError
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
HeapCreate
WriteFile
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
HeapSize
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
ReadFile
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoW
GetUserDefaultLCID
user32
ReleaseDC
gdi32
CreateDCA
GetDeviceCaps
ole32
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
oleaut32
VariantInit
VariantClear
SysAllocString
SysFreeString
Sections
.text Size: 209KB - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ