vidar | c17b17789eb5638b701d6418013366d4448e317aeb12a5d1ac70f12ed8cd5a39N | Triage

Sharing

General

Target

c17b17789eb5638b701d6418013366d4448e317aeb12a5d1ac70f12ed8cd5a39N
Size

3.0MB
MD5

925d67844f0482b8869de167db1011e0
SHA1

a0a3665247c5ec44981e9ccc290cc240f69dbb65
SHA256

c17b17789eb5638b701d6418013366d4448e317aeb12a5d1ac70f12ed8cd5a39
SHA512

6a6a2c6676ec29857e861d53a8b0596f2ee55bbe10d83067790ff8ba8fc81c8c91d6967acfaf6bbb5ebc7aab6eb8d8c1a9f44c4dffdf4d1a93a02c046cb23f05
SSDEEP

24576:s34AdnbBTJwZYUMGNL/geFyNcTN+jv75TQn652VBuNyb:soAdb1eZYHGJtF4ch+jvNm0Nyb

Score

10^/10

stealer vidar

Malware Config

Signatures

Detect Vidar Stealer 1 IoCs

resource	yara_rule
sample	family_vidar_v7

Vidar family
vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c17b17789eb5638b701d6418013366d4448e317aeb12a5d1ac70f12ed8cd5a39N

Files

c17b17789eb5638b701d6418013366d4448e317aeb12a5d1ac70f12ed8cd5a39N
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 687KB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ