Extracted

• • Target

    JaffaCakes118_e032af8c6ab53c34f29d433391f97f1d6c0cb5647e76ac6609b594761729fe37

  • Size

    761.7MB

  • MD5

    fd389eb0cff4d93e0e9fce0e2248221f

  • SHA1

    8fbd0f00f5f16c1ca43891652ec9f411ddb58a2b

  • SHA256

    e032af8c6ab53c34f29d433391f97f1d6c0cb5647e76ac6609b594761729fe37

  • SHA512

    40fe03c7e1fc216f84ec378ee59be18ade24a81480dca9b1372010e003882b9acd123c5e5d7f18de78ee3eb592b6ba907495da5d5244cc0c16f15d1351810dbf

  • SSDEEP

    24576:JP2Nr/ox3EmOgBRWoIy1MIWHOq8aDCc5Orzb06Y51fdJFP9XJ2VyGbYJc6IU2rew:JP2NDox3nLMIOOq8aOR

  Score

  10^/10

  vidar408discoveryevasionstealertrojan

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2