Extracted

• • Target

    JaffaCakes118_71683ed2086bceb4febaa870ff3dc90b

  • Size

    2.9MB

  • MD5

    71683ed2086bceb4febaa870ff3dc90b

  • SHA1

    add97aa9fb26f64c81df5df1b932f0bff630525c

  • SHA256

    f218ff57753dedadb3cdd2d616fe802cc336031629d10e9c6b07e0e7a4e04a81

  • SHA512

    38fde3cc45ec175414ec318a519b9e8f8a9af05bef6b44a920ec89b77e3dbfc80d107d30d733c3caefdbbc0a6a8f071473d149ce9c563c759001aeb9931b0b19

  • SSDEEP

    49152:RXy2gkTkvSaY0q8/df24onCU6qmS3W6bts/OYTDJVV9M+XcwDhC3Mlb:I2dTcSa+8/N2+1oBb6/rTD/PM9wDM

  Score

  10^/10

  vidar932discoveryevasionstealertrojan

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Vidar Stealer

    stealer

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2