_UnhandledExceptionFilter@4
Behavioral task
behavioral1
Sample
build.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
build.exe
Resource
win10ltsc2021-20250207-en
Behavioral task
behavioral3
Sample
build.exe
Resource
win11-20250207-en
General
-
Target
build.exe
-
Size
119KB
-
MD5
08388bb4894c71e7b1be4bad966c3824
-
SHA1
7437ac98f08fc41283b900aa6fb0ae350d59dd6c
-
SHA256
986a98dc33a925fa232e1e5311807c7681cad9e0f07957d81e4f2f8257503f9c
-
SHA512
2adf5154e7dca7de1fcf12560c97f1b74e66fb3c5074d8fa9d29dd9da91a1314f9fc18270808c12364c4941a6a2346109824bd4c625df905f9be84af393934b3
-
SSDEEP
3072:8Ho0VvS7fw67XojiwHjwlntccGGLz9VkYFP+WR9pLhbFnhSe2e2e2nw:41VvSM6ziiw0cMLzDj9VBne
Malware Config
Extracted
vidar
https://t.me/sc1phell
https://steamcommunity.com/profiles/76561199819539662
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0
Signatures
Files
-
build.exe.exe windows:6 windows x86 arch:x86
84ba17106ada936d580064070fd488b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
??2@YAPAXI@Z
??3@YAXPAX@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_itoa_s
_splitpath
atexit
free
isupper
malloc
memchr
memcmp
memcpy
memmove
memset
rand
srand
strchr
strcpy
strcpy_s
strlen
strncpy
strstr
strtok_s
kernel32
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateProcessA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
GetComputerNameA
GetComputerNameW
GetCurrentProcess
GetCurrentProcessId
GetDriveTypeA
GetEnvironmentVariableA
GetFileAttributesA
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetLastError
GetLocalTime
GetLocaleInfoA
GetLogicalDriveStringsA
GetLogicalProcessorInformationEx
GetModuleFileNameA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTime
GetTickCount
GetTimeZoneInformation
GetVolumeInformationA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalSize
HeapAlloc
HeapFree
K32GetModuleFileNameExA
LoadLibraryW
LocalAlloc
LocalFree
OpenEventA
OpenProcess
Process32First
Process32Next
RaiseException
ReadFile
ReadProcessMemory
SetFilePointer
Sleep
SystemTimeToFileTime
TerminateProcess
VirtualQueryEx
WaitForSingleObject
WriteFile
lstrcatA
lstrcpyA
lstrlenA
advapi32
GetCurrentHwProfileA
GetUserNameA
GetUserNameW
RegCloseKey
RegEnumKeyExA
RegGetValueA
RegOpenKeyExA
RegQueryValueExA
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
user32
CharToOemA
CloseDesktop
CloseWindow
CreateDesktopA
EnumDisplayDevicesA
GetDC
GetDesktopWindow
GetKeyboardLayoutList
GetWindowRect
MessageBoxA
OpenDesktopA
ReleaseDC
wsprintfA
wsprintfW
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
DeleteObject
GetDeviceCaps
SelectObject
shell32
SHFileOperationA
SHGetFolderPathA
ShellExecuteExA
ole32
CreateStreamOnHGlobal
GetHGlobalFromStream
ws2_32
WSACleanup
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
htons
recv
send
socket
shlwapi
PathFileExistsA
PathMatchSpecA
ord155
ord156
StrStrA
crypt32
CryptBinaryToStringA
CryptUnprotectData
wininet
HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetSetOptionA
bcrypt
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey
BCryptGenerateSymmetricKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
dbghelp
SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymInitialize
SymMatchString
SymSetOptions
Exports
Exports
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ