_UnhandledExceptionFilter@4
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20250207-en
General
-
Target
1.exe
-
Size
272KB
-
MD5
dbdfd9ab774d8fa5a56718b1fae7bc95
-
SHA1
df4c5c42e6b8d3c7324a34a2b017f362d9213558
-
SHA256
604c471648621880aeceac0534190b14e8c3ea05d4bc5bb95a8e777dd82e65aa
-
SHA512
d3478dd32f89105cd62997f539961bb69a7eb08ca614f9185c29a32cb96f3dbc87638fea6eb09717ad67696d5aab1a39373aaddf0fd0c057ea6787346d7a31c8
-
SSDEEP
3072:ne/3hGz8Su8ucwsy7vf7Qy63S9scCh4slxWsr7i9W3WWsZHpV0iukwEEfzqygF/S:n6xqucZy7vf8f3oMRxb/3W1Hp91Gq
Malware Config
Extracted
vidar
https://t.me/m08mbk
https://steamcommunity.com/profiles/76561199820567237
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0
Signatures
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1.exe
Files
-
1.exe.exe windows:6 windows x86 arch:x86
9fa03dc67d87598889edf28a24bc9b26
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateFileMappingA
CreateProcessA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
GetComputerNameA
GetComputerNameW
GetCurrentProcess
GetCurrentProcessId
GetDriveTypeA
GetEnvironmentVariableA
GetFileAttributesA
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetLastError
GetLocalTime
GetLocaleInfoA
GetLogicalDriveStringsA
GetLogicalProcessorInformationEx
GetModuleFileNameA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemPowerStatus
GetSystemTime
GetTickCount
GetTimeZoneInformation
GetUserDefaultLocaleName
GetVolumeInformationA
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalSize
HeapAlloc
HeapFree
InitializeCriticalSectionEx
IsWow64Process
K32EnumProcessModules
K32GetModuleBaseNameA
K32GetModuleFileNameExA
LoadLibraryW
LocalAlloc
LocalFree
MapViewOfFile
OpenEventA
OpenProcess
Process32First
Process32Next
RaiseException
ReadFile
ReadProcessMemory
SetFilePointer
Sleep
SystemTimeToFileTime
TerminateProcess
UnmapViewOfFile
VirtualQueryEx
WaitForSingleObject
WriteFile
lstrcatA
lstrcpyA
lstrcpynA
lstrlenA
msvcrt
??2@YAPAXI@Z
??3@YAXPAX@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_itoa_s
_splitpath
_wtoi64
atexit
free
isupper
malloc
memchr
memcmp
memcpy
memmove
memset
rand
srand
strchr
strcmp
strcpy
strcpy_s
strlen
strncpy
strstr
strtok_s
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
GetCurrentHwProfileA
GetUserNameA
GetUserNameW
RegCloseKey
RegEnumKeyExA
RegGetValueA
RegOpenKeyExA
RegQueryValueExA
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
user32
CharToOemA
CharToOemW
CloseDesktop
CloseWindow
CreateDesktopA
EnumDisplayDevicesA
GetDC
GetDesktopWindow
GetKeyboardLayoutList
GetWindowRect
MessageBoxA
OpenDesktopA
ReleaseDC
wsprintfA
wsprintfW
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
DeleteObject
GetDeviceCaps
SelectObject
ole32
CoCreateInstance
CreateStreamOnHGlobal
GetHGlobalFromStream
oleaut32
SysAllocString
SysFreeString
shell32
SHFileOperationA
SHGetFolderPathA
ShellExecuteExA
ws2_32
WSACleanup
WSAStartup
closesocket
connect
freeaddrinfo
getaddrinfo
htons
recv
send
socket
shlwapi
PathFileExistsA
PathMatchSpecA
ord155
ord156
StrStrA
crypt32
CryptBinaryToStringA
CryptUnprotectData
wininet
HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetSetOptionA
bcrypt
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptDestroyKey
BCryptGenerateSymmetricKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
dbghelp
SymCleanup
SymFromAddr
SymGetLineFromAddr64
SymInitialize
SymMatchString
SymSetOptions
Exports
Exports
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ