X:\RGL\crashpad\crashpad\out\Default\crashpad_handler.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-07-02_e69aa90a6ebcbb1af196135e7845eb91_black-basta_vidar.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral2
Sample
2025-07-02_e69aa90a6ebcbb1af196135e7845eb91_black-basta_vidar.exe
Resource
win11-20250619-en
General
-
Target
2025-07-02_e69aa90a6ebcbb1af196135e7845eb91_black-basta_vidar
-
Size
1.6MB
-
MD5
e69aa90a6ebcbb1af196135e7845eb91
-
SHA1
f5c7dab51a21b69cad5fa1d39748f2edfd298867
-
SHA256
ee0d695c19a70f6a6876440230bd07b6d213afb010e8bb0873da09a0def2bb7b
-
SHA512
448e7eb6d792ac6c577302e3fce07ff5f1150f20224bbef310fe3c664914131b6f43509891b8001d54ba3569add200dcf62c9266b2a0e7ad0517104e0b7e8038
-
SSDEEP
49152:APJvoaBA4KVOK8HET45SW6H8DS52tdDpbRZy:mcVJe5SSDntdDpbRZy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-07-02_e69aa90a6ebcbb1af196135e7845eb91_black-basta_vidar
Files
-
2025-07-02_e69aa90a6ebcbb1af196135e7845eb91_black-basta_vidar.exe windows:6 windows x64 arch:x64
3e3c3120963a76231393ce6790b6197f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetLocalTime
GetCurrentProcessId
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
DeleteCriticalSection
SetLastError
GetModuleFileNameW
GetFileInformationByHandleEx
GetCurrentProcess
RegisterWaitForSingleObject
TerminateProcess
GetQueuedCompletionStatus
WaitForSingleObject
DuplicateHandle
DisconnectNamedPipe
OpenProcess
PostQueuedCompletionStatus
CreateEventW
SetEvent
CreateThread
UnregisterWaitEx
CreateIoCompletionPort
ConnectNamedPipe
VerSetConditionMask
GetModuleHandleW
VerifyVersionInfoW
FormatMessageA
IsWow64Process
SetNamedPipeHandleState
CreateNamedPipeW
CreateFileW
GetVersion
TransactNamedPipe
WaitNamedPipeW
LoadLibraryW
GetProcAddress
FindClose
OutputDebugStringW
ReleaseSemaphore
CreateSemaphoreW
ReadFile
GetFileSizeEx
GetStdHandle
WriteFile
SetEndOfFile
UnlockFileEx
SetFilePointerEx
LockFileEx
GetFileType
LocalFree
InitOnceExecuteOnce
CreateDirectoryW
GetFileAttributesW
DeleteFileW
GetVersionExW
GetTimeZoneInformation
GetSystemInfo
IsProcessorFeaturePresent
GetProcessId
Wow64GetThreadContext
SuspendThread
ResumeThread
GetThreadContext
GetProcessTimes
GetSystemDefaultLCID
GetThreadLocale
GetUserDefaultLCID
Sleep
RaiseException
CreateProcessW
SleepEx
GetLastError
FormatMessageW
GetCurrentThreadId
SetUnhandledExceptionFilter
SetProcessShutdownParameters
CloseHandle
SetConsoleCtrlHandler
InitializeCriticalSection
VirtualQueryEx
ReadProcessMemory
GetFileTime
RemoveDirectoryW
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
WideCharToMultiByte
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RtlUnwindEx
FreeLibrary
LoadLibraryExW
GetCommandLineA
GetCommandLineW
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
advapi32
BuildExplicitAccessWithNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildSecurityDescriptorW
RevertToSelf
ImpersonateNamedPipeClient
SystemFunction036
user32
TranslateMessage
RegisterClassW
DispatchMessageW
GetWindowLongPtrW
UnregisterClassW
CreateWindowExW
SetWindowLongPtrW
DestroyWindow
DefWindowProcW
GetMessageW
PostMessageW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winhttp
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpSendRequest
WinHttpWriteData
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpConnect
powrprof
CallNtPowerInformation
Sections
.text Size: 535KB - Virtual size: 534KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 166KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gehcont Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CPADinfo Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 864KB - Virtual size: 868KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE