MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7508460a4fef59b9c528b810023de66ae601fb52a6e4f5a8735ccc3d8abfdad0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vidar


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7508460a4fef59b9c528b810023de66ae601fb52a6e4f5a8735ccc3d8abfdad0
SHA3-384 hash: dabb3badae1cfb7de841c66c58a2941a55b8987cbbb637147ecc579547e7580ac312fa499c606ee26e79c58d4e18d6fc
SHA1 hash: 311dd9e6d9f7bc1b17dd11f6b4d5b7c727693f1b
MD5 hash: 2fc74884d6eee5befdba084e4d11df9f
humanhash: kilo-winner-fruit-triple
File name:Start10ThemeEdit.exe
Download: download sample
Signature Vidar
Create hunting rule
File size:119'296 bytes
First seen:2025-02-23 15:18:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 48aa5c8931746a9655524f67b25a47ef (4 x Adware.Generic, 3 x AsyncRAT, 3 x Vidar)
ssdeep 3072:unPIbiThZjqhnwGWqGKMPrEdpg355uhuax1p0888888888888W88888888888/1:uguGr9GrYds5wIa10888888888888W8F
TLSH T18DC3E903B3D30075F4655E79C8768440AD2779B919F6602E3DF8DB0E4AB9AC28C77B62
TrID 82.2% (.EXE) Inno Setup installer (107240/4/30)
8.0% (.EXE) Win64 Executable (generic) (10522/11/4)
3.4% (.EXE) Win32 Executable (generic) (4504/4/1)
1.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
1.5% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter abuse_ch
Tags:de-pumped exe vidar

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Program.Unwanted.1514.22016.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67bb3c87a0fd713c335c804b
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
embarcadero_delphi fingerprint installer obfuscated
Link:
https://www.filescan.io/uploads/67bb3c433afc3763bec27623/reports/fe09d417-883b-4349-bdd2-7fc9439dfd5d/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/7508460a4fef59b9c528b810023de66ae601fb52a6e4f5a8735ccc3d8abfdad0
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/26f59e82-50bf-4927-b648-5c989f774335
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
1 / 100
Link:
https://www.joesandbox.com/analysis/1622243
Behaviour
Behavior Graph:
n/a
Score:
2%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/7508460a4fef59b9c528b810023de66ae601fb52a6e4f5a8735ccc3d8abfdad0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7508460a4fef59b9c528b810023de66ae601fb52a6e4f5a8735ccc3d8abfdad0/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oueemcsp55m3trjixaiaeppgnltad62su3splkdtltgd3cv73lia._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250223-spqjxssrx9/
Behaviour
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e3fd4b2e-c015-4f1a-acbb-7f0fc1c82dea
Unpacked files
SH256 hash:
7508460a4fef59b9c528b810023de66ae601fb52a6e4f5a8735ccc3d8abfdad0
MD5 hash:
2fc74884d6eee5befdba084e4d11df9f
SHA1 hash:
311dd9e6d9f7bc1b17dd11f6b4d5b7c727693f1b
Link:
https://www.unpac.me/results/ebc2b563-4d07-4510-a670-473057bdae9b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7508460a4fef59b9c528b810023de66ae601fb52a6e4f5a8735ccc3d8abfdad0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Vidar

zip 07ad80ce87f2db34c10bc924702cc631834106d7ba5c2076a35c1ae933e09591

Vidar

Executable exe 7508460a4fef59b9c528b810023de66ae601fb52a6e4f5a8735ccc3d8abfdad0

(this sample)

  
Dropped by
MD5 cf10c8709428174183af1be4d2a63cea
  
Dropped by
SHA256 07ad80ce87f2db34c10bc924702cc631834106d7ba5c2076a35c1ae933e09591

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CreateProcessW
advapi32.dll::OpenProcessToken
kernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExW
kernel32.dll::LoadLibraryW
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceW
kernel32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateDirectoryW
kernel32.dll::CreateFileW
kernel32.dll::DeleteFileW
kernel32.dll::GetWindowsDirectoryW
kernel32.dll::GetFileAttributesW
kernel32.dll::FindFirstFileW
WIN_BASE_USER_APIRetrieves Account Informationadvapi32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExW
advapi32.dll::RegQueryValueExW
WIN_USER_APIPerforms GUI Actionsuser32.dll::PeekMessageW
user32.dll::CreateWindowExW

Comments