analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Vidar Binary

Full analysis: https://app.any.run/tasks/b3eac3fa-4de0-44e5-a966-bc38cec08e66
Verdict: Malicious activity
Threats:

Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.

Analysis date: January 23, 2019, 02:11:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
evasion
trojan
stealer
arkei
vidar
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2279E17D60F5530259F2A7579A40318D

SHA1:

4423ACFD7062260B22CF0D8ED15F8A91AC735EA2

SHA256:

E99DAF10E6CB98E93F82DBE344E6D6B483B9073E80B128C163034F68DE63BE33

SSDEEP:

12288:fkXIUl7ZCjz1LYyd17QLmSEjZG6EuP3XSB9tpxg:f7Ul7ZCH2wpfP06Eu/8I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Actions looks like stealing of personal data

      • Vidar Binary.exe (PID: 3480)
    • Stealing of credential data

      • Vidar Binary.exe (PID: 3480)
    • ARKEI was detected

      • Vidar Binary.exe (PID: 3480)
  • SUSPICIOUS

    • Creates files in the user directory

      • Vidar Binary.exe (PID: 3480)
    • Checks for external IP

      • Vidar Binary.exe (PID: 3480)
    • Creates files in the program directory

      • Vidar Binary.exe (PID: 3480)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

ProductVersion: 3.5.70.3
CompanyName: Spencer Kimball, Peter Mattis and the GIMP Development Team
ProductName: Transfrmed
FileDescription: Delighters Simulations Retrieve
InternalName: Transfrmed
LegalCopyright: Copyright ©Spencer Kimball, Peter Mattis and the GIMP Development Team 2000 - 2014 KG and its Licensors
PrivateBuild: 3.5.70.3
Comments: Delighters Simulations Retrieve
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 3.5.70.3
FileVersionNumber: 3.5.70.3
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x13272
UninitializedDataSize: -
InitializedDataSize: 516096
CodeSize: 147456
LinkerVersion: 9
PEType: PE32
TimeStamp: 2018:12:28 18:29:49+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 28-Dec-2018 17:29:49
Detected languages:
  • English - United States
Comments: Delighters Simulations Retrieve
PrivateBuild: 3.5.70.3
LegalCopyright: Copyright ©Spencer Kimball, Peter Mattis and the GIMP Development Team 2000 - 2014 KG and its Licensors
InternalName: Transfrmed
FileDescription: Delighters Simulations Retrieve
ProductName: Transfrmed
CompanyName: Spencer Kimball, Peter Mattis and the GIMP Development Team
ProductVersion: 3.5.70.3

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 28-Dec-2018 17:29:49
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00023FD0
0x00024000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62797
.rdata
0x00025000
0x00008A88
0x00008C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.00543
.data
0x0002E000
0x00005304
0x00003400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.25124
.rsrc
0x00034000
0x0006E430
0x0006E600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.71956
.reloc
0x000A3000
0x00003850
0x00003A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.84628

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.2454
1233
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.26897
19496
Latin 1 / Western European
English - United States
RT_ICON
3
5.44447
9640
Latin 1 / Western European
English - United States
RT_ICON
4
5.07236
4264
Latin 1 / Western European
English - United States
RT_ICON
5
5.17761
1128
Latin 1 / Western European
English - United States
RT_ICON
6
2.90866
296
Latin 1 / Western European
English - United States
RT_ICON
7
3.00288
744
Latin 1 / Western European
English - United States
RT_ICON
9
0.545897
36
Latin 1 / Western European
English - United States
RT_STRING
100
3.32378
238
Latin 1 / Western European
English - United States
RT_DIALOG
101
2.76249
76
Latin 1 / Western European
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
AVIFIL32.dll
COMCTL32.dll
COMDLG32.dll
GDI32.dll
IMM32.dll
IPHLPAPI.DLL
KERNEL32.dll
MSVFW32.dll
NETAPI32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ARKEI vidar binary.exe explorer.exe no specs mmc.exe no specs mmc.exe

Process information

PID
CMD
Path
Indicators
Parent process
3480"C:\Users\admin\AppData\Local\Temp\Vidar Binary.exe" C:\Users\admin\AppData\Local\Temp\Vidar Binary.exe
explorer.exe
User:
admin
Company:
Spencer Kimball, Peter Mattis and the GIMP Development Team
Integrity Level:
MEDIUM
Description:
Delighters Simulations Retrieve
928"C:\Windows\explorer.exe" C:\Windows\explorer.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3640"C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc" /sC:\Windows\system32\mmc.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Management Console
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1940"C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc" /sC:\Windows\system32\mmc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
172
Read events
143
Write events
28
Delete events
1

Modification events

(PID) Process:(3480) Vidar Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Vidar Binary_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3480) Vidar Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Vidar Binary_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3480) Vidar Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Vidar Binary_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3480) Vidar Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Vidar Binary_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3480) Vidar Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Vidar Binary_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3480) Vidar Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Vidar Binary_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3480) Vidar Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Vidar Binary_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3480) Vidar Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Vidar Binary_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3480) Vidar Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Vidar Binary_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3480) Vidar Binary.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Vidar Binary_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
0
Suspicious files
1
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
3480Vidar Binary.exeC:\ProgramData\WJAUQKSZG87YG1ZX6Y7R\NL_90059c37-1320-41a4-b58d-2b75a9850d2f6392352522.zipcompressed
MD5:ED34D6AC9597A333DB42BFA555BE8177
SHA256:0E9F09BF1C2B3FFEB29D851D807BC895512EB230E1EACE14630D21B9BAD8BFF4
3480Vidar Binary.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\line[1].txttext
MD5:B2C39995337D3B0A6EEEDAE22C201018
SHA256:23F98DA9B5858E0EAD7521F0527C2822548762BE0DA34001DEFDD0DD948C8F6B
3480Vidar Binary.exeC:\ProgramData\WJAUQKSZG87YG1ZX6Y7R\files\information.txttext
MD5:A33779B015B2F92641D081FEF155EF93
SHA256:43FC6729C47FD1ACAE98BCD99EAF04E6876E004A8B36437683A1AD0AF7688371
3480Vidar Binary.exeC:\ProgramData\WJAUQKSZG87YG1ZX6Y7R\files\outlook.txttext
MD5:F518826079574033D69D81A1C654BA00
SHA256:1479325CED628E87517746CF501E344D1FA2FF10A67FD8F0B4863236BEDB0C3A
3480Vidar Binary.exeC:\ProgramData\WJAUQKSZG87YG1ZX6Y7R\ldsqlite
MD5:01A1EE033F117197D52DC1CA978AD16B
SHA256:6D4BABAEBEA2F5450BD4BBE07E43C7E84A67E78F8B508CF2731A45A1EC5F9E2E
3480Vidar Binary.exeC:\ProgramData\WJAUQKSZG87YG1ZX6Y7R\files\passwords.txttext
MD5:E0EE1892004A327AE8878494352A35E6
SHA256:E1B782EB670A6D8ED01FEB9CD9DDEF9AE20569B72A1E33E078906D07627F7850
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3480
Vidar Binary.exe
POST
200
185.194.141.58:80
http://ip-api.com/line/
DE
text
171 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3480
Vidar Binary.exe
185.194.141.58:80
ip-api.com
netcup GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
kolobkoproms.ug
malicious
ip-api.com
  • 185.194.141.58
shared

Threats

PID
Process
Class
Message
3480
Vidar Binary.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3480
Vidar Binary.exe
A Network Trojan was detected
MALWARE [PTsecurity] Generic.PWS.Arkei Stealers Header (Vidar)
1 ETPRO signatures available at the full report
No debug info