Malicious
Malicious

4ec20b98f01fbc117e0b2b53898583fc

PE Executable
MD5: 4ec20b98f01fbc117e0b2b53898583fc
Size: 3.8 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
3.8 MB · 3,802,824 B
First seen
2026-07-04 07:16 · 3 months ago
Last seen
2026-07-04 07:16 · 3 months ago
Last analysis
2026-09-03 21:08 · one month ago
Hashes
MD5 4ec20b98f01fbc117e0b2b53898583fc Sha1 6993ab54f381992f1ef6ec34d16c4f7f988dbf3a Sha256 f5b1bc797b8693d71954e2dbd9e077f512f23e1944c9f43fe7b860718c975b8f Sha384 94fe510cfa162c3271451c0d14fe21513bb81a98854648113f95e71048ab0f8a2e7137bd9807ddf47aeefbf5475d10c7 Sha512 87f02e93629a2b8c0039ab05192843eeab52dad974e94fe9ffe4297c56abfa9aab5fd4648c3308bf71095d7b3a9e4db80eb2af18f2e8d36a256ef6203f7beb97 SSDeep 49152:e0I8l//Zffb0shdbqTP1ftdtUgjI27XV5HR03tvqTKFsAJhn6:e0dPhtqTP1Jr/RctC+FpLn6 TLSH BA069D4BBE8058A4C09AA73664A603547B3DBC5E4F3633E72E90B6791E727C18E35F44
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLL
1 malicious · 2 files
EXE4ec20b98f01fbc117e0b2b53898583fcVidar Stealer
Structure
P7B[Authenticode]_64409076.p7b
BIN(folder)
BIN4
BIN19
BIN31
BIN45
BIN57
BIN70
BIN81
BIN92
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:dll~T1027~T1055>bin
Shape pe:dll>bin
malicious 2 nodes
Name Value
Info
Authenticode present at 0x39FD70 size 2392 bytes
1 malicious · 2 files
EXE4ec20b98f01fbc117e0b2b53898583fcVidar Stealer
Structure
P7B[Authenticode]_64409076.p7b
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙