Malicious
Malicious

b4d4f56d3486760811cf4245694c0d75

PE Executable
MD5: b4d4f56d3486760811cf4245694c0d75
Size: 3.8 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Size
3.8 MB · 3,800,360 B
First seen
2026-08-12 03:16 · 2 months ago
Last seen
2026-08-12 03:16 · 2 months ago
Last analysis
2026-09-03 21:26 · one month ago
Hashes
MD5 b4d4f56d3486760811cf4245694c0d75 Sha1 a94586156298e2f782952123ce7ae69b2bf65045 Sha256 2f0d97741d4e6c74812d3d60fcbaef53bd4464a5f50e46efc742398f9f259569 Sha384 f9ef3716b66fdfb8162a334a04cfc8da36f6bea24005d3cdc44c15193f273fa0b298013402585dd5984cbb583460861d Sha512 758c64c4a70054203b1171f0078c25a9a37cb37c5fe6a48b2bcb1673a50ef11b325b7c8a27d8b89732b259fc2f150e31a397a1f939b92bb00ebf0e38e5eb2233 SSDeep 49152:hXcZ+H6SOguD6E2c2grF4OSmX9Vb6NZNEfXBKFGr68BXVnt2Xsefx:hXtM4er7X9s7NUBKFGmuXr2fx TLSH 5C069D0BBE945864C09A933168B602997B7EBC1D4F3637D72E40B67A2E727C18E35F44
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLL
1 malicious · 2 files
EXEb4d4f56d3486760811cf4245694c0d75Vidar Stealer
Structure
P7B[Authenticode]_18bc006b.p7b
BIN(folder)
BIN4
BIN19
BIN31
BIN45
BIN57
BIN70
BIN81
BIN92
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:dll~T1027~T1055>bin
Shape pe:dll>bin
malicious 2 nodes
Name Value
Info
Authenticode present at 0x39F3C8 size 2400 bytes
1 malicious · 2 files
EXEb4d4f56d3486760811cf4245694c0d75Vidar Stealer
Structure
P7B[Authenticode]_18bc006b.p7b
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙