Malicious
Malicious

d1036630fc41ebc68659bb775a93206a

PE Executable
MD5: d1036630fc41ebc68659bb775a93206a
Size: 4.97 MB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 4.7 MB PE Executable identified by Malva.RE as Vidar Stealer. Static analysis extracted 1 embedded or derived file. It matches 1 YARA rule. Observed behaviours map to MITRE ATT&CK T1027 and T1055. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9c56c37f2756e500078c24bfe3a4e2d508c4b02bccb31382a690e7a5c36d121b
MD5
d1036630fc41ebc68659bb775a93206a
Verdict
Malicious
File type
PE Executable · 4.7 MB
Family
Vidar Stealer
MITRE ATT&CK
T1027T1055

Cite this report: https://app.malva.re/sha256/9c56c37f2756e500078c24bfe3a4e2d508c4b02bccb31382a690e7a5c36d121b

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
4.97 MB · 4,965,744 B
First seen
2026-08-11 21:01 · 2 months ago
Last seen
2026-08-11 21:01 · 2 months ago
Last analysis
2026-09-03 21:34 · one month ago
Hashes
MD5 d1036630fc41ebc68659bb775a93206a Sha1 8f9191507d4690f15ba2471e51b766b356cef9d0 Sha256 9c56c37f2756e500078c24bfe3a4e2d508c4b02bccb31382a690e7a5c36d121b Sha384 b3e7d808ac769b1c9a4c2fe3537b1454135e7bd9014555780f4bb2b9dd377312a4e53882b9c3883fac37202939716156 Sha512 2ea37fe9359727acd85f01179290b7a8263b3d14ddbfc16207006ef8eb3216170c1ae3185f586eafb7e5b0bc0e678904d844005f3594fb063165fcd246ea685b SSDeep 49152:E6Laqa9JYpcBJT5xHlaEHrs/UEfLgTGGhkZJ3+0yOdImcVmANQ0ZH8Rok/t:EoOlHLc7TgTGGKZJO0yOdNchNQ4H8Rom TLSH F5365A176E9148F6C0A9E735C4BB4259B674BC4D8B3523D32E616EB82F323C1AE76740
Detection
PeID
HQR data fileMicrosoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamtElock 1.0 (private) -> tE!tElock 1.0 (private) -> tE!

1 malicious · 2 files
EXEd1036630fc41ebc68659bb775a93206aVidar Stealer
Structure
P7B[Authenticode]_4a4a5ec5.p7b
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe~T1027~T1055>bin
Shape pe:exe>bin
malicious 2 nodes

Name Value
Info
Authenticode present at 0x4BBC00 size 2416 bytes

1 malicious · 2 files
EXEd1036630fc41ebc68659bb775a93206aVidar Stealer
Structure
P7B[Authenticode]_4a4a5ec5.p7b
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙