> Analysis · d4b6905ef14c_

~/packetpursuit $ cat /intel/analyses/d4b6905ef14c.../report.md

typereportfamilyvidarconfidencemediumcreated2026-07-21updated2026-07-21
SHA-256: d4b6905ef14c2c13a69b31585be4a6a8e49f0918f1ef1406936b7f6f7ecc37b3

Vidar — d4b6905ef14c2c13a69b31585be4a6a8e49f0918f1ef1406936b7f6f7ecc37b3

Family: vidar Confidence: medium (OpenCTI label; no static family strings, toolchain diverges from prior Go-based sibling) Status: Static-only — CAPE skipped, no Windows guest available^[dynamic-analysis.md]

Build / RE

Toolchain: MSVC 14.41 (Visual Studio 2022 17.11+), C/C++^[pefile.txt:46]^[rabin2-info.txt:11]. Rich header shows Linker 14.00, Utc1900_C++ (33808), Utc1900_C (33808), Masm1400 (33808/33138)^[pefile.txt:RICH_FIELDS]. PE timestamp Fri May 22 21:19:22 2026^[pefile.txt:34].

Module / naming: No PDB path recovered. Build info strings absent. No Go runtime, no .NET CLR. Standard Windows C runtime with .CRT$XC* initializers^[strings.txt].

Packing / obfuscation: None external. The outer PE is a plain MSVC C++ executable. Compile-time obfuscation is minimal:

  • No UPX, no custom packer stub^[binwalk.txt]
  • .text entropy 6.45 (normal for compiled C++)^[pefile.txt:91]
  • .data entropy 7.02 (moderately high, consistent with encrypted payload)^[pefile.txt:131]
  • No .rsrc section with icon masquerade (zero .rsrc content — not even an empty manifest)

Payload placement: A 1,130,368-byte encrypted payload sits inside the .data section (RVA 0x19000, file offset 0x17E00)^[pefile.txt:119-124]. At runtime the stub copies this block into a freshly allocated RWX heap, decrypts it in-place, and calls the decrypted code as a function pointer. This is the msvc-stub-data-section-payload-loader pattern.

Anti-analysis:

  • FreeConsole() called immediately on entry to detach from console^[r2:main]
  • Two Sleep() delays with PRNG-derived durations (1500–5500 ms range) before payload allocation^[r2:main]^[r2:fcn.140004470]
  • PRNG uses a 32-bit LCG (ecx = ecx * 0x343fd + 0x269ec3) seeded from system time; the first call also checks a build-time hardcoded timestamp gate^[r2:fcn.1400044b4]
  • IsDebuggerPresent imported but not called in the traced entry path^[r2:imports]
  • No VM detection, no TLS callbacks, no anti-disassembly jumps observed statically

Certificate / signing: Unsigned. signed: false in rabin2^[rabin2-info.txt:27]. No Authenticode certificate table. No .rsrc RT_MANIFEST. Binary is stripped of symbolic names but not of section headers (stripped: false)^[rabin2-info.txt:30].

Notable static artefacts:

  • Minimal IAT: only KERNEL32.dll imports — no WinInet, WinHTTP, WS2_32, or crypt32 in the outer binary^[pefile.txt:import-table]
  • All other APIs resolved at runtime by the decrypted inner payload (inferred from the stub's FreeConsole/Sleep/VirtualAlloc only surface)
  • .data section contents at file offset 0x17E00 are high-entropy ciphertext; first bytes after copy are decrypted with a rolling 16-byte key stream^[r2:main:0x14000113c]

Deploy / ATT&CK

TTPs (inferred from static artefacts and family knowledge):

Technique ID Evidence
Data from Local System T1005 Vidar family is a browser/crypto-wallet infostealer; encrypted .data block is the payload container
Credentials from Password Stores T1555 Vidar known to harvest Chrome Login Data, Firefox logins.json, etc.
Exfiltration Over C2 Channel T1041 Inner payload expected to contain HTTP/TLS C2 logic; no hardcoded C2 in outer binary
Obfuscated Files or Information T1027 1.1 MB encrypted payload in .data; no plaintext strings in outer PE
Masquerading T1036 Filename 0126e5a2527f990118a3e437042c4db3.exe is random noise; PE ProductName / FileDescription fields are absent
Deobfuscate/Decode Files or Information T1140 Rolling XOR/ADD decryption loop at main before payload execution
VirtualAlloc RWX Staging T1055.012 `VirtualAlloc(0, 0x113600, MEM_COMMIT
FreeConsole Stealth T1564.003 Console window hidden immediately on process start^[r2:main]

Persistence: Unknown from static. Vidar historically writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Run or uses scheduled tasks; no registry strings in outer sample.

C2 / network: No hardcoded URLs, IPs, Telegram bot tokens, or Discord webhooks found in static strings. The inner payload is expected to resolve C2 at runtime after decryption.

Attribution:

  • Family: Vidar (preliminary, from OpenCTI label)^[triage.json]. No static confirmation.
  • Build cluster: This sample diverges sharply from the prior corpus Vidar sibling (3799d1f74d95), which was Go 1.25.10 with randomized module paths and stolen Authenticode. This is MSVC C++ with a plain data-section payload loader. Either (a) a distinct fork/builder using the same distribution label, or (b) the same actor switching toolchains. The .data-section payload pattern is consistent with commodity crypter/loader services rather than a bespoke build.
  • Confidence note: Medium. Static profile fits a generic MSVC stealer loader. Without dynamic detonation or decrypted payload strings, attribution rests on the OpenCTI label alone.

Summary

An MSVC 14.41 PE32+ x64 stealer loader with a 1.1 MB encrypted payload embedded in .data. Outer stub calls FreeConsole(), gates execution via a PRNG-derived Sleep() delay, allocates RWX memory, copies the ciphertext from .data, decrypts with a rolling 16-byte key stream, and transfers control to the decrypted payload. Unsigned, minimal IAT, no static C2 strings. Preliminary family label is vidar (OpenCTI), but the toolchain (MSVC C++) diverges from the prior Go-based Vidar sibling in this corpus. No dynamic data available.