poullight | 70236db972081f891c2f239e67e7924bae492ddc5fe5073c838eab0a730413b2 | Triage

Sharing

General

Target

70236db972081f891c2f239e67e7924bae492ddc5fe5073c838eab0a730413b2
Size

92KB
MD5

afd0fd73b658168e31480fa3f0fef267
SHA1

a2579217dd963ac5a5d474bac08085c632124cfe
SHA256

70236db972081f891c2f239e67e7924bae492ddc5fe5073c838eab0a730413b2
SHA512

d773200722ce9f3cd2fa15dfca5d18368b3df6d2cb70a62e8d4f251a1228b253fdf2ecaeb457c1a7192e328686ee385c55246ebc48fed68231c518602c689c4a
SSDEEP

1536:7cGDF4pwt9RRnllg3VsH/KPqRwmcUet/s7wOHUN4ZKBvfdcPJvh90:IGDARVsH/KPq6mDELO0Ogw0

Score

10^/10

poullight

Malware Config

Signatures

Poullight Stealer Payload 1 IoCs

resource	yara_rule
sample	family_poullight

Poullight family
poullight

Files

70236db972081f891c2f239e67e7924bae492ddc5fe5073c838eab0a730413b2
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ