purelogs | f54d769e9290f1882ae085da919f734b6ce3cc36a8b879233b07f7d4a3121e7b

General

Target
f54d769e9290f1882ae085da919f734b6ce3cc36a8b879233b07f7d4a3121e7b
Size 888KB
Sample231201-bht54adc76
SHA256 f54d769e9290f1882ae085da919f734b6ce3cc36a8b879233b07f7d4a3121e7b
MD5 4088310104f79131c438cabacf0b6edb
SHA1 815320a8404024788e1d29a3d52e17d21de8181c
SHA512 5627b97d3e80fca610300b8b9f65a49a2bc4a6e179d219ec422c60932aa26ddf6c994e485db971e1a5a9ec5f5bdeb42a55d8a75cd7d7310145d1018b228eb88e
SSDEEP 12288:ug0SHdr/2DzVbI421wLFtA+yG0+G3Lc1N9FLRlwR:ZX92zlIx1WtArG0CRF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

purelogs

Malware Config

Signatures

Detect PureLogs payload 2 IoCs

resource	yara_rule
sample	family_purelogs
static1/unpack001/Scan_20231130_085902_pdf .exe	family_purelogs

Purelogs family
purelogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Scan_20231130_085902_pdf .exe

File Explorer

f54d769e9290f1882ae085da919f734b6ce3cc36a8b879233b07f7d4a3121e7b

.iso 888KB
Scan_20231130_085902_pdf .exe

.exe 827KB

f54d769e9290f1882ae085da919f734b6ce3cc36a8b879233b07f7d4a3121e7b

SHA256 f54d769e9290f1882ae085da919f734b6ce3cc36a8b879233b07f7d4a3121e7b
MD5 4088310104f79131c438cabacf0b6edb
SHA1 815320a8404024788e1d29a3d52e17d21de8181c
SHA512 5627b97d3e80fca610300b8b9f65a49a2bc4a6e179d219ec422c60932aa26ddf6c994e485db971e1a5a9ec5f5bdeb42a55d8a75cd7d7310145d1018b228eb88e
SSDEEP 12288:ug0SHdr/2DzVbI421wLFtA+yG0+G3Lc1N9FLRlwR:ZX92zlIx1WtArG0CRF
MD5 SHA1 SHA512 SSDEEP

Detect PureLogs payload

Scan_20231130_085902_pdf .exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ecfe6f56c220473c0f1730960e907f103e893c3778155d3f675ebbce4621b61a
MD5 5388a9eda1698bab204e57054a0df83e
SHA1 9319e5125e5274a4cd75b2e239f7167da01c9a9e
SHA512 a89586e40461d913a6bad7e3499dc7c441d9db465bb331c458e02884d24ee862234398de8006bbe374e766ba0d96d970ff467c6a1bc1b8bee933547c543f2bb4
SSDEEP 12288:wg0SHdr/2DzVbI421wLFtA+yG0+G3Lc1N9FLRlwR:fX92zlIx1WtArG0CRF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect PureLogs payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

841374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

f54d769e9290f1882ae085da919f734b6ce3cc36a8b879233b07f7d4a3121e7b

Scan_20231130_085902_pdf .exe

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

f54d769e9290f1882ae085da919f734b6ce3cc36a8b879233b07f7d4a3121e7b

Scan_20231130_085902_pdf .exe

mscoree

dotnet