purelogstealer | NEWXENQUIRYX042400[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEWXENQUIRYX042400.zip
Size

29KB
MD5

ae1c5c3de412e8de3efd47987c488f8e
SHA1

4709fd16f124cca8354dcb1e38ec05e9a42dcc7d
SHA256

3c5ad97151d2804bc535042bffa9d864b6b6cd4cdbe2f3c15e0736b8aec96a45
SHA512

f0ff2059bbce23622087d8d55cbe0fe907b58796cdc303f42e93e36bd2cb3faff2a361c210ddeba29c99804c96f5cde8691d0104cc3dc2dfefd766f75549f2a7
SSDEEP

768:ijjeP08bT4KmhMa0uEKAbYBRWHzSQviaJTcKZhWmCTB48:rP08bER0u1WeQ1ZV4BP

Score

10^/10

purelogstealer

Malware Config

Signatures

PureLog Stealer payload 1 IoCs

resource	yara_rule
static1/unpack002/Jkxkt.exe	family_purelog_stealer

Purelogstealer family
purelogstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Jkxkt.exe

Files

NEWXENQUIRYX042400.zip
.zip
NEW ENQUIRY 042400.img
.iso
Jkxkt.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ