Behavioral task
behavioral1
Sample
Purchase Order No- 2300167.img.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Purchase Order No- 2300167.img.exe
Resource
win10v2004-20240426-en
General
-
Target
9f7bf8b26dfb6b19736a1d31cafa535bb65a651faad291dff1778c60edc7cbc9
-
Size
2.2MB
-
MD5
18cccce325ad85967630cd12fbe2c923
-
SHA1
cf7e1418603a3ccea535de5aa2762e9127626252
-
SHA256
9f7bf8b26dfb6b19736a1d31cafa535bb65a651faad291dff1778c60edc7cbc9
-
SHA512
05a41cca412fff83b5bacb32decb33e79830081908d4456f4c2aaea295fdb48004cd25bd0f7a60bc941570084cff6b9c1edb8e439a0dc305c929755ec01fe13c
-
SSDEEP
49152:cNW6WXNGHlf8PriAL4lWNN2Va+SEr59zmgR5FVC/vipzKTy:cMvNQUPr5L4l6NqT9z/C/OzKTy
Malware Config
Signatures
-
PureLog Stealer payload 1 IoCs
resource yara_rule static1/unpack001/Purchase Order No- 2300167.img.exe family_purelog_stealer -
Purelogstealer family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Purchase Order No- 2300167.img.exe
Files
-
9f7bf8b26dfb6b19736a1d31cafa535bb65a651faad291dff1778c60edc7cbc9.zip
-
Purchase Order No- 2300167.img.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ