Behavioral task
behavioral1
Sample
41bfcac136ff8f5d232419298ec7b6e0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
41bfcac136ff8f5d232419298ec7b6e0N.exe
Resource
win10v2004-20240709-en
General
-
Target
41bfcac136ff8f5d232419298ec7b6e0N.exe
-
Size
2.5MB
-
MD5
41bfcac136ff8f5d232419298ec7b6e0
-
SHA1
ced165b12d38356915b64a083ec6c88633572c96
-
SHA256
19c9916b59cb8573f64f15a1fa11e1704d24539cddad2559579ec4aff203c46c
-
SHA512
5f8383fe13d662500dd44565821ac5299b4aaa23e864010f451db04130ce91d2fb1ebe652887abb04be98729cdb05b1f352e39a6de1d3479b46a4194dc900e5b
-
SSDEEP
49152:R5HDi1U52tdpGLi83D26M0Mn4QpcGvM0JZ4DKYW/IVStzY4cU+rb:fHDi1U52tdbCD60wp5E0JZ/7Aoz5w
Malware Config
Signatures
-
PureLog Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_purelog_stealer -
Purelogstealer family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 41bfcac136ff8f5d232419298ec7b6e0N.exe
Files
-
41bfcac136ff8f5d232419298ec7b6e0N.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ