Behavioral task
behavioral1
Sample
order.scr
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
order.scr
Resource
win10v2004-20240802-en
General
-
Target
70c946dde89d4602561f7afbf09e9b83c4d2e756d38139bb3a5c26fdfac8b401.zip
-
Size
37KB
-
MD5
113f558fa482970e95b99109a7362fce
-
SHA1
977cbd9cc57cc671d7133dc9bf5df402bfd9207c
-
SHA256
70c946dde89d4602561f7afbf09e9b83c4d2e756d38139bb3a5c26fdfac8b401
-
SHA512
55d5d3cb9f815e197a845b3881c852b62dea06f6565cef5ec865b34080e36df3c5b0fbb37d7b87a311281c4c81747255c805839b4c9be4f950e9723a38e1e001
-
SSDEEP
768:IxRUDKg8h6qBeMbgdJMcD9x3I6yVk90c3tKMuYlBF:ICh84CgdSq4S0GLuY9
Malware Config
Signatures
-
PureLog Stealer payload 1 IoCs
resource yara_rule static1/unpack001/order.scr family_purelog_stealer -
Purelogstealer family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/order.scr
Files
-
70c946dde89d4602561f7afbf09e9b83c4d2e756d38139bb3a5c26fdfac8b401.zip.zip
-
order.scr.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ