purble_place.zip
- SHA256 a5890e0ca5913af5a558afda35fcc5cfe8a2a31b6694059d110b8114050425c2
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Purble Place.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Purble Place.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Vista.Emulation.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Vista.Emulation.dll
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
General
- Target purble_place.zip
- Size 58.8MB
- Sample260417-1ext9acs6s
- SHA256 a5890e0ca5913af5a558afda35fcc5cfe8a2a31b6694059d110b8114050425c2
- MD5 e872665a833f807e81633c278191753a
- SHA1 5e59a2712aeebf2fbd973f74015082a7096abe9c
- SHA512 04bb7cc61a13b9cfc1f73535709a77924a4cd76ad591b42264d50d45f2b246dfd616f61ed33797fb9e2c1de3b23d4ef17dbad60eae3fdffa0e589935d6383a5d
- SSDEEP 1572864:px6U+g/ByUyKIj4ig3YI/TX8MfHWq61IAA2rsSMuN5EPhvFFuV82Y:pxH+g5yUyKIjwz/TMMf+1IT2ic5klFRb
- TLSH T144D7333978F03BC574B24F2691E7AA318096E598B391D2C5F55C2F10CAB738924BA377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Purble Place.exe unpack001/Vista.Emulation.dll
File Explorer
-
purble_place.zip.zip 58.8MB
-
Purble Place.exe.exe 59.1MB
-
Vista.Emulation.dll.dll 60KB
-
readme.txt104B
Purble Place.exe
- IMPHASH a6d1f237a38b6e7d3a48b606fa0d7939
- SHA256 c0d94c0006a0eaef4426c9e36fae15f41cac3f00d9454a8286b5840af18e77ed
- MD5 e1ccd2c89fd644d4f3ad8c84d16fc2ae
- SHA1 0cd1ffd4d4ac3c90c887f30ff4e87bda617680c2
- SHA512 eee7db4d0e3907a4eee77d32b05d964cd7fb5ced5a4146f326cca1f609e68804b15f95ff0e3288a6ea75ac2ec1e1feda6301087455cab6e837e86126d8fc7bca
- SSDEEP 1572864:DYuymd7IOwIWT4XGfaOvhBgOTvYgq1o+O8z4yeYF7W/PPFTwVg46:DtymtIOwIWTVvvhyOTs1oX82o7g3Ft46
- TLSH T148D7332B64661780F5710B30C8A6753380E5BD08B996E6EAFEDC3E4145BB3D9A07E335
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
SetFileSecurityA
SetFileSecurityW
kernel32
CloseHandle
CompareStringA
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
DosDateTimeToFileTime
ExitProcess
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindResourceA
FreeLibrary
GetCPInfo
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetDateFormatA
GetFileAttributesA
GetFileAttributesW
GetFileType
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetNumberFormatA
GetProcAddress
GetProcessHeap
GetStdHandle
GetTempPathA
GetTickCount
GetTimeFormatA
GetVersionExA
GlobalAlloc
HeapAlloc
HeapFree
HeapReAlloc
IsDBCSLeadByte
LoadLibraryA
LocalFileTimeToFileTime
MoveFileA
MoveFileExA
MultiByteToWideChar
ReadFile
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
Sleep
SystemTimeToFileTime
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpiA
lstrlenA
comctl32
ord17
comdlg32
CommDlgExtendedError
GetOpenFileNameA
gdi32
DeleteObject
shell32
SHBrowseForFolderA
SHChangeNotify
SHFileOperationA
SHGetFileInfoA
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
user32
CharToOemBuffA
CharUpperA
CopyRect
CreateWindowExA
DefWindowProcA
DestroyIcon
DestroyWindow
DialogBoxParamA
DispatchMessageA
EnableWindow
EndDialog
FindWindowExA
GetClassNameA
GetClientRect
GetDlgItem
GetDlgItemTextA
GetMessageA
GetParent
GetSysColor
GetSystemMetrics
GetWindow
GetWindowLongA
GetWindowRect
GetWindowTextA
IsWindow
IsWindowVisible
LoadBitmapA
LoadCursorA
LoadIconA
LoadStringA
MapWindowPoints
MessageBoxA
OemToCharA
OemToCharBuffA
PeekMessageA
PostMessageA
RegisterClassExA
SendDlgItemMessageA
SendMessageA
SetDlgItemTextA
SetFocus
SetMenu
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
TranslateMessage
UpdateWindow
WaitForInputIdle
wsprintfA
wvsprintfA
ole32
CLSIDFromString
CoCreateInstance
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
Name
.text
Size
73KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
379KB
Virtual Size
378KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Vista.Emulation.dll
- IMPHASH fed37d93adf623512a3e191f2a9e389a
- SHA256 ab99feb022a466a13a38fe4088bc62b7fd3a74d50ed3a248c95f37bb57926794
- MD5 1133991dd82f774a7abb842bd67e7cb8
- SHA1 35b0e6cd294ea193e10b8a24fa567dcf9b86875a
- SHA512 cdfb11b5cafc7581ea8aebb0d01454f6ff363c8a7071cf910d76de88eda36e86e3f151be2074e2cc2f1ef8af8b66ffeafe1ce338aa3bf61e942618003111faff
- SSDEEP 768:m09sixfrV5jq1qJQwHFNcX8qVU5M/5xG06EndOjaOhizloRLyWLXb:d9suZ2wHFNcMli/5x96C8JWlMyWLX
- TLSH T157536C113262D0B2D09B477D34859B15AB7FF8156BF085836FB61B4DAE323E0BA36306
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7674
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\Documents and Settings\Administrator\My Documents\Visual Studio Projects\VistaEmulation\build\VistaEmulation.pdb
shlwapi
PathAppendA
PathIsDirectoryA
kernel32
GetModuleFileNameA
CompareStringW
CompareStringA
GetCurrentDirectoryA
CreateDirectoryA
FlushFileBuffers
HeapSize
LCMapStringW
GetLastError
MultiByteToWideChar
HeapFree
WideCharToMultiByte
HeapAlloc
ExitProcess
CloseHandle
GetFileType
CreateFileA
GetCurrentThreadId
GetCommandLineA
GetVersionExA
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEnvironmentVariableA
GetTimeZoneInformation
SetEndOfFile
ReadFile
SetFilePointer
SetHandleCount
GetStdHandle
GetStartupInfoA
SetStdHandle
TerminateProcess
GetCurrentProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
GetCPInfo
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
RtlUnwind
GetACP
GetOEMCP
InitializeCriticalSection
InterlockedExchange
VirtualQuery
LoadLibraryA
CreateFileW
VirtualProtect
GetSystemInfo
LCMapStringA
shell32
SHGetFolderPathA
ole32
StringFromGUID2
SHGetFolderPathEx
_localtime64_s
_sopen_s
_wfopen_s
mbstowcs_s
wcstombs_s
Name
.text
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=94, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=4, id=93, version=2179,
count=5, id=25, version=9210,
count=85, id=1, productName=Unmarked objects,
count=3, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
readme.txt
- SHA256 09d0814ef5b33c87a8e5dc1df1e029b16fd30c125d3b1b37c594288884efdf7f
- MD5 338bf3dafa96b7f7875d97244e1c4fd9
- SHA1 457acb82f70220b04e2abe9ba60113c305a470f8
- SHA512 6a9d848eb3f0afcdc29044c880fb592b0543ed33549bce57837d3696e3a433df4e34b984c0fef99dce02f6d70b3b0eecb9fde52d16a475e877f1d7ddbc5f8cd7
- TLSH T1BFB012626E2C0775075D0E1E24078C80257C3E053C51344DC5C40499B5445C01315C72
- MD5 SHA1 SHA512 TLSH