purelogstealer | 5[.]exe | Triage

Sharing

General

Target

5.exe
Size

50KB
MD5

a4ae05762502813b211f8a85ade4aaf9
SHA1

d8ccccad0ec7dd9ada63a9b7b2f318d5c2bf7345
SHA256

ff1a81ba33a6328568c2c3fa6c02d90909322624fd07c76d9fb300e56d47092a
SHA512

4ec7b4063079e418d1b7a7d4a81bf823976fb22aa3011914420cd95b1a0f7a0a7b36e3b6a2edbb5395c11c71cbf800747fc2cdaea9fa5fe0ca6df0ee59041dff
SSDEEP

768:hYkXQd1NrfaBQrpl21Ic6ehe9cy3i5j6Aw6/hnkz8IkOWHQki8T:O6Qr8QrMryp+WIhnO8jOWF

Score

10^/10

Malware Config

Signatures

PureLog Stealer payload 1 IoCs

Processes:

resource yara_rule

sample family_purelog_stealer
Purelogstealer family
purelogstealer
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

5.exe

Files

5.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ