MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1cd9e489da7d5a543a219458d60fae774c3c7771a2d60bbe3a6217bbf8fbe626. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
PureLogsStealer
Vendor detections: 7
| SHA256 hash: | 1cd9e489da7d5a543a219458d60fae774c3c7771a2d60bbe3a6217bbf8fbe626 |
|---|---|
| SHA3-384 hash: | 2c439c50fad20699daa6d3160f6b0c86154af48b07174c9b4182745475bd0608e26aeb958d13de19aae8241ea20d4d95 |
| SHA1 hash: | 4d8b035279dd2b565c457d2cf09911b653642a54 |
| MD5 hash: | 7e49bac468548a0e83133f0d5b02544b |
| humanhash: | alabama-sweet-quiet-earth |
| File name: | PO-O129867-0721_Issued.pdf.txz.rar |
| Download: | download sample |
| Signature | PureLogsStealer |
| File size: | 371'653 bytes |
| First seen: | 2026-07-24 12:44:57 UTC |
| Last seen: | 2026-07-24 12:47:36 UTC |
| File type: | rar |
| MIME type: | application/x-rar |
| ssdeep | 6144:73jn0SN5o2WYCqhGe9ILbcAFMn/bxibxrEyzdrXBVWFKJP9/y7TFY2exxH1eNA:jr5NrJeI8QAmnjxibX57WwJxyO2exx0m |
| TLSH | T1B5842319D06CE192253A4F1DBF24DF9BF7259F583EBDC61904C89E160FACF34021A999 |
| TrID | 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1) |
| Magika | rar |
| Reporter |  TomU |
| Tags: | PureLogsStealer rar |
Intelligence
File Origin
# of uploads :
3
# of downloads :
60
Origin country :
CHFile Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | PO-O129867-0721_Issued.js |
|---|---|
| File size: | 1'558'650 bytes |
| SHA256 hash: | 0826368434cbe294a9dd842f70a0f7e25367d0319179ca9bc9d7f13fb74ab9d1 |
| MD5 hash: | 4b3a16ad9e1e502aae805211f2bd25a7 |
| MIME type: | text/plain |
| Signature | PureLogsStealer |
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
cmd conhost downloader expand lolbin powershell repaired
Verdict:
Malicious
File Type:
rar
First seen:
2026-07-23T07:11:00Z UTC
Last seen:
2026-07-26T06:54:00Z UTC
Hits:
~10
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Rar Archive
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2026-07-22 14:01:23 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
11 of 24 (45.83%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
collection discovery execution persistence
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Executes a command shell one-liner
System Time Discovery
Accesses Microsoft Outlook profiles
Checks computer location settings
Registers new Windows logon scripts automatically executed at logon.
Badlisted process makes network request
Downloads MZ/PE file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
PureLogsStealer
rar 1cd9e489da7d5a543a219458d60fae774c3c7771a2d60bbe3a6217bbf8fbe626
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.