Gridinsoft Logo
File Icon

The Pure.exe (PureVPN) File Analysis

Updated 2 months ago
Checked by Malaware Check
Pure.exe

Technical Analysis

File Name Pure.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
SSDEEP Hash
24576:yWItda2CcikcO60RNZCeg8+47xOC9HDSaRB9Xd3gtAEjogTGaNe6YD1Pjgu3:yrEy6QhACr3g3ZVE6YD1LgC
Scanner Version 1.0.211.174
Database Version 2025-03-29 00:01:19 UTC
⚠

Suspicious File Detected

Detected by 32 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

Vidar is an information stealer that targets both personal data and cryptocurrency assets. It operates through keylogging, data extraction, and cryptocurrency wallet targeting. The malware silently collects valuable information and can access digital wallets to transfer cryptocurrency to attacker-controlled accounts.
44%
Detection Rate
1,741,816
File Size (bytes)
32/73
Engines Detected
2025-03-29
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
4101231618d67e4f37b421996a7a06bb
SHA1
3e1ac01e383efcdf38c084b1e342bef918a61e56
SHA256
d177b9af0c4bb903c4c6ef4ecd1b2fbffcfe3d55a62fba6d8869013f0b147255
SHA512
5b7d262245e7b81534b3541fa1f53a0113e68241a1309a7fb7d58fca402be94fe165a95c809f430654467b77c23bdebfd8f9adcc5cac4e060d72c3338433b9db
ImpHash
c7269d59926fa4252270f407e4dab043

Security Engines with Detections (32 of 73)

Bkav
W32.AIDetectMalware Malicious
Lionic
Trojan.Win32.Vidar.i!c Malicious
AVG
Win32:Malware-gen Malicious
Elastic
malicious (high confidence) Malicious
Skyhigh
Artemis!Trojan Malicious
McAfee
Artemis!4101231618D6 Malicious
Malwarebytes
Malware.AI.4186416883 Malicious
Sangfor
Trojan.Win32.Save.a Malicious
K7GW
Trojan ( 005c47fe1 ) Malicious
CrowdStrike
win/malicious_confidence_60% (W) Malicious
huorong
HVM:Trojan/Injector.gen!E Malicious
Symantec
ML.Attribute.HighConfidence Malicious
ESET-NOD32
a variant of WinGo/Kryptik.GI Malicious
Cynet
Malicious (score: 99) Malicious
Kaspersky
Trojan-PSW.Win32.Vidar.dnu Malicious
Avast
Win32:Malware-gen Malicious
F-Secure
Trojan.TR/AVI.Agent.iahmn Malicious
McAfeeD
ti!D177B9AF0C4B Malicious
Trapmine
malicious.moderate.ml.score Malicious
CTX
exe.trojan.kryptik Malicious
Sophos
Mal/Generic-S Malicious
Ikarus
Trojan-Dropper.WinGo.Agent Malicious
Avira
TR/AVI.Agent.iahmn Malicious
Fortinet
W32/Kryptik.GI!tr Malicious
Microsoft
Trojan:Win32/Wacatac.B!ml Malicious
Google
Detected Malicious
VBA32
TrojanPSW.Vidar Malicious
Cylance
Unsafe Malicious
Panda
Trj/Chgt.AD Malicious
GData
Win32.Trojan-Stealer.Vidar.L70OK4 Malicious
DeepInstinct
MALICIOUS Malicious
alibabacloud
Trojan:Multi/Kryptik.GL Malicious
41 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 76686d7574bf0c93df765ef392d25ff6
Fuzzy: d210a09791de860c48bb192cec99f82e
dHash: 30f0e0f0f0804888
Image Base 0x00400000
Entry Point 0x00459670
Compilation Time 1970-01-01 00:00:00
Checksum 0x001b91d4 (Actual: 0x001b91d4)
OS Version 6.1
PEiD Signatures PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Digital Signature The expected hash does not match the digest in SpcInfo
Imports 1 libraries
kernel32
Exports 0 functions
Resources 10 Resources
Sections 7 Sections

Version Information

▼
CompanyName
FileDescription PureVPN
FileVersion 14.8.0.0
InternalName setup
LegalCopyright Copyright (c). All rights reserved.
OriginalFilename purevpn_setup.exe
ProductName PureVPN
ProductVersion 14.8.0.0
Translation 0x0409 0x04e4

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 622,402 bytes 622,592 bytes 6.14 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ FE4329023881C721C12F2CD6652A10FC
.rdata 0x00099000 840,628 bytes 840,704 bytes 6.37 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ FF4C862B37E0F144952E07ACE3CDD88E
.data 0x00167000 257,400 bytes 81,408 bytes 5.29 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE F343978260DC3A1BBF58F4FC10A6F118
.idata 0x001a6000 1,000 bytes 1,024 bytes 4.65 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE FF2C560E1C761F1AE7A1BB3422744EFA
.reloc 0x001a7000 51,168 bytes 51,200 bytes 6.53 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 63C7524116D6F1347226CA2C41C62F7C
.symtab 0x001b4000 4 bytes 512 bytes 0.02 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 07B5472D347D42780469FB2654B7FC54
.rsrc 0x001b5000 132,838 bytes 133,120 bytes 5.26 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E9E3BEDA0FDB74ACF6190CADA728F049
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 10 (132,219 bytes)
Resource Type Count Total Size Percentage
RT_ICON 6 119,895 bytes
90.7%
RT_MESSAGETABLE 1 10,304 bytes
7.8%
RT_GROUP_ICON 1 90 bytes
0.1%
RT_VERSION 1 696 bytes
0.5%
RT_MANIFEST 1 1,234 bytes
0.9%

Certificate Chain Analysis

▼
Certificate Information
Product PureVPN
Description PureVPN
File Version 14.8.0.0
Original Name purevpn_setup.exe
Signing Date 08:49 PM 03/06/2025 (92 days ago)
Verification Status The digital signature of the object did not verify.
Signers GZ Systems Limited; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert
Counter Signers DigiCert Timestamp 2024; DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA; DigiCert Trusted Root G4; DigiCert
Internal Name setup
Copyright Copyright (c). All rights reserved.
Certificate Chain Summary
DigiCert Trusted Root G4 #1 Primary
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #2 Chain
Validity Period: 2022-03-23 00:00:00 → 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 #3 Chain
Validity Period: 2021-04-29 00:00:00 → 2036-04-28 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 08 AD 40 B2 60 D2 9C 4C 9F 5E CD A9 BD 93 AE D9
DigiCert Timestamp 2024 #4 Chain
Validity Period: 2024-09-26 00:00:00 → 2035-11-25 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 0B AE 66 BC 5A BA 7F 95 87 C6 F9 E9 04 E3 33 04
GZ Systems Limited #5 Chain
Validity Period: 2024-09-23 00:00:00 → 2025-09-21 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 03 B4 96 6F F1 12 2C FF FC EA 38 79 2F C8 16 1C

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
32 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware