home

PURETEXT.EXE

PureText

http://www.SteveMiller.net

It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘PureText’. The file has been seen being downloaded from cl3c0.pogoplug.com and multiple other hosts.
Publisher:
http://www.SteveMiller.net

Product:
PureText

Description:
PureText for Win32 (x86)

Version:
2.0

MD5:
89fe09ee406cd66e529b004076623fe3

SHA-1:
ca6652d26592d21d52b2d1a9ab1e3e9148dd027f

SHA-256:
eadb7562b63f846abacf62e94ee591a42db6f9228cf80afabe70dc6ded7e18fc

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/27/2024 2:41:32 PM UTC  (today)

File size:
28 KB (28,672 bytes)

Product version:
2.0

Copyright:
Copyright (C) 2003

Original file name:
PURETEXT.EXE

File type:
Executable application (Win32 EXE)

Language:
English (United States)

File PE Metadata
Compilation timestamp:
8/22/2003 6:05:06 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
384:9dE6xFhah9dytoE2nn4p7Onuh4q0TYk2ndBbK+6b2XenfLt9x+DoE7:9DxFha3dTZn4wA42d02XefhaDx

Entry address:
0x30B0

Entry point:
83, EC, 1C, E8, 48, DF, FF, FF, 84, C0, 74, 08, 33, C0, 83, C4, 1C, C2, 10, 00, 55, 6A, 00, FF, 15, 64, 40, 40, 00, A3, 90, 60, 40, 00, A0, 94, 60, 40, 00, 33, ED, 84, C0, 75, 30, 68, 58, 50, 40, 00, 6A, 01, 55, FF, 15, 38, 40, 40, 00, 8B, E8, FF, 15, 3C, 40, 40, 00, 3D, B7, 00, 00, 00, 75, 13, 55, FF, 15, 40, 40, 40, 00, B8, 01, 00, 00, 00, 5D, 83, C4, 1C, C2, 10, 00, A1, 90, 60, 40, 00, 6A, 00, 50, 6A, 00, 6A, 00, 6A, 00, 6A, 00, 6A, 00, 6A, 00, 68, 04, 00, 30, 00, 6A, 00, 68, 4C, 50, 40, 00, 6A, 00, FF...
 
[+]

Entropy:
5.2903

Code size:
9 KB (9,216 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
PureText

Command:
"C:\users\{user}\documents\puretext.exe"


User Start Menu Item
Name:
puretext.exe


The file PURETEXT.EXE has been discovered within the following programs.

askSam 7  by askSam Systems
Publisher's description - “askSam 7 is here and it’s never been easier to organize, search, and manage your information. askSam is a flexible and powerful way to organize information and create searchable databases from Web pages, Email, PDF files, texts, and Word documents.”
www.askSam.com
About 4% of users remove it
PureText  by HMA Repackaged
www.SteveMiller.net
About 7% of users remove it
 
Powered by Should I Remove It?

The file PURETEXT.EXE has been seen being distributed by the following 2 URLs.

http://cl3c0.pogoplug.com/svc/files/XCLDYZU6GCAHNMNYNFR2AX8PC2/XCLDYZU6GCAHNMNYNFR2AX8PC2/T4_4L6K2kTxKtslm-k0IBQ/.../PureText.exe

https://doc-0s-a0-docsviewer.googleusercontent.com/viewer/securedownload/jb09reke6l401pk7a317i7qtee75vtjn/cea6bblp4103m79usmu0n1poco0b82en/1320616800000/dXJs/.../aHR0cDovL3d3dy5zdGV2ZW1pbGxlci5uZXQvZG93bmxvYWRzL3B1cmV0ZXh0MjBfeDg2LnppcA==?sec=AHSqidYNJdnIoV-XzKO-EEF943uM2fEThzN0kRfJDpIBlI2EaxA_rXvgZyTO-ZhUvBY0Lam1jFKehhdB_U2kkFKREspBcnxF9VbeiGGWP_cX9bc45mFPX8W12pOF-JFQ6a1mPcQZKMgLGFww-pVLn6d_JluJYyT1EKyra8W3fRlvV77RSf6kLXUj-Y3LF1fNkg_etmJetr-C6VqcFOx0i9LBGgr_Ek1tJt-jBHkfahd-xJVcwG3tVsLKpcwzVuPIpdHQvAAlf-AJggm7xGlR06x6zZzjdcDFFQFyF83mUwpB9B2MZPs917XhEwn7wMdT47olu-9o4Iy_SO69o7sqa08bBr43uw9fkQhuMQOuhzhqpMNnLmwpDHkUPboPJlg-_0svRC_YwwhOQmZ2BMwou2hfdHeB6yrTRlFjiVIcJPkceShNJYFpsV_DOysEB9iSozI3EfjOC4zod14Rlf8k90fbTzzqB3TbUt8xX1GDSMOAB11hl7hf0a22_Axg0CuqES5dI6mtNeMr8Y9DxO1hpkednci6mnZhjhoHwA9pba1X8ssvtUkwguRE45BkEUhYuBZJbRkKM6MAvtG1KJbLbHhN3HZ-XHJ2xAy3u-PDBqMFg9vQ9Yg7rD2ZwYVQH0-ZpYTzWfaF0ciGNvieTed3gIsizGw8JHvXygBjRqvV08uwWjSU9pdPTaUZx9nwi9REp7aC_cbyhxOXzeYPnl88x5KdMNWB

Scan PURETEXT.EXE - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.