Malicious
Malicious

4de31170ddc61263da6cf06850ef4cc9

PE Executable
MD5: 4de31170ddc61263da6cf06850ef4cc9
Size: 148.99 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 4de31170ddc61263da6cf06850ef4cc9
Sha1 bb9dd6b3392b6f850525a05f51cf9a817c01918c
Sha256 652b4e9e70a97e6c4039975b91c79e4e763457c2cfe8b920204b6cf71ecf808f
Sha384 d0713c0855aed977b0246d2b091c5fd91cd787571a8807fa84f466cf85583219218937a38d9912c1eb5d8d856b019be6
Sha512 cd2e7921a696877e6997e2bcf831fa2a1478745c1c6934421d4eb3efa63e3068936127ea66457ce71aa66b0b7c4cf2d6d1b9ff74d28c36ced29147c22c7afa06
SSDeep 1536:hZ+dp7oepetWX83HcKvl3SGMJ8xZqAQ/Wuags5m4aOF22rUQ8dBYlPNAeG5/tq:hZ9KmDcRJ8xZqA+Wu8m4aOkoPNa5/tq
TLSH F0E34A16A5688624DAF3127A6DE76100DF33002F4324AA44FACD91CE7FB255E8537FB6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
4de31170ddc61263da6cf06850ef4cc9
Malicious
.Net Resources
Malicious
Payload.Pulse-Tweaks.exe
Malicious
.Net Resources
Malicious
Payload.Benchmarks.ps1
Payload.CHANGELOG.md
Payload.Core.ps1
Payload.Pulse.ps1
Malicious
[PowerShell Command]
Malicious
Payload.README.txt
Payload.Restore-Pulse.cmd
Malicious
[PowerShell Command]
Malicious
Payload.Restore-Pulse.ps1
Payload.Start-Pulse.cmd
Malicious
[PowerShell Command]
Malicious
Payload.Startup.ps1
Payload.Test-Core.ps1
Payload.Test-Platform.ps1
Payload.VALIDATION.txt
Payload.Window.xaml
Payload.Launcher.cs
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
Payload.Installer.cs
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 4 STICH kept: 2secondary ignored: 2
bin 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:exe>scr:ps1~T1027~T1059.001
Shape pe:exe>pe:exe>scr:ps1
malicious 3 nodes
Path pe:exe>pe:exe>scr:ps1~T1059.001
Shape pe:exe>pe:exe>scr:ps1
technique3 nodes
Name Value
Module Name
Pulse-Tweaks-Setup.exe
Full Name
Pulse-Tweaks-Setup.exe
EntryPoint
System.Int32 Setup::Main(System.String[])
Scope Name
Pulse-Tweaks-Setup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Pulse-Tweaks-Setup
Assembly Version
1.2.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
87
Main Method
System.Int32 Setup::Main(System.String[])
Main IL Instruction Count
119
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
bne.un IL_00A1: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --uninstall
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_00A1: ldarg.0
call System.String System.IO.Path::GetTempPath()
ldstr Pulse-Uninstall-
call System.Guid System.Guid::NewGuid()
stloc.1 <null>
ldloca.s V_1
ldstr N
call System.String System.Guid::ToString(System.String)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
dup <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldstr Pulse-Remove.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
ldloc.0 <null>
call System.Void System.IO.File::Copy(System.String,System.String)
ldloc.0 <null>
ldstr --remove 
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_Id()
stloc.2 <null>
ldloca.s V_2
call System.String System.Int32::ToString()
call System.String System.String::Concat(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String,System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
stloc.2 <null>
leave IL_0143: ldloc.2
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
bne.un.s IL_010F: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --remove
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_010F: ldarg.0
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
ldloca.s V_3
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brfalse.s IL_00C6: ldstr "Invalid removal parent."
ldloc.3 <null>
ldc.i4.0 <null>
bgt.s IL_00D1: nop
ldstr Invalid removal parent.
newobj System.Void System.ArgumentException::.ctor(System.String)
throw <null>
nop <null>
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetProcessById(System.Int32)
stloc.s V_4
ldloc.s V_4
ldc.i4 10000
callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32)
brtrue.s IL_00F3: leave.s IL_0101
ldstr The original uninstaller is still open. Close it and try again.
newobj System.Void System.IO.IOException::.ctor(System.String)
throw <null>
leave.s IL_0101: leave.s IL_0106
ldloc.s V_4
brfalse.s IL_0100: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0106: call System.Void Setup::Remove()
pop <null>
leave.s IL_0106: call System.Void Setup::Remove()
call System.Void Setup::Remove()
ldc.i4.0 <null>
stloc.2 <null>
leave.s IL_0143: ldloc.2
ldarg.0 <null>
ldlen <null>
brfalse.s IL_011E: newobj System.Void SetupForm::.ctor()
ldstr Unknown setup option.
newobj System.Void System.ArgumentException::.ctor(System.String)
throw <null>
newobj System.Void SetupForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldc.i4.0 <null>
stloc.2 <null>
leave.s IL_0143: ldloc.2
callvirt System.String System.Exception::get_Message()
ldstr Pulse Setup
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldc.i4.1 <null>
stloc.2 <null>
leave.s IL_0143: ldloc.2
ldloc.2 <null>
ret <null>
Info
PE Detect: PeReader OK (file layout)
Module Name
Pulse-Tweaks-Setup.exe
Full Name
Pulse-Tweaks-Setup.exe
EntryPoint
System.Int32 Setup::Main(System.String[])
Scope Name
Pulse-Tweaks-Setup.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Pulse-Tweaks-Setup
Assembly Version
1.2.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
87
Main Method
System.Int32 Setup::Main(System.String[])
Main IL Instruction Count
119
Main IL 
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.1 <null>
bne.un IL_00A1: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --uninstall
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_00A1: ldarg.0
call System.String System.IO.Path::GetTempPath()
ldstr Pulse-Uninstall-
call System.Guid System.Guid::NewGuid()
stloc.1 <null>
ldloca.s V_1
ldstr N
call System.String System.Guid::ToString(System.String)
call System.String System.String::Concat(System.String,System.String)
call System.String System.IO.Path::Combine(System.String,System.String)
dup <null>
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldstr Pulse-Remove.exe
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.0 <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
ldloc.0 <null>
call System.Void System.IO.File::Copy(System.String,System.String)
ldloc.0 <null>
ldstr --remove 
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_Id()
stloc.2 <null>
ldloca.s V_2
call System.String System.Int32::ToString()
call System.String System.String::Concat(System.String,System.String)
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String,System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
stloc.2 <null>
leave IL_0143: ldloc.2
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
bne.un.s IL_010F: ldarg.0
ldarg.0 <null>
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --remove
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_010F: ldarg.0
ldarg.0 <null>
ldc.i4.1 <null>
ldelem.ref <null>
ldloca.s V_3
call System.Boolean System.Int32::TryParse(System.String,System.Int32&)
brfalse.s IL_00C6: ldstr "Invalid removal parent."
ldloc.3 <null>
ldc.i4.0 <null>
bgt.s IL_00D1: nop
ldstr Invalid removal parent.
newobj System.Void System.ArgumentException::.ctor(System.String)
throw <null>
nop <null>
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::GetProcessById(System.Int32)
stloc.s V_4
ldloc.s V_4
ldc.i4 10000
callvirt System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32)
brtrue.s IL_00F3: leave.s IL_0101
ldstr The original uninstaller is still open. Close it and try again.
newobj System.Void System.IO.IOException::.ctor(System.String)
throw <null>
leave.s IL_0101: leave.s IL_0106
ldloc.s V_4
brfalse.s IL_0100: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0106: call System.Void Setup::Remove()
pop <null>
leave.s IL_0106: call System.Void Setup::Remove()
call System.Void Setup::Remove()
ldc.i4.0 <null>
stloc.2 <null>
leave.s IL_0143: ldloc.2
ldarg.0 <null>
ldlen <null>
brfalse.s IL_011E: newobj System.Void SetupForm::.ctor()
ldstr Unknown setup option.
newobj System.Void System.ArgumentException::.ctor(System.String)
throw <null>
newobj System.Void SetupForm::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.Form)
ldc.i4.0 <null>
stloc.2 <null>
leave.s IL_0143: ldloc.2
callvirt System.String System.Exception::get_Message()
ldstr Pulse Setup
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldc.i4.1 <null>
stloc.2 <null>
leave.s IL_0143: ldloc.2
ldloc.2 <null>
ret <null>
Deobfuscated PowerShell UNKNWOWNmalicious
@echo huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Prohuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
4de31170ddc61263da6cf06850ef4cc9
Malicious
.Net Resources
Malicious
Payload.Pulse-Tweaks.exe
Malicious
.Net Resources
Malicious
Payload.Benchmarks.ps1
Payload.CHANGELOG.md
Payload.Core.ps1
Payload.Pulse.ps1
Malicious
[PowerShell Command]
Malicious
Payload.README.txt
Payload.Restore-Pulse.cmd
Malicious
[PowerShell Command]
Malicious
Payload.Restore-Pulse.ps1
Payload.Start-Pulse.cmd
Malicious
[PowerShell Command]
Malicious
Payload.Startup.ps1
Payload.Test-Core.ps1
Payload.Test-Platform.ps1
Payload.VALIDATION.txt
Payload.Window.xaml
Payload.Launcher.cs
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
Payload.Installer.cs
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.reloc
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
@echo huhuhuhuhuhuhuhuhuhuhu
4de31170ddc61263da6cf06850ef4cc9 › .Net Resources › Payload.Pulse-Tweaks.exe › .Net Resources › Payload.Restore-Pulse.cmd › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
Prohuhuhuhu
4de31170ddc61263da6cf06850ef4cc9 › .Net Resources › Payload.Pulse-Tweaks.exe › .Net Resources › Payload.Start-Pulse.cmd › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙