6b594082ac29b4464f1a75ba48c13f0d

PE Executable

MD5: 6b594082ac29b4464f1a75ba48c13f0d

Size: 115.2 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very low

MD5	6b594082ac29b4464f1a75ba48c13f0d
Sha1	6017225c048a34c77cc1a9188c8fb8135fb830d2
Sha256	2d96839426e3400d9273eb9621889e74f847b503a2c9ef73ae8148f80a1eb2a1
Sha384	0d10120a0f95c66e6061da55c08e52a212bfdc911aa68877948db54affe19e8a1faf25973c92deee4e53de3302c842f2
Sha512	2c7d7ec90c92d1670f668ab9e1713e1becb6e86fd0a33eeb006dccf596509d8e771a50ab7ef6d552eb824abc6115c7d9fb8798b94e2e59faa4b2c15c5b06f7e9
SSDeep	1536:n83HcKvl3SGMJ8xZqAQ/Wuags5m4aOF22rUQ8dBYlPNAeG5:nmDcRJ8xZqA+Wu8m4aOkoPNa5
TLSH	CCB3292AA4688614DDF3117A6DE6B100EF23002F53285A44FA9C92CE7FF556F4437FA6

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>scr:ps1~T1027~T1059.001

Shape pe:exe>scr:ps1

malicious 2 nodes

Path pe:exe>scr:ps1~T1059.001

Shape pe:exe>scr:ps1

technique2 nodes

Name	Value
Module Name	Pulse-Tweaks.exe
Full Name	Pulse-Tweaks.exe
EntryPoint	System.Int32 Program::Main(System.String[])
Scope Name	Pulse-Tweaks.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Pulse-Tweaks
Assembly Version	1.2.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	32
Main Method	System.Int32 Program::Main(System.String[])
Main IL Instruction Count	328
Main IL	ldnull <null> stloc.0 <null> ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr PulseTweaks call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> call System.OperatingSystem System.Environment::get_OSVersion() callvirt System.PlatformID System.OperatingSystem::get_Platform() ldc.i4.2 <null> beq.s IL_002C: ldarg.0 ldstr Pulse Tweaks requires Windows. newobj System.Void System.PlatformNotSupportedException::.ctor(System.String) throw <null> ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.1 <null> bne.un.s IL_0042: ldc.i4.0 ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr --restore ldc.i4.5 <null> callvirt System.Boolean System.String::Equals(System.String,System.StringComparison) br.s IL_0043: stloc.2 ldc.i4.0 <null> stloc.2 <null> ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.1 <null> bne.un.s IL_005A: ldc.i4.0 ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr --self-test ldc.i4.5 <null> callvirt System.Boolean System.String::Equals(System.String,System.StringComparison) br.s IL_005B: stloc.3 ldc.i4.0 <null> stloc.3 <null> ldloc.2 <null> ldloc.3 <null> or <null> stloc.s V_4 ldarg.0 <null> ldlen <null> brfalse.s IL_0074: ldloc.1 ldloc.s V_4 brtrue.s IL_0074: ldloc.1 ldstr Launch without arguments, or use --restore for recovery / --self-test for read-only platform checks. newobj System.Void System.ArgumentException::.ctor(System.String) throw <null> ldloc.1 <null> ldstr App call System.Guid System.Guid::NewGuid() stloc.s V_7 ldloca.s V_7 ldstr N call System.String System.Guid::ToString(System.String) call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.1 <null> ldstr last-launch.log call System.String System.IO.Path::Combine(System.String,System.String) call System.DateTime System.DateTime::get_UtcNow() stloc.s V_8 ldloca.s V_8 ldstr o call System.String System.DateTime::ToString(System.String) ldstr Pulse 1.2.0 launch call System.String System.String::Concat(System.String,System.String) call System.Void System.IO.File::WriteAllText(System.String,System.String) call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() stloc.s V_5 ldloc.s V_5 callvirt System.String[] System.Reflection.Assembly::GetManifestResourceNames() stloc.s V_9 ldc.i4.0 <null> stloc.s V_10 br IL_016A: ldloc.s V_10 ldloc.s V_9 ldloc.s V_10 ldelem.ref <null> stloc.s V_11 ldloc.s V_11 ldstr Payload. ldc.i4.4 <null> callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison) brfalse.s IL_0164: ldloc.s V_10 ldloc.s V_11 ldstr Payload. call System.Int32 System.String::get_Length() callvirt System.String System.String::Substring(System.Int32) stloc.s V_12 ldloc.s V_12 ldloc.s V_12 call System.String System.IO.Path::GetFileName(System.String) call System.Boolean System.String::op_Inequality(System.String,System.String) brfalse.s IL_0123: ldloc.s V_5 ldstr Invalid embedded filename. newobj System.Void System.IO.InvalidDataException::.ctor(System.String) throw <null> ldloc.s V_5 ldloc.s V_11 callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_13 ldloc.0 <null> ldloc.s V_12 call System.String System.IO.Path::Combine(System.String,System.String) ldc.i4.1 <null> ldc.i4.2 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode,System.IO.FileAccess) stloc.s V_14 ldloc.s V_13 ldloc.s V_14 callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) leave.s IL_0156: leave.s IL_0164 ldloc.s V_14 brfalse.s IL_0155: endfinally ldloc.s V_14 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0164: ldloc.s V_10 ldloc.s V_13 brfalse.s IL_0163: endfinally ldloc.s V_13 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_10 ldc.i4.1 <null> add <null> stloc.s V_10 ldloc.s V_10 ldloc.s V_9 ldlen <null> conv.i4 <null> blt IL_00DF: ldloc.s V_9 ldc.i4.s 37 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr WindowsPowerShell\v1.0\powershell.exe call System.String System.IO.Path::Combine(System.String,System.String) dup <null> call System.Boolean System.IO.File::Exists(System.String) brtrue.s IL_0199: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) ldstr Windows PowerShell is unavailable. newobj System.Void System.IO.FileNotFoundException::.ctor(System.String) throw <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 ldloc.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) ldloc.s V_6 callvirt System.Collections.Specialized.StringDictionary System.Diagnostics.ProcessStartInfo::get_EnvironmentVariables() ldstr PULSE_EXECUTABLE_PATH call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() callvirt System.Void System.Collections.Specialized.StringDictionary::set_Item(System.String,System.String) ldloc.s V_6 ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.s V_6 ldc.i4.5 <null> newarr System.String dup <null> ldc.i4.0 <null> ldstr -NoLogo -NoProfile -STA -ExecutionPolicy Bypass stelem.ref <null> dup <null> ldc.i4.1 <null> ldloc.s V_4 brtrue.s IL_01E8: ldstr "-NoExit " ldstr br.s IL_01ED: stelem.ref ldstr -NoExit stelem.ref <null> dup <null> ldc.i4.2 <null> ldstr -File " stelem.ref <null> dup <null> ldc.i4.3 <null> ldloc.0 <null> ldloc.2 <null> brtrue.s IL_020D: ldstr "Restore-Pulse.ps1" ldloc.3 <null> brtrue.s IL_0206: ldstr "Test-Platform.ps1" ldstr Pulse.ps1 br.s IL_0212: call System.String System.IO.Path::Combine(System.String,System.String) ldstr Test-Platform.ps1 br.s IL_0212: call System.String System.IO.Path::Combine(System.String,System.String) ldstr Restore-Pulse.ps1 call System.String System.IO.Path::Combine(System.String,System.String) stelem.ref <null> dup <null> ldc.i4.4 <null> ldstr " stelem.ref <null> call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_6 ldloc.s V_4 ldc.i4.0 <null> ceq <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) ldloc.s V_6 ldloc.s V_4 ldc.i4.0 <null> ceq <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardOutput(System.Boolean) ldloc.s V_6 ldloc.s V_4 ldc.i4.0 <null> ceq <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardError(System.Boolean) ldloc.s V_6 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_15 ldloc.s V_4 brtrue.s IL_0269: ldnull ldloc.s V_15 callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardOutput() callvirt System.Threading.Tasks.Task`1<System.String> System.IO.TextReader::ReadToEndAsync() br.s IL_026A: stloc.s V_16 ldnull <null> stloc.s V_16 ldloc.s V_4 brtrue.s IL_027E: ldnull ldloc.s V_15 callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardError() callvirt System.Threading.Tasks.Task`1<System.String> System.IO.TextReader::ReadToEndAsync() br.s IL_027F: stloc.s V_17 ldnull <null> stloc.s V_17 ldloc.s V_15 callvirt System.Void System.Diagnostics.Process::WaitForExit() ldloc.s V_4 brtrue.s IL_02CF: ldloc.s V_15 ldloc.s V_16 callvirt System.Runtime.CompilerServices.TaskAwaiter`1<System.String> System.Threading.Tasks.Task`1<System.String>::GetAwaiter() stloc.s V_19 ldloca.s V_19 call System.String System.Runtime.CompilerServices.TaskAwaiter`1<System.String>::GetResult() ldloc.s V_17 callvirt System.Runtime.CompilerServices.TaskAwaiter`1<System.String> System.Threading.Tasks.Task`1<System.String>::GetAwaiter() stloc.s V_19 ldloca.s V_19 call System.String System.Runtime.CompilerServices.TaskAwaiter`1<System.String>::GetResult() call System.String System.String::Concat(System.String,System.String) stloc.s V_18 ldloc.s V_18 callvirt System.Int32 System.String::get_Length() ldc.i4.0 <null> ble.s IL_02CF: ldloc.s V_15 ldloc.1 <null> ldstr last-launch.log call System.String System.IO.Path::Combine(System.String,System.String) ldloc.s V_18 call System.Void System.IO.File::AppendAllText(System.String,System.String) ldloc.s V_15 callvirt System.Int32 System.Diagnostics.Process::get_ExitCode() brfalse.s IL_0325: ldloc.s V_15 ldc.i4.5 <null> newarr System.String dup <null> ldc.i4.0 <null> ldstr Pulse could not finish normally. If an error was shown, keep its text. Launch details, when available: stelem.ref <null> dup <null> ldc.i4.1 <null> ldloc.1 <null> ldstr last-launch.log call System.String System.IO.Path::Combine(System.String,System.String) stelem.ref <null> dup <null> ldc.i4.2 <null> ldstr Your setting backups are retained in stelem.ref <null> dup <null> ldc.i4.3 <null> ldloc.1 <null> ldstr Backups call System.String System.IO.Path::Combine(System.String,System.String) stelem.ref <null> dup <null> ldc.i4.4 <null> ldstr . stelem.ref <null> call System.String System.String::Concat(System.String[]) ldstr Pulse Tweaks ldc.i4.0 <null> ldc.i4.s 48 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldloc.s V_15 callvirt System.Int32 System.Diagnostics.Process::get_ExitCode() stloc.s V_10 leave.s IL_0364: ldloc.s V_10 ldloc.s V_15 brfalse.s IL_033B: endfinally ldloc.s V_15 callvirt System.Void System.IDisposable::Dispose() endfinally <null> callvirt System.String System.Exception::get_Message() ldstr Pulse Tweaks ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldc.i4.1 <null> stloc.s V_10 leave.s IL_0364: ldloc.s V_10 ldloc.0 <null> brfalse.s IL_0363: endfinally ldloc.0 <null> ldc.i4.1 <null> call System.Void System.IO.Directory::Delete(System.String,System.Boolean) leave.s IL_0363: endfinally pop <null> leave.s IL_0363: endfinally endfinally <null> ldloc.s V_10 ret <null>
Info	PE Detect: PeReader OK (file layout)
Module Name	Pulse-Tweaks.exe
Full Name	Pulse-Tweaks.exe
EntryPoint	System.Int32 Program::Main(System.String[])
Scope Name	Pulse-Tweaks.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Pulse-Tweaks
Assembly Version	1.2.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	32
Main Method	System.Int32 Program::Main(System.String[])
Main IL Instruction Count	328
Main IL	ldnull <null> stloc.0 <null> ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr PulseTweaks call System.String System.IO.Path::Combine(System.String,System.String) stloc.1 <null> call System.OperatingSystem System.Environment::get_OSVersion() callvirt System.PlatformID System.OperatingSystem::get_Platform() ldc.i4.2 <null> beq.s IL_002C: ldarg.0 ldstr Pulse Tweaks requires Windows. newobj System.Void System.PlatformNotSupportedException::.ctor(System.String) throw <null> ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.1 <null> bne.un.s IL_0042: ldc.i4.0 ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr --restore ldc.i4.5 <null> callvirt System.Boolean System.String::Equals(System.String,System.StringComparison) br.s IL_0043: stloc.2 ldc.i4.0 <null> stloc.2 <null> ldarg.0 <null> ldlen <null> conv.i4 <null> ldc.i4.1 <null> bne.un.s IL_005A: ldc.i4.0 ldarg.0 <null> ldc.i4.0 <null> ldelem.ref <null> ldstr --self-test ldc.i4.5 <null> callvirt System.Boolean System.String::Equals(System.String,System.StringComparison) br.s IL_005B: stloc.3 ldc.i4.0 <null> stloc.3 <null> ldloc.2 <null> ldloc.3 <null> or <null> stloc.s V_4 ldarg.0 <null> ldlen <null> brfalse.s IL_0074: ldloc.1 ldloc.s V_4 brtrue.s IL_0074: ldloc.1 ldstr Launch without arguments, or use --restore for recovery / --self-test for read-only platform checks. newobj System.Void System.ArgumentException::.ctor(System.String) throw <null> ldloc.1 <null> ldstr App call System.Guid System.Guid::NewGuid() stloc.s V_7 ldloca.s V_7 ldstr N call System.String System.Guid::ToString(System.String) call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.1 <null> ldstr last-launch.log call System.String System.IO.Path::Combine(System.String,System.String) call System.DateTime System.DateTime::get_UtcNow() stloc.s V_8 ldloca.s V_8 ldstr o call System.String System.DateTime::ToString(System.String) ldstr Pulse 1.2.0 launch call System.String System.String::Concat(System.String,System.String) call System.Void System.IO.File::WriteAllText(System.String,System.String) call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() stloc.s V_5 ldloc.s V_5 callvirt System.String[] System.Reflection.Assembly::GetManifestResourceNames() stloc.s V_9 ldc.i4.0 <null> stloc.s V_10 br IL_016A: ldloc.s V_10 ldloc.s V_9 ldloc.s V_10 ldelem.ref <null> stloc.s V_11 ldloc.s V_11 ldstr Payload. ldc.i4.4 <null> callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison) brfalse.s IL_0164: ldloc.s V_10 ldloc.s V_11 ldstr Payload. call System.Int32 System.String::get_Length() callvirt System.String System.String::Substring(System.Int32) stloc.s V_12 ldloc.s V_12 ldloc.s V_12 call System.String System.IO.Path::GetFileName(System.String) call System.Boolean System.String::op_Inequality(System.String,System.String) brfalse.s IL_0123: ldloc.s V_5 ldstr Invalid embedded filename. newobj System.Void System.IO.InvalidDataException::.ctor(System.String) throw <null> ldloc.s V_5 ldloc.s V_11 callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_13 ldloc.0 <null> ldloc.s V_12 call System.String System.IO.Path::Combine(System.String,System.String) ldc.i4.1 <null> ldc.i4.2 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode,System.IO.FileAccess) stloc.s V_14 ldloc.s V_13 ldloc.s V_14 callvirt System.Void System.IO.Stream::CopyTo(System.IO.Stream) leave.s IL_0156: leave.s IL_0164 ldloc.s V_14 brfalse.s IL_0155: endfinally ldloc.s V_14 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0164: ldloc.s V_10 ldloc.s V_13 brfalse.s IL_0163: endfinally ldloc.s V_13 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_10 ldc.i4.1 <null> add <null> stloc.s V_10 ldloc.s V_10 ldloc.s V_9 ldlen <null> conv.i4 <null> blt IL_00DF: ldloc.s V_9 ldc.i4.s 37 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr WindowsPowerShell\v1.0\powershell.exe call System.String System.IO.Path::Combine(System.String,System.String) dup <null> call System.Boolean System.IO.File::Exists(System.String) brtrue.s IL_0199: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) ldstr Windows PowerShell is unavailable. newobj System.Void System.IO.FileNotFoundException::.ctor(System.String) throw <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 ldloc.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String) ldloc.s V_6 callvirt System.Collections.Specialized.StringDictionary System.Diagnostics.ProcessStartInfo::get_EnvironmentVariables() ldstr PULSE_EXECUTABLE_PATH call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.String System.Reflection.Assembly::get_Location() callvirt System.Void System.Collections.Specialized.StringDictionary::set_Item(System.String,System.String) ldloc.s V_6 ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.s V_6 ldc.i4.5 <null> newarr System.String dup <null> ldc.i4.0 <null> ldstr -NoLogo -NoProfile -STA -ExecutionPolicy Bypass stelem.ref <null> dup <null> ldc.i4.1 <null> ldloc.s V_4 brtrue.s IL_01E8: ldstr "-NoExit " ldstr br.s IL_01ED: stelem.ref ldstr -NoExit stelem.ref <null> dup <null> ldc.i4.2 <null> ldstr -File " stelem.ref <null> dup <null> ldc.i4.3 <null> ldloc.0 <null> ldloc.2 <null> brtrue.s IL_020D: ldstr "Restore-Pulse.ps1" ldloc.3 <null> brtrue.s IL_0206: ldstr "Test-Platform.ps1" ldstr Pulse.ps1 br.s IL_0212: call System.String System.IO.Path::Combine(System.String,System.String) ldstr Test-Platform.ps1 br.s IL_0212: call System.String System.IO.Path::Combine(System.String,System.String) ldstr Restore-Pulse.ps1 call System.String System.IO.Path::Combine(System.String,System.String) stelem.ref <null> dup <null> ldc.i4.4 <null> ldstr " stelem.ref <null> call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_6 ldloc.s V_4 ldc.i4.0 <null> ceq <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) ldloc.s V_6 ldloc.s V_4 ldc.i4.0 <null> ceq <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardOutput(System.Boolean) ldloc.s V_6 ldloc.s V_4 ldc.i4.0 <null> ceq <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_RedirectStandardError(System.Boolean) ldloc.s V_6 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_15 ldloc.s V_4 brtrue.s IL_0269: ldnull ldloc.s V_15 callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardOutput() callvirt System.Threading.Tasks.Task`1<System.String> System.IO.TextReader::ReadToEndAsync() br.s IL_026A: stloc.s V_16 ldnull <null> stloc.s V_16 ldloc.s V_4 brtrue.s IL_027E: ldnull ldloc.s V_15 callvirt System.IO.StreamReader System.Diagnostics.Process::get_StandardError() callvirt System.Threading.Tasks.Task`1<System.String> System.IO.TextReader::ReadToEndAsync() br.s IL_027F: stloc.s V_17 ldnull <null> stloc.s V_17 ldloc.s V_15 callvirt System.Void System.Diagnostics.Process::WaitForExit() ldloc.s V_4 brtrue.s IL_02CF: ldloc.s V_15 ldloc.s V_16 callvirt System.Runtime.CompilerServices.TaskAwaiter`1<System.String> System.Threading.Tasks.Task`1<System.String>::GetAwaiter() stloc.s V_19 ldloca.s V_19 call System.String System.Runtime.CompilerServices.TaskAwaiter`1<System.String>::GetResult() ldloc.s V_17 callvirt System.Runtime.CompilerServices.TaskAwaiter`1<System.String> System.Threading.Tasks.Task`1<System.String>::GetAwaiter() stloc.s V_19 ldloca.s V_19 call System.String System.Runtime.CompilerServices.TaskAwaiter`1<System.String>::GetResult() call System.String System.String::Concat(System.String,System.String) stloc.s V_18 ldloc.s V_18 callvirt System.Int32 System.String::get_Length() ldc.i4.0 <null> ble.s IL_02CF: ldloc.s V_15 ldloc.1 <null> ldstr last-launch.log call System.String System.IO.Path::Combine(System.String,System.String) ldloc.s V_18 call System.Void System.IO.File::AppendAllText(System.String,System.String) ldloc.s V_15 callvirt System.Int32 System.Diagnostics.Process::get_ExitCode() brfalse.s IL_0325: ldloc.s V_15 ldc.i4.5 <null> newarr System.String dup <null> ldc.i4.0 <null> ldstr Pulse could not finish normally. If an error was shown, keep its text. Launch details, when available: stelem.ref <null> dup <null> ldc.i4.1 <null> ldloc.1 <null> ldstr last-launch.log call System.String System.IO.Path::Combine(System.String,System.String) stelem.ref <null> dup <null> ldc.i4.2 <null> ldstr Your setting backups are retained in stelem.ref <null> dup <null> ldc.i4.3 <null> ldloc.1 <null> ldstr Backups call System.String System.IO.Path::Combine(System.String,System.String) stelem.ref <null> dup <null> ldc.i4.4 <null> ldstr . stelem.ref <null> call System.String System.String::Concat(System.String[]) ldstr Pulse Tweaks ldc.i4.0 <null> ldc.i4.s 48 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldloc.s V_15 callvirt System.Int32 System.Diagnostics.Process::get_ExitCode() stloc.s V_10 leave.s IL_0364: ldloc.s V_10 ldloc.s V_15 brfalse.s IL_033B: endfinally ldloc.s V_15 callvirt System.Void System.IDisposable::Dispose() endfinally <null> callvirt System.String System.Exception::get_Message() ldstr Pulse Tweaks ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldc.i4.1 <null> stloc.s V_10 leave.s IL_0364: ldloc.s V_10 ldloc.0 <null> brfalse.s IL_0363: endfinally ldloc.0 <null> ldc.i4.1 <null> call System.Void System.IO.Directory::Delete(System.String,System.Boolean) leave.s IL_0363: endfinally pop <null> leave.s IL_0363: endfinally endfinally <null> ldloc.s V_10 ret <null>

Deobfuscated PowerShell UNKNWOWNmalicious

@echo huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

Prohuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

No malware configuration was found at this point.

Deobfuscated PowerShell UNKNWOWNmalicious

@echo huhuhuhuhuhuhuhuhuhuhu

6b594082ac29b4464f1a75ba48c13f0d › .Net Resources › Payload.Restore-Pulse.cmd › [PowerShell Command]

Deobfuscated PowerShell UNKNWOWNmalicious

Prohuhuhuhu

6b594082ac29b4464f1a75ba48c13f0d › .Net Resources › Payload.Start-Pulse.cmd › [PowerShell Command]

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.