Static task
static1
General
-
Target
PulzeTools.exe
-
Size
906KB
-
MD5
71a3d4d693b44cae82b1a554e1b446ac
-
SHA1
68b365fc26861c5ec0de8b1445a4d4c00dc68739
-
SHA256
c1488fc07000983eb006aaa022b71a327a891960e906965f4d2c2b8aa5af3e25
-
SHA512
9c48924b2f8639b16f469b10c7ea0a1e31c3d11508d51e4d4e3ae1b9c25130569acbc7f48770f3084b75c086faf655b0291e4481dd83331fe03e4e6c132e15c1
-
SSDEEP
12288:dLiJbHmFR5UkhJsx1gI2DvRO/kskMmqWKhxg5bimQXqLdmtp:dWJyFRikfsx1gZvximQXqLO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PulzeTools.exe
Files
-
PulzeTools.exe.exe windows:4 windows x64 arch:x64
d8e19791284f6af29001274de65cea35
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileW
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
ExitProcess
FormatMessageA
FreeLibrary
GetConsoleWindow
GetCurrentProcess
GetEnvironmentVariableA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemInfo
GlobalMemoryStatusEx
InitializeCriticalSection
K32GetModuleInformation
LeaveCriticalSection
LocalFree
MapViewOfFile
MultiByteToWideChar
RaiseException
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
api-ms-win-crt-convert-l1-1-0
mbrtowc
strtoul
wcrtomb
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
getenv
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
___mb_cur_max_func
localeconv
setlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
_fdopen
api-ms-win-crt-private-l1-1-0
__C_specific_handler
memchr
memcmp
memcpy
memmove
strchr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_exit
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
strerror
system
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
_fileno
_fseeki64
_ftelli64
_lseeki64
_read
_wfopen
_write
fclose
fflush
fopen
fputc
fputs
fread
fwrite
getc
getwc
putc
putwc
setvbuf
ungetc
ungetwc
api-ms-win-crt-string-l1-1-0
_stricmp
iswctype
memset
strcmp
strcoll
strlen
strncmp
strxfrm
towlower
towupper
wcscoll
wcslen
wcsxfrm
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_tzset
strftime
wcsftime
api-ms-win-crt-utility-l1-1-0
rand_s
libwinpthread-1
pthread_cond_broadcast
pthread_cond_wait
pthread_getspecific
pthread_key_create
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
pthread_once
pthread_setspecific
shell32
SHGetFolderPathA
ShellExecuteA
ShellExecuteW
user32
MessageBoxA
ShowWindow
wininet
HttpQueryInfoA
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
Sections
.text Size: 711KB - Virtual size: 710KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ