General

  • Target
    PulseSecureInstallerService.exe
  • Size 4.9MB
  • Sample261102-pej3lsvy5p
  • SHA256 844237486a2191881bbb319759e7d0fbf46579b97a13e9c1e5cd6243b541b68b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10

Malware Config

Signatures

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs

File Explorer

  • PulseSecureInstallerService.exe
    .exe 4.9MB
  • $PLUGINSDIR/SimpleSC.dll
    .dll 59KB
  • $PLUGINSDIR/UserInfo.dll
    .dll 4KB
  • PulseSecureInstallerService.msi
    .msi 4.9MB
  • VerifyAndInstall.exe
    .exe 181KB
  • dsInstallerClient.dll
    .dll 269KB
  • dsIpc.dll
    .dll 936KB
  • dsLogService.dll
    .dll 199KB
  • msvcp140.dll
    .dll 443KB
  • vcruntime140.dll
    .dll 81KB

PulseSecureInstallerService.exe

  • IMPHASH cc0e5f1dbcc79b54e7c90bb5f062f29b
  • SHA256 844237486a2191881bbb319759e7d0fbf46579b97a13e9c1e5cd6243b541b68b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Digest
c7:1f:0f:7e:7a:da:e2:3e:51:d2:26:d4:24:eb:56:69:3f:45:02:8a:c3:09:f5:3d:7b:bb:78:e4:9d:43:b8:ed
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Pulse Secure\, LLC,OU=Engineering-2021,O=Pulse Secure\, LLC,L=San Jose,ST=California,C=US
Minor OS version
0
Major OS version
4
Entry point
14272
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths