fulton-v0.3.2-windows-x86_64.zip
- SHA256 de59ee4ed00dc2f478b8ea8bcce1540c013834bfa4996aeb3b2f53eeb29e87d3
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fulton-v0.3.2-windows-x86_64/fulton.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
fulton-v0.3.2-windows-x86_64/fulton.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target fulton-v0.3.2-windows-x86_64.zip
- Size 289KB
- Sample261104-3tkvcaes8z
- SHA256 de59ee4ed00dc2f478b8ea8bcce1540c013834bfa4996aeb3b2f53eeb29e87d3
- MD5 781a285213d2d50df7969abf5b148e94
- SHA1 04523169f0da915a0f2fa0f8a6363ac03ef03998
- SHA512 484a5aa77cc97f17f9244f6e8acc9233b30cd1144673e6fdce0092c718775fb8e6719c518416c2f21358904075922ae8cd10946b2815b246979beee4809fad89
- SSDEEP 6144:wAokNdajkChhaftQlKIk41qgXecuEvi/6R1m+cAbQLNT0:s9kAiS8IkCqIuEviMqxT0
- TLSH T1BB54232E221808F4E932D2702C9598013D1523DD1E7BDF99955CC4B9FB0E616E6FA8EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/fulton-v0.3.2-windows-x86_64/fulton.exe
File Explorer
-
fulton-v0.3.2-windows-x86_64.zip.zip 289KB
-
fulton-v0.3.2-windows-x86_64/fulton.exe.exe 848KB
fulton-v0.3.2-windows-x86_64/fulton.exe
- IMPHASH 806273af5a7762b3c22526cef6770f71
- SHA256 9e6dfe44782dcad3d163f24b5736ce714018adb4257c884ad88d853f5470c003
- MD5 0d0998c79bb4f13f6ea88e33131c182a
- SHA1 5171e4ec42a6694d4b67222a6d683ff4b0bdd0eb
- SHA512 ba0f3bed60020034a9f7be977441a35d15e52c3a16cef1d8fbc23a986a8774ee2161324188d2d319ebc1d79ce2727a7edc572558f9ccd29cb90a914eaf66cea2
- SSDEEP 12288:DoO0s4PahV0mKYF/45uAX5KpEoAV9h9Vh8JwkxUcIj:D4fQySgLgcn8J1Xq
- TLSH T197058D17B1A366ACE025C078930B6B23E53BB44917206DFB16D49A743FA3CE59F7A710
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
367184
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
fulton.pdb
user32
CallNextHookEx
GetMessageA
RegisterHotKey
SetWindowsHookExA
kernel32
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetLastError
InitializeCriticalSection
LeaveCriticalSection
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
__C_specific_handler
api-ms-win-crt-environment-l1-1-0
__p__environ
getenv
api-ms-win-crt-heap-l1-1-0
_msize
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_initialize_narrow_environment
_initterm
_initterm_e
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
system
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
fwrite
ntdll
LdrFindEntryForAddress
LdrGetProcedureAddress
LdrLoadDll
LdrRegisterDllNotification
LdrUnloadDll
NtAlertThread
NtAlertThreadByThreadId
NtAllocateVirtualMemory
NtCancelIoFileEx
NtCancelSynchronousIoFile
NtClose
NtCreateFile
NtCreateNamedPipeFile
NtCreateSection
NtCreateThreadEx
NtDelayExecution
NtDeviceIoControlFile
NtFlushBuffersFile
NtFreeVirtualMemory
NtFsControlFile
NtLockFile
NtMapViewOfSection
NtOpenFile
NtOpenThread
NtQueryAttributesFile
NtQueryDirectoryFile
NtQueryInformationFile
NtQueryInformationProcess
NtQueryInformationThread
NtQueryObject
NtQuerySystemInformation
NtQueryVolumeInformationFile
NtReadFile
NtResumeThread
NtSetInformationFile
NtTerminateProcess
NtUnlockFile
NtUnmapViewOfSection
NtWaitForAlertByThreadId
NtWaitForSingleObject
NtWriteFile
RtlActivateActivationContextEx
RtlAddVectoredExceptionHandler
RtlAllocateHeap
RtlEnterCriticalSection
RtlEqualUnicodeString
RtlExitUserProcess
RtlFreeHeap
RtlGetActiveActivationContext
RtlGetCurrentDirectory_U
RtlGetFullPathName_U
RtlGetSystemTimePrecise
RtlLeaveCriticalSection
RtlQueryPerformanceCounter
RtlQueryPerformanceFrequency
RtlReleaseActivationContext
RtlRemoveVectoredExceptionHandler
RtlReportSilentProcessExit
RtlSetCurrentDirectory_U
RtlUpcaseUnicodeChar
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-string-l1-1-0
strncmp
Name
.text
Size
499KB
Virtual Size
499KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
282KB
Virtual Size
282KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
512B
Virtual Size
91B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
52KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ