Benign windows Download

PulseHD.PulseHD

Authenticode chain CN: YayYay LimitedBinary contains high-entropy data regions

SHA-2567ecf2f4df10214606858ee9a03463ad8e0169f0e6419d9d1c590a760759c8808

URLhttps://storage.googleapis.com/pulsehd/PulseHD%20Setup%208.7.0.exe

MaleculeO₅(As₆C₃CoEr₃I)H₆(CmF₉Os₇Po₄TiU₂)Md₃(Bi₁₂PaSi₃)

Evidence

x86 indirect call through a global pointer 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400558bec83ec5c837d0c0f742b837d0c46U....\.}..t+.}.F
0x4108b4514750d834818108b0de8ae470089.E.u..H......G..
0x420480450ff7510ff750cff7508ff151c82H.P.u..u..u.....
0x4304000e94201000053568b35f4ae47008d@..B...SV.5..G..
0x44045a45750ff7508ff15208240008365f4E.WP.u... [email protected].
0x4500089450c8d45e450ff7508ff15248240..E..E.P.u...$.@
0x460008b7df08365f0008b1d5c804000e980..}..e....\.@...
0x4700000000fb646520fb656560faf55e88b.....FR..VV..U..
0x480cf2b4de80fafc103c2894d1099f7ff33.+M.......M....3
0x490d28af00fb646510fafc10fb64e550faf.....FQ.....NU..
0x4a04de803c18bca99f7ff0fb656540faf55M..........VT..U
0x4b0e88ac80fb646500faf451003c299f7ff.....FP..E......
0x4c0c1e1080fb6c00bc88d45f450894df8ff.........E.P.M..
0x4d015648040008345f004894514508d45e4[email protected].
0x4e050ff750cff1528824000ff7514ffd383P.u...([email protected]....
0x4f045e804397de80f8c77ffffff837e58ffE..9}...w....~X.
0x5007465ff7634ff155480400085c0894514[email protected].
0x51074558b7d0c6a0157c745e410000000c7tU.}.j.W.E......
0x52045e808000000ff1550804000ff765857[email protected]
0x530ff1558804000ff75148b354c80400057[email protected][email protected]
0x540ffd689450c8d45e46820080000506aff...E..E.h ...Pj.
0x55068e02e470057ff152c824000ff750c57h..G.W..,[email protected]
0x560ffd6ff7514ffd38d45a450ff7508ff15...u....E.P.u...
0x570848240005f5e33c05bc9c210008b4c24..@._^3.[.....L$
0x58004a128af47008bd15369d21840000056..([email protected]
0x590578b540208f6c202744f8d710133ff3bW.T.....tO.q.3.;
0x5a0352caf470073428bce69c9184000008d5,.G.sB..i..@...
0x5b04401088b08f6c102740347eb1ef6c104D.......t.G.....
0x5c074098bcf4f85c97420eb10f6c110750bt...O..t .....u.
0x5d08bd933da83e30133d989184605184000..3....3...F..@.
0x5e0003b352caf470072ca5f5e5bc2040055.;5,.G.r._^[...U
0x5f08bec51518b550853568bf269f6184000..QQ.U.SV..i..@.
0x600008b1d28af470033c903f357894dfc89...(.G.3...W.M..
0x6104df88b4608a802740b394d0c740624beM..F...t.9M.t.$.
0x620428946083b152caf470073448bc269c0B.F.;.,.G.sD..i.
0x630184000008d7c18088d42018b0ff6c102.@...|...B......
0x640740a6a0152e8a5ffffff8b0ff6c10475t.j.R..........u
0x65028f6c1407403ff45fcf6c1017405ff45([email protected]
0x660fceb03ff45f83b052caf47008bd072bc....E.;.,.G...r.
0x67033c05f5e5bc9c20800837dfc0074f3833._^[.....}..t..

NSIS self-extracting installer 0x237c–0x244c

0x237c007e000005000200003bf07c028bf857.~.......;.|...W
0x238c53e89f03000085c00f8422010000833dS........."....=
0x239cf8ae470000757a6a1c8d45d85350e8bc..G..uzj..E.SP..
0x23ac2d00008b45d8a9f0ffffff7572817ddc-...E......ur.}.
0x23bcefbeadde7569817de8496e7374756081....ui.}.Instu`.
0x23cc7de4736f66747557817de04e756c6c75}.softuW.}.Nullu
0x23dc4e0945088b45088b0df881420083e002N.E..E.....B....
0x23ec0905a0af47008b45f03bc6890df8ae47....G..E.;.....G
0x23fc000f8fb2000000f64508087506f64508........E..u..E.
0x240c047541ff45fc8d70fc3bfe76128bfeeb.uA.E..p.;.v....
0x241c0ef645080275086a00e84ffeffff593b..E..u.j..O...Y;
0x242c35044243007d0d5753ff75f8e84a37005.BC.}.WS.u..J7.
0x243c008945f8013df88142002bf785f60f8f..E..=..B.+.....
0x244c20                                              

Large PE with elevated code entropy 0x6bd0–0x6c60

0x6bd000000000000000000000000000000000................
0x6be000000000000000000000000000000000................
0x6bf000000000000000000000000000000000................
0x6c007e930000e6930000d6930000c2930000~...............
⋯6 more rows

Modify file creation/access/write times 0x768a–0x774a

⋯3 more rows
0x76ba3400436c6f736548616e646c65001f034.CloseHandle...
0x76ca53657446696c6554696d65003900436fSetFileTime.9.Co
0x76da6d7061726546696c6554696d6500dc02mpareFileTime...
⋯7 more rows

CreateFile API string reference 0x77cc–0x7a1c

⋯3 more rows
0x77fc77734469726563746f7279570000d601wsDirectoryW....
0x780c47657454656d70506174685700001101GetTempPathW....
0x781c476574436f6d6d616e644c696e655700GetCommandLineW.
⋯12 more rows
0x78ec0000c3036c737472636d706941005600....lstrcmpiA.V.
0x78fc43726561746546696c655700d4014765CreateFileW...Ge
0x790c7454656d7046696c654e616d65570000tTempFileNameW..
0x791ca403577269746546696c6500c6036c73..WriteFile...ls
⋯16 more rows