Endorphin[.]exe | Triage™

resource
Endorphin.exe

Endorphin.exe

IMPHASH 32f3282581436269b3a75b6675fe3e08
SHA256 c3b236af617c181af2fd23ffedbd6a62bf33b8978e17bc2f731686e938eb60d6
MD5 b115484de015c83394bffab1b21bf0b0
SHA1 7a8540ec2a6c93bae9b870e651c873f6758def3b
SHA512 f0949215b7f20aaedb5aed6a7cd6175fd6e3db142b5455a918f2f7716d4c6815c883f720eb978fe93f481d1de73fe119421b760ed350427442cf10e12aa42f82
SSDEEP 24576:OXeb6NclYmpi0mCoGC7XUHmgJRYWOQTr9x5CKTGIymt2qtFHzC2f8DJutD:aNCVb9JbLG+t59zJfEW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3e:fb:6c:d7:78:fe:cd:8f:8c:3a:cb:30:e0:d1:05:7b:aa:b9:5f:e9:c2:8f:72:66:ff:8c:fe:b8:6d:35:6d:e9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=MADEFORNET OU,O=MADEFORNET OU,ST=Harjumaa,C=EE

Chains

May 11, 2022

CN=MADEFORNET OU,O=MADEFORNET OU,ST=Harjumaa,C=EE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=MADEFORNET OU,O=MADEFORNET OU,ST=Harjumaa,C=EE

Serial Number

ed:b6:15:5f:53:ef:fb:82:87:08:57:6f:93:fc:46:a8

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 27, 2022 - Apr 27, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 29, 2022 - Mar 14, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Minor OS version

0

Major OS version

5

Entry point

14864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

724KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Asin.jar

SHA256 85e1950ab4ff2fff8f7e6667ddbe6e3db0a5385a1a06d91f8d12adb7e7f32d29
MD5 eee7bfa58be2f0cd02cbe7ea3de26e1e
SHA1 14f187ac8d61e1a78f04cf08ba1419c2c76e95b9
SHA512 1e5105d7bfcef2c754da1d409291b2189ffdd8fc1943696017d7fcf6347df1343f55acf2e85d8e528e2a86dbf0a5b5d5db881447c81789a2a1ce99c90a873159
SSDEEP 3072:7Ur1cKZKle+B2g/1v6lGRc2Vy9EdaDRI1eeH5LiE:7IIA+J1GG5AE8DRteZmE
MD5 SHA1 SHA512 SSDEEP

$TEMP/Busty.jar

SHA256 c8dc2a03551e96253e5957153c37753a38bac525187e57cceeaf845bfadfe7f9
MD5 de30b0d24070875fe94c7abe372642be
SHA1 c3648f932d9b088e49567c2f3e778fa27e117375
SHA512 506ed6b16593ad2c0f0507286ebf1bd98e100c5dde3b6ef0fe58d204ef957b738f6019d3eaf458aecda6d9be472becefc06cd5c587cff887ef255680b537cd48
SSDEEP 3072:Azj9It0y0EXhuZSnlku2cAoEkYWlINvT5xgiRJsq7NF:Azj9XExuQlkuPbGZ9VRL
MD5 SHA1 SHA512 SSDEEP

$TEMP/Earning.jar

SHA256 40c5e65afa71f3b3be71af3a619288e72ec1009976134f43c6ae9473e51a86ce
MD5 f3a62274e7dbbdc801c122f2107e8c83
SHA1 b9ed03597ed8f9f6fe43da4d9ba0ee02de70a933
SHA512 3b51ad5d53587a95945b6774367dde1ae053bbf326047d9a868511826569727e268ce26cbfc5718c6e2fa223b7707b97c00f1c0af842b247a30a5aad73d53de1
SSDEEP 192:6wmNWj9dJ9ZDrFN/Q86qWfic9EatGxeBYv6LEkDA55c2axr:6RN89dJ9ZDHY85YR9BGgYv6Qd5c2A
MD5 SHA1 SHA512 SSDEEP

$TEMP/Forms.jar

SHA256 d23f6ca4eb1c74775092f5966180f7381a477218f914923502ecd711f1cf2ab9
MD5 b9b3960b9767b022f96de388ebf476a1
SHA1 4b96a575c34c8e4b54f5cca4ff01464668cb2e97
SHA512 a6140c3ce825ac7d2add4b6838bd009388b6d89af2d886d8f48b69f8c8dcb4b929ccf9afd41e1dde07a4b2daa5069c56cc44ad001abf6b38f53e8dc9650fe7b4
SSDEEP 3072:PvOJXQUkEFknBOSjIF2ht96kw7lDk/+0sKf0IZBdx:nO5QI+ntjo2r96kQgtsKf04
MD5 SHA1 SHA512 SSDEEP

$TEMP/Ink.jar

SHA256 bcf153d587ff68e585663bcd13a1558679c7280d4bf8ae06051864c4cbbc84db
MD5 2703d155a7e27274e44827c1cf4e3ffa
SHA1 febb74cefa66240ad69a2fdc08049bcc66a86ef9
SHA512 0465039fcc201ad76c6249b4bdf5983cfe243d442da8754f73e714381e1e9b1c2608608cf17936c522acbc617da8c33bff290bcca39a8eed3253e019fa17a669
SSDEEP 3072:w2ZYRg2kjhd0mgnvpZxyl6Hv7gdPw5W62/MWvVZ4:maHh69pbHHTgBwIMWvD4
MD5 SHA1 SHA512 SSDEEP

$TEMP/Instrumentation.jar

SHA256 bc837e85ec45b83d8b36c2fbd5c53fc99ce28168dd2d7400f99101d7b8e58f2f
MD5 57af36b6b783844d7a8da546cd49f78c
SHA1 cdd1edb3725378dd1c9b7150d26d62199ea9d0c8
SHA512 9c66c5b139e27204ced6d78241315cd82d989601bfe3ada1234ce1ef20db972916379852ffe1f974f7bfe399fb180c6488fcf42d37e66804d7c984dfcb0e2ec1
SSDEEP 3072:osQzjTNuuig6XFGMxYoZAwirem2ijDYmBtGuu6iGZ+YYwDEwW9VEVUL:boHNuLRxZAwiqmR9876i7VwfWLEVUL
MD5 SHA1 SHA512 SSDEEP

$TEMP/Oriental.jar

SHA256 7555f6a76f6ad7d7cfcd89ed12b2433179548a9367bde69184fa7b4044ca57f8
MD5 0cd943bd6b8c89dad69222ee3d27666c
SHA1 055ca16e451d42fd837c67d11d864b16f8162094
SHA512 a6c14643650387a10e31db5476c61d0332ab698029a8349817eb15e4332213e35083584633722195addbcd4ec4963c5df569c8d399f892db0870a1f1c2a036be
SSDEEP 12288:cGiNWuI/OIEUMWV/8TsC+NQIGyBiCB2u5yvSPfA:cGiNzIVMy/jBo25XA
MD5 SHA1 SHA512 SSDEEP

Busy

SHA256 4b3ebe97e454f0bfd06115914e39e00e71ed5a43e8060651a471935d7508f4e4
MD5 c81c1e3887b5014d3f2c4cb836a97c98
SHA1 18c5b2a548db4ac370373efbf0e24d1d309b3712
SHA512 6f1abd7240e2cc314df74c9f2422b476dd7f55b6e333b01535259df46bdd7770094936f05526841064728b971137dfcc372bfd8b35f1ac54bc2608ef6e692eda
SSDEEP 1536:lJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3oh63EYrDWyu0uZo2+9BrO:nam6OzmkrJrRj4h6DWy4ZNorO
MD5 SHA1 SHA512 SSDEEP

Ca

SHA256 5f97f6980e818f082973f37e2e155417eaed9a89ee500019c1a1d59b34ac57c3
MD5 6299ac51232e5251ae1b0d0e97e0bf3b
SHA1 844c29e8765d0bee116e3157ab6bc28936f10cf7
SHA512 c24e852460b12b2533f9aeb15f9301556eb237ade602e322bc5f30e4e05a263bd8dd03beea61ee781077dbfb3d04cd0b49174a73e02b62d9c5092bcb923d770d
MD5 SHA1 SHA512

Ce

SHA256 8f6ae179a3e40e0dd15661d92aad530fe5db0ab8dd12133ecb4fb5785d5a99e8
MD5 2836752db3ae22e8f3116f07bcbdea9d
SHA1 a045d7a7f344b4d8b6f1cb5734fb0bccd7468224
SHA512 02d229b2d6d28ae5fa6c0967f590f443b6d0bea5d85e886c1acbdf1c7b79c627ed4352ba16f0f6d8edeeb89a85b5f8b6d2ab08afb00066d2ba02492f1e6769dc
SSDEEP 768:HHD9OTGQfoz66t4dP+8pN5XvrsY916ojfvSb2Tal0xiVWV9+k:nDATG62rt4dP+iX7DjfvSSuyxiQ
MD5 SHA1 SHA512 SSDEEP

Chronic

SHA256 51c88ea41db2a6ff73c96fb4985ac5ab03280f3c33bcd92852e5bd4640f22d45
MD5 b184260edef6d74af80ea8800e43c590
SHA1 7627e7f19bf3baf577f6a88f4d791fc2aee62311
SHA512 debcf143c45bfcc20f336b93f15ff46ef3bb160602f2a0e705b112aa3854e614231e46f75270f84a7a0eb9a8b9bfd8321c76ff74c729a9f44199a9e1e319faf6
SSDEEP 1536:PnT3VCLIsLS8ZIjOrOJ0ou3GerIUhj18Ehs5VqS:vz8StjOrOJGGMBwvqS
MD5 SHA1 SHA512 SSDEEP

Diagnostic

SHA256 99c91f0a6c8d97bbc674054c843496ebc84d0f5b4cd10170e71a12eed8b15e10
MD5 3a6aa28017e4d179070206beb1653a05
SHA1 0b67c4f7ea120426e14123f3a22b5bae7e4b2ef4
SHA512 e546a85629e063c9134c6f8985b9fb09981dad07af057b45163427d7b54fd8ae4cc3459fda4fce3e613c725675935748445401810c661e8609cc03c28c007297
SSDEEP 768:p489HDZ9t8JsRPPBvbCsOfE04GmvTQzMv/BnwwxWpAizWjg39SvYpeNK:p48918JsdVCsESNvmtpAi6JvAeA
MD5 SHA1 SHA512 SSDEEP

Highland

SHA256 e4468e0b6cf421ac1332d865c806f19ff45f669e621e76a57dbbfb8be22713b8
MD5 d8effee5c4eadf2b4e9d032875d55daa
SHA1 d66cf59447b206ba02a1f13c063fa946ba4f2799
SHA512 bbb352fe1d6df77f65a6dca9a418afda7025696d051cf094e2cfb896ac8b97fa5d8e8cc61acfe77e52a3c238448aa23056a5ecfc1c28c0c266bdc1dec502d0f2
SSDEEP 1536:jSWJKWNJELHW/EJlrZlYR+68cNk3smxUsb1yAwsc8MxqVbD61HOyU/CX2CdXibOz:jSW4wC2mYR+HUDXOXT/CfXib+tSijpce
MD5 SHA1 SHA512 SSDEEP

Implementation

SHA256 71629968e5ead98a905cc47d3d6464b59236caed3a8421ea21a826c80d3611f8
MD5 6d4188c842734af48f634095b51f6fbf
SHA1 d7a22a7e74196765de38301a75996e152d0bd849
SHA512 5b70f3b1ff952573812b932acad8e65bc4ae228e352cfc4f6414cff129c6c2f18c73e74d6b525996606bb68f2b2879c59f922223e89bd1db3594cec71f645a08
SSDEEP 384:miWjc/mwftIQXoSpu88888888888888888888888888888zv888888NfU84444Q8:x2c/mex/S8
MD5 SHA1 SHA512 SSDEEP

Keyword

SHA256 7e61c7adcec1e97570f7a99c9a6f39b931e4b813eeaa658faf9e5a0a5250fde8
MD5 67ac4f5a3ffed2995f0a6ac88bfe3129
SHA1 0d20ccc25682aee66eb12e87f6e7eeaeaa52180d
SHA512 e9ac13690f4bbe2ccb9292f8fb50173466cec8919752865a047ed4dd4ad1df2e82b525f92142e13e24588751389555b2281aafaa18ff564aeffd55b449c7ec14
SSDEEP 3072:a3I09JwCIj4BPb1XuE/gc0Ag0Fuz08XvBN3vaAtI:a3IW5Iuh0AOz04p1dC
MD5 SHA1 SHA512 SSDEEP

Kruger

SHA256 d360e145b32c99f1398c6090a01f8472d49a105f595738d687ac1854d61560d6
MD5 c5142f241095b33a3beeec6e08b8875a
SHA1 1d65e907b9ac72b0def76d06c4f1f864a85b738f
SHA512 e5072cf62e13d6c696f27b0f6ea911024bb1f3005f730867dc67c3c0aa0ffbdabe2c23779c5c1b93392753df6dee755983bc48768529b5a2bce4f3fec1adc9fc
SSDEEP 1536:60YwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpd:teVzOqD1IGuB
MD5 SHA1 SHA512 SSDEEP

Maintained

SHA256 e250590ec3a995e79482a063c48537bf6340717e3be188bc6b06757f11e4af5f
MD5 b73d3f99296057478791a46ec569d7b4
SHA1 336403728b4830c3eb11e9e03969835f86ef2cfd
SHA512 d342a961b9c8091b4a910e370c7c8e4aaa63cdf2d2a57b37f0a9df685cdd5f1fdffffd9b4ea6a428dde509228eeebe8b48f21265a8fcd8a9e879b7708517ce4e
SSDEEP 1536:5pJKgMPdkdux84SbL8R571Nf0xe5c/IwDXX/44l:5pMgKYbwR5Exe2/RTX/4I
MD5 SHA1 SHA512 SSDEEP

Menus

SHA256 be48eb22709475c75b6fe0485d72d3d4825a93b0868a31905eacc9ef0bf52051
MD5 c9155486bd963760c9b4da978f35978b
SHA1 eb20ffe873f0e7fe3678db5cfdc09aa026103857
SHA512 6e74bad755c4b7bd744e2d03c5cb056ef6a01f6df5748c548bc6a5f3af9b2e7f22e3f364a6ad266855dbca4231b6f2932a6854c9e3256fa05e2f148e6b49af3f
SSDEEP 1536:eu0HkjrkBGCGuNkMoKFHWKbAAnPC2U1Ld/f/Yyiy2ozCt+JQ+Hcnka+EY8x7:7xRuNkdKF0vYNyet+JQ+HcnkL8x7
MD5 SHA1 SHA512 SSDEEP

Promotional

SHA256 204bb729a5b2c62d5a3be6da5208bd07a7ff7d2fd8db737a480e8482394762fc
MD5 353b6d30ae1ef6f5e3acb19ef9effad2
SHA1 3a61c05877612a5b619926a9030efdb6a4211392
SHA512 752a70b739aa64a3f2505c0b40f9d504fc6eb72305a43a739841b7e0b7d6afb938fd07d213faf521ce61334a730747ac0f2608c4d33706446073a74426fcdd7c
SSDEEP 1536:g25G5ClCQEiV2XaRodwTVCJ9XonOM4O7tiC9jC0O2i94rqWJNm4Ql0/YUdzPrCt2:gQGYlawwBonasL9jC0O2iSW4QlXUxPrL
MD5 SHA1 SHA512 SSDEEP

Welsh

SHA256 e9c0146cbeb214a354f4755bb3066f33243c572522195f1df338c6acf95e3c08
MD5 5b1d954865ac0fd4d706ddfc8ee81a63
SHA1 080f73fb25f250c528c89ee6e7f804555fd656bc
SHA512 0bc4524bb40b7eb4d82266d321c04658a95fb8a38da58692c33cd9aa7b32e9fbeba8b022cc63842c64d06069566cd06a4ae05399032c6e86a13fae203992309b
SSDEEP 1536:+CfVYvLutohx6a+A3MDS661CZxbxY/jJHcUoNghHeqSkV4T2uv:+SVYvlhx6vA3MD8jjJ8lghHzJi2uv
MD5 SHA1 SHA512 SSDEEP

$TEMP/Rachel.jar

SHA256 03eb8b2c27435dff991f40357c9f160bfac6b7e49a232e93321c1823280a40df
MD5 36aaf3651cecc185af78b5ce2e34bb42
SHA1 73e3542112e25b7289ddd931129917f794d8b282
SHA512 8d43bdf7be35c87e91c180288847897b46943d6fe3fdd2c7c71af3e6837c490a36d55f9a6a8a8e0836466af924eddd3dd57f3efbdc6f473c1d4dc6a9bc54ccb2
SSDEEP 3072:/1q/z8baAZwyDdUJBvhcPvkoMbYOmVez9pRpsgSZ4Gt9EwJfa:/1McaXy5UXZc3A99p7SZ4e93fa
MD5 SHA1 SHA512 SSDEEP

$TEMP/Resolve.jar

SHA256 4feddf1fb9c0bce929d8824aa4e20f7dd22c7026fe5f935838cafb94f036c17c
MD5 856d27125f245628cbb5cd9bdacb586e
SHA1 dd99593090398eca95f15b16ed642ea14a48dc8c
SHA512 bd1b56e2543ce57aeb4986dc487faa8f22c1da0a970712a4c5099f677460068b8984510b7c431d1b17c2b2cfa90b70b2acb37865516d598bbadc440ee3c8a713
SSDEEP 3072:jO9Sc0fRfZrIhHhUANoShpM5F+nyD/e0W2YvtEIZ2PbYNF:jo0f/rOBTnhpM5F+nU6vtFwbo
MD5 SHA1 SHA512 SSDEEP

Endorphin.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Asin.jar

$TEMP/Busty.jar

$TEMP/Earning.jar

$TEMP/Forms.jar

$TEMP/Ink.jar

$TEMP/Instrumentation.jar

$TEMP/Oriental.jar

Busy

Ca

Ce

Chronic

Diagnostic

Highland

Implementation

Keyword

Kruger

Maintained

Menus

Promotional

Welsh

$TEMP/Rachel.jar

$TEMP/Resolve.jar

Sharing

Errors

General

Malware Config

Signatures

File Explorer

Endorphin.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$TEMP/Asin.jar

$TEMP/Busty.jar

$TEMP/Earning.jar

$TEMP/Forms.jar

$TEMP/Ink.jar

$TEMP/Instrumentation.jar

$TEMP/Oriental.jar

Busy

Ca

Ce

Chronic

Diagnostic

Highland

Implementation

Keyword

Kruger

Maintained

Menus

Promotional

Welsh

$TEMP/Rachel.jar

$TEMP/Resolve.jar