EndcordInstaller[.]zip

General

Target
EndcordInstaller.zip
Size 1.8MB
Sample260810-qqt8dszbjb
SHA256 a9241865e11410ae54bf953c6d557a0f37fdead2c627b1134cae56c3effaa20d
MD5 be2c82ca8d35f56e6fc48bdf3139a343
SHA1 b3b3a79430502c8bda59a6b0ec89386284ddfc29
SHA512 4bbc8104209a9af6bb7dab2a1b6a1602578bc23501f91ca07d823dd86a03f020050c61ccea3237a42f8179ee76454b88935fa58b2cd6d0915f181a1e76aa4ea6
SSDEEP 24576:3hG0MMgQcrvJJX88elVu3Xk53ffK133izuIpvweQrko2sKf6+8gCio2ACZ8EJwjk:E00rbX8PqKe3Inowf6Lu3wvbrEH
TLSH
T1B09533104D6B5878C1AE9B8F723F906A61148F2F591FDAF8B142DD929E71C0F82E7B50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/EndcordInstaller.exe

File Explorer

EndcordInstaller.zip

.zip 1.8MB
EndcordInstaller.exe

.exe .js 6.1MB

EndcordInstaller.zip

SHA256 a9241865e11410ae54bf953c6d557a0f37fdead2c627b1134cae56c3effaa20d
MD5 be2c82ca8d35f56e6fc48bdf3139a343
SHA1 b3b3a79430502c8bda59a6b0ec89386284ddfc29
SHA512 4bbc8104209a9af6bb7dab2a1b6a1602578bc23501f91ca07d823dd86a03f020050c61ccea3237a42f8179ee76454b88935fa58b2cd6d0915f181a1e76aa4ea6
SSDEEP 24576:3hG0MMgQcrvJJX88elVu3Xk53ffK133izuIpvweQrko2sKf6+8gCio2ACZ8EJwjk:E00rbX8PqKe3Inowf6Lu3wvbrEH
TLSH
T1B09533104D6B5878C1AE9B8F723F906A61148F2F591FDAF8B142DD929E71C0F82E7B50
MD5 SHA1 SHA512 SSDEEP TLSH

EndcordInstaller.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a7a9d829082fcd7ca61f5790e8cfed10af8a4002170e7e5f64150bc2e93f0fa0
MD5 5fd28d503082d4fc7b33d76cac76dea7
SHA1 c57db5167051fda27e391d35487804780c287ca1
SHA512 c797eb29b28f22af3721c832f82e1c79265f4149e737da771b33da8b49f6d98508d08b9ea7a5922187ac3f08c7448b4be1ad9bb7c0d173c927d4683e523591e3
SSDEEP 49152:r4wBYNEBGk9zVxLJvqf0hQ910h7Kqi6jyTv+JEAKdEWmr4cjx51iVLtVHNdDfyJn:AQViBvrdGp
TLSH
T179563A39751BF43B0A4316FB69D74451BA29B499650090107EECC62CF3DAF68F1E2FA8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86 polyglot

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9d:97:b2:a2:f8:05:e2:51:7c:8f:5a:5d:1d:86:ff:d0:12:33:8d:41:ed:50:14:99:d1:8c:d3:fb:b6:1c:9a:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Endcord Developer

Chains

Aug 4, 2026

CN=Endcord Developer

Subject

CN=Endcord Developer

Serial Number

69:2e:c8:ef:95:fb:2b:ac:4c:6b:9f:9b:f1:ae:92:1e

Issuer

CN=Endcord Developer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 21, 2026 - Jul 21, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

0

Major OS version

4

Entry point

6359246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

EndcordInstaller.zip

EndcordInstaller.exe

PE Signature issue

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

EndcordInstaller.zip

EndcordInstaller.exe

PE Signature issue

mscoree

dotnet