endoflife[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
endoflife.exe
Size 2.3MB
Sample261030-qckf2aef73
SHA256 3eb6ba059b4c94ab45c382158eeb0b49675f00539e021e4978a186786546dfb0
MD5 9a1becf0e54fd3841159897aa9c6c135
SHA1 803f9b7b4bcb0d2ae2f9a720ed5b854ed87b35c3
SHA512 f48d554d0ff6aa4ef892758bbd652fd131b99ba17f2b47a0e81ebfa19abd5a3af9c5d40f1fbf7220d2e969a53c08d6b8ce707f39872acbf591b20d03d1708c56
SSDEEP 24576:zgwTVm3zmrz7K+X1yuXbzjWArcI3uu+iyfMhnux2IJ6clMi81s3A4y4I/D:zgwhmKrz7K+X8uXbXWyeu+Y+y4I/D
TLSH
T112B5094369DB0DE9C9D67BB8A1D31335B734FD718B291E3E6A08C2315D636C4AE1AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
endoflife.exe

File Explorer

endoflife.exe

.exe 2.3MB

endoflife.exe

IMPHASH 738c6e0ef7cfc0af578db16bdb55aa3b
SHA256 3eb6ba059b4c94ab45c382158eeb0b49675f00539e021e4978a186786546dfb0
MD5 9a1becf0e54fd3841159897aa9c6c135
SHA1 803f9b7b4bcb0d2ae2f9a720ed5b854ed87b35c3
SHA512 f48d554d0ff6aa4ef892758bbd652fd131b99ba17f2b47a0e81ebfa19abd5a3af9c5d40f1fbf7220d2e969a53c08d6b8ce707f39872acbf591b20d03d1708c56
SSDEEP 24576:zgwTVm3zmrz7K+X1yuXbzjWArcI3uu+iyfMhnux2IJ6clMi81s3A4y4I/D:zgwhmKrz7K+X8uXbXWyeu+Y+y4I/D
TLSH
T112B5094369DB0DE9C9D67BB8A1D31335B734FD718B291E3E6A08C2315D636C4AE1AB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt

kernel32

CloseHandle CreateFileA CreateProcessA CreateThread DeleteCriticalSection EnterCriticalSection FormatMessageA GetLastError GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetThreadId InitializeConditionVariable InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _filelengthi64 _fileno _fmode _fstat64 _get_osfhandle _initterm _lseeki64 _onexit _wfopen abort calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getc getenv getwc iswctype localeconv malloc memchr memcmp memcpy memmove memset putc putwc rand realloc setlocale setvbuf signal strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm system towlower towupper ungetc ungetwc vfprintf wcscoll wcsftime wcslen wcsxfrm _write _read _fileno _fdopen

user32

GetDC GetSystemMetrics MessageBoxA

Name

.text

Size

749KB

Virtual Size

749KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

978B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

endoflife.exe

gdi32

kernel32

msvcrt

user32

generic