EndfieldPuzzleSolver_x86_64-windows.zip
- SHA256 f46e0a4019407dc100ff0477c94b96ca7f5baec46934955ff20bb939a1556da5
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
EndfieldPuzzleSolver_x86_64-windows/EndfieldPuzzleSolver.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
EndfieldPuzzleSolver_x86_64-windows/EndfieldPuzzleSolver.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target EndfieldPuzzleSolver_x86_64-windows.zip
- Size 726KB
- Sample261107-s85sysfc78
- SHA256 f46e0a4019407dc100ff0477c94b96ca7f5baec46934955ff20bb939a1556da5
- MD5 5f4a60efd943beee9030a6dca0199d40
- SHA1 51fc114627221729a7d64e9adac62e51e8ea5334
- SHA512 02e57e74ee0f949c9372c7cb9ed51e07cd8111aebe78b5699fb7cfaa39173016907ec2c2a4120b671e09274ba83f13fc348803b294d2120b1e758aea007368ab
- SSDEEP 12288:PXQDOmXeDvFkBmqOTaxLujwORzwVs1F/aSqwhsWqm4m2AdthPAzUZtv55/OBaW2F:IDxX4NamqOWxLRmzb1F/nqwKFmRCSFqo
- TLSH T1E1F4336BC5014BD7ED203D7AC59AEAFE89E5A9644B60AB511890FA3D3011CF2C23DC5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/EndfieldPuzzleSolver_x86_64-windows/EndfieldPuzzleSolver.exe
File Explorer
-
EndfieldPuzzleSolver_x86_64-windows.zip.zip 726KB
-
EndfieldPuzzleSolver_x86_64-windows/EndfieldPuzzleSolver.exe.exe 1.9MB
EndfieldPuzzleSolver_x86_64-windows/EndfieldPuzzleSolver.exe
- IMPHASH 2160a295e0856c0f279a8dad68dcbed5
- SHA256 31a18455f9082dba6e3ea35ae786ccb4907a5e3c6f00bb98fbd8509ec058551d
- MD5 904cb62e0371f9c11531750e9075e857
- SHA1 41dd8793613934930e0cd3543bbe0c0beb2162cb
- SHA512 01e79199eafdab8b883759562eb0250ccead93f8c3df6c245db8e1b3d4e8ed92e584357de5e0661b287b164c214ea27d6c6437a811ec6ed16f0695a4c67cd7be
- SSDEEP 24576:25sjxk3hCPk1kQOvlbdisakGqkzHxxvISUWpXe5uJgLLxhU3KZzcpc/BjnewZxaj:2yGgk/OsprGv1zcpex
- TLSH T1CF953811FF8659ECC19AC67442468B725B31B4CA0B21AFFF069441753E6AAF10FB879C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1098304
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
EndfieldPuzzleSolver.pdb
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WakeByAddressAll
WaitOnAddress
bcryptprimitives
ProcessPrng
kernel32
HeapSize
LCMapStringW
CompareStringW
CloseHandle
GetProcessHeap
HeapFree
HeapReAlloc
lstrlenW
GetCurrentProcess
GetProcAddress
WideCharToMultiByte
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
ReleaseMutex
SetFilePointerEx
GetLastError
SetFileInformationByHandle
FlushFileBuffers
SetFileTime
DuplicateHandle
WaitForSingleObject
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
CreateFileW
FindFirstFileExW
FindClose
GetConsoleMode
GetFileType
GetModuleHandleW
FormatMessageW
SetEnvironmentVariableW
GetFullPathNameW
GetModuleHandleA
GetModuleFileNameW
ExitProcess
QueryPerformanceFrequency
HeapAlloc
ReadConsoleW
MultiByteToWideChar
WriteConsoleW
GetStdHandle
GetConsoleOutputCP
CreateThread
ReadFileEx
SleepEx
GetFileAttributesW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
WriteFileEx
QueryPerformanceCounter
GetCurrentThreadId
GetExitCodeProcess
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
FindNextFileW
VirtualProtect
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStringTypeW
SetStdHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetCommandLineA
GetModuleHandleExW
WriteFile
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
ntdll
NtOpenFile
NtReadFile
RtlNtStatusToDosError
NtWriteFile
NtCreateNamedPipeFile
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
725KB
Virtual Size
725KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=141, id=261, version=33145,
count=13, id=260, version=33145,
count=10, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=41, id=261, version=35207,
count=9, id=257, version=33145,
count=187, id=1, productName=Unmarked objects,
count=88, productName=Unmarked objects (old),
count=1, id=258, version=35225,