The Endorphin.exe File Analysis

Updated 22 days ago

Checked by Malaware Check

Endorphin.exe

Technical Analysis

File Name	Endorphin.exe
File Type	Win32 EXE
Magic Bytes	`PE32 executable (GUI) Intel 80386, for MS Windows`
SSDEEP Hash	196608:zH1t/ie8aYGS/wEIZfzFLOyomFHKnPZ2W/BxBwBgO438eGuSUKcXW1XqeeOUHcdS:zVt/ieIrCF5+BG/438etSUhW1qvwYZU
Scanner Version	1.0.216.174
Database Version	2025-05-15 21:00:25 UTC

⚠

Suspicious File Detected

Detected by 11 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

15%

Detection Rate

13,949,616

File Size (bytes)

11/71

Engines Detected

2025-05-15

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	1bd40d1d062723ad0929f6def69a592c
SHA1	6428291b307ccf6b68b36bace337703a43a942c6
SHA256	dc4ca28afd0e9d55854b8de691b038e3d3445b18790e07f2f98c6311eb3c2408
SHA512	6c296027ece2f3c8414c714a1ac9b4155d3be35ac97ab2dbce3fcfee601b5c9e4d9da63b169e9992c05051e473444f99446adec39aaf606603bcfbe76e80e4d4
ImpHash	a64a40d744bfb19fcbf53da5716d70d3

Security Engines with Detections (11 of 71)

Bkav

W32.AIDetectMalware Malicious

Elastic

malicious (high confidence) Malicious

Cylance

Unsafe Malicious

VirIT

Trojan.Win32.GenHeur.B Malicious

Varist

W32/ABTrojan.PMNA-6354 Malicious

Google

Detected Malicious

McAfee

Artemis!1BD40D1D0627 Malicious

Malwarebytes

Spyware.Lumma Malicious

Rising

Trojan.Injector!1.127AD (CLASSIC) Malicious

Fortinet

W32/PossibleThreat Malicious

DeepInstinct

MALICIOUS Malicious

60 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Icon	Hash: cc71b2d1ee240b3f504c2f64795483c1 Fuzzy: 4d82fd3eb663c0ff1461d23f0f3c3c31 dHash: f0da9b989b9bdaf0
Image Base	`0x00400000`
Entry Point	`0x0067e918`
Compilation Time	2019-10-12 06:46:47
Checksum	0x00d5bcb6 (Actual: 0x00d5d277)
OS Version	5.1
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB Path	`D:\Austausch\C-Projekte\CloneSpy3\Release\CloneSpy.pdb`
Digital Signature	The expected hash does not match the digest in SpcInfo
Imports	24 libraries
Exports	0 functions
Resources	960 Resources
Sections	5 Sections

Version Information

▼

Comments	Duplicate file removal tool
CompanyName	Marcus Kleinehagenbrock
FileDescription	CloneSpy Application
FileVersion	3.43
InternalName	CloneSpy
LegalCopyright	© 2001 - 2019 Marcus Kleinehagenbrock
OriginalFilename	CloneSpy.exe
ProductName	CloneSpy
ProductVersion	3.43
WWW	http:\\www.clonespy.com
Translation	0x0409 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	2,907,592 bytes	2,907,648 bytes	6.60 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`9E2B26453FF71CD72FA3475087BA6A1A`
`.rdata`	`0x002c7000`	644,400 bytes	644,608 bytes	4.99 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`EADCCBA991F2EADE442119214695AC24`
`.data`	`0x00365000`	54,404 bytes	32,256 bytes	4.46 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E9722BEF55E2968C159128852FD58152`
`.rsrc`	`0x00373000`	1,672,192 bytes	1,672,192 bytes	7.22 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`CA4643FD215739017985A928EB8102D2`
`.reloc`	`0x0050c000`	643,072 bytes	643,072 bytes	7.72 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`21F9C1EC75624697A3AEDC1A5014075A`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 960 (1,575,680 bytes)

Resource Type	Count	Total Size	Percentage
AFX_DIALOG_LAYOUT	1	2 bytes	0%
PNG	553	1,012,317 bytes	64.2%
STYLE_XML	5	83,741 bytes	5.3%
WAVE	1	7,740 bytes	0.5%
RT_CURSOR	29	8,804 bytes	0.6%
RT_BITMAP	47	253,348 bytes	16.1%
RT_ICON	120	147,232 bytes	9.3%
RT_MENU	2	480 bytes	0%
RT_DIALOG	54	36,414 bytes	2.3%
RT_STRING	29	12,736 bytes	0.8%
RT_GROUP_CURSOR	28	574 bytes	0%
RT_GROUP_ICON	77	2,142 bytes	0.1%
RT_VERSION	1	908 bytes	0.1%
RT_ANICURSOR	1	7,910 bytes	0.5%
RT_MANIFEST	1	381 bytes	0%
None	11	951 bytes	0.1%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

11 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1