trichloromethane.exe-Malware-main.zip
- SHA256 212689dd6b767a3b00e39654a03b3b8df7d50fdfbb00b139c7a697e4bdf1b6a6
Overview
overview
7Static
static
3trichlorom...ty.exe
windows10-2004-x64
3trichlorom...ty.exe
windows11-ltsc_2024-x64
3trichlorom...ty.exe
windows10-2004-x64
3trichlorom...ty.exe
windows11-ltsc_2024-x64
3trichlorom...ne.exe
windows10-2004-x64
3trichlorom...ne.exe
windows11-ltsc_2024-x64
3trichlorom...ty.exe
windows10-2004-x64
3trichlorom...ty.exe
windows11-ltsc_2024-x64
3trichloromethane.exe
windows10-2004-x64
3trichloromethane.exe
windows11-ltsc_2024-x64
3trichlorom...te.bat
windows10-2004-x64
3trichlorom...te.bat
windows11-ltsc_2024-x64
3trichlorom...DL.dll
windows10-2004-x64
3trichlorom...DL.dll
windows11-ltsc_2024-x64
3trichlorom...-4.dll
windows10-2004-x64
3trichlorom...-4.dll
windows11-ltsc_2024-x64
3trichlorom...mu.exe
windows10-2004-x64
3trichlorom...mu.exe
windows11-ltsc_2024-x64
3trichlorom...ss.exe
windows10-2004-x64
3trichlorom...ss.exe
windows11-ltsc_2024-x64
3trichlorom...sm.exe
windows10-2004-x64
1trichlorom...sm.exe
windows11-ltsc_2024-x64
1trichlorom...in.exe
windows10-2004-x64
7trichlorom...in.exe
windows11-ltsc_2024-x64
7trichlorom...bin.py
windows10-2004-x64
3trichlorom...bin.py
windows11-ltsc_2024-x64
3trichlorom...ne.exe
windows10-2004-x64
3trichlorom...ne.exe
windows11-ltsc_2024-x64
3trichlorom...ty.exe
windows10-2004-x64
3trichlorom...ty.exe
windows11-ltsc_2024-x64
3trichloromethane.exe
windows10-2004-x64
3trichloromethane.exe
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
trichloromethane.exe-Malware-main/trichloromethane-safety.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral2
Sample
trichloromethane.exe-Malware-main/trichloromethane-safety.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral5
Sample
trichloromethane.exe-Malware-main/trichloromethane.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral6
Sample
trichloromethane.exe-Malware-main/trichloromethane.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral7
Sample
trichloromethane-safety.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral8
Sample
trichloromethane-safety.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral9
Sample
trichloromethane.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral10
Sample
trichloromethane.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral11
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Create.bat
Resource
win10v2004-20260911-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral12
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Create.bat
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral13
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/SDL.dll
Resource
win10v2004-20260911-de
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral14
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/SDL.dll
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral15
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/libcurl-4.dll
Resource
win10v2004-20260911-de
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral16
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/libcurl-4.dll
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral17
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/qemu.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral18
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/qemu.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral19
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/compress.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral20
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/compress.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral21
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/nasm.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral22
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/nasm.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral23
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral24
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral25
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.py
Resource
win10v2004-20260911-de
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral26
Sample
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.py
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral27
Sample
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral28
Sample
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral29
Sample
trichloromethane-safety.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral30
Sample
trichloromethane-safety.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral31
Sample
trichloromethane.exe
Resource
win10v2004-20260911-de
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral32
Sample
trichloromethane.exe
Resource
win11ltsc2024-20260911-de
windows11-ltsc_2024-x64
1 signatures
900 seconds
General
- Target trichloromethane.exe-Malware-main.zip
- Size 11.9MB
- Sample261024-xv9bfaby5t
- SHA256 212689dd6b767a3b00e39654a03b3b8df7d50fdfbb00b139c7a697e4bdf1b6a6
- MD5 88ba7d3e553c95040252de9fcec8027d
- SHA1 e2cc3d76ef55615b42a0f0308e1c930e69335e32
- SHA512 2b0eab77d77b9bb22c539ba433cef77ccc04c22da7f088644bb63256882a62ecb4c1ddf2474b467e5b338c1bb7a56cc9468cb634d27d49caca9def38e2ec53dd
- SSDEEP 196608:Db8NzEUevvfumu9myPyFIRx9czsykV7O9QbbYXbYRqhl6YAzi1ow0vAGrT8AtK5P:Db8NbeHfuhyFI3qd6xMeegeP0nX8AILV
- TLSH T1B4C633E6D5FA87C2FD362D73E9D3C7B43F464A41B13025A0B80C2918ABCD65D163298B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 14 IoCs
Checks for missing Authenticode signature.
resource unpack001/trichloromethane.exe-Malware-main/trichloromethane-safety.exe unpack001/trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.exe unpack001/trichloromethane.exe-Malware-main/trichloromethane.exe unpack002/trichloromethane-safety.exe unpack002/trichloromethane.exe unpack001/trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/SDL.dll unpack001/trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/libcurl-4.dll unpack001/trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/qemu.exe unpack001/trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/compress.exe unpack001/trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/nasm.exe unpack001/trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.exe unpack001/trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.exe unpack004/trichloromethane-safety.exe unpack004/trichloromethane.exe
File Explorer
-
trichloromethane.exe-Malware-main.zip.zip 11.9MB
-
trichloromethane.exe-Malware-main/readme.txt3KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety.exe.exe 83KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.exe.exe 83KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.iobj65KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.ipdb21KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.pdb3.0MB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane-safety.sln1KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/CL.command.1.tlog894B
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/CL.read.1.tlog15KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/CL.write.1.tlog582B
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/link.command.1.tlog1KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/link.read.1.tlog3KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/link.write.1.tlog922B
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/trichloromethane-safety.lastbuildstate218B
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane-safety.obj88KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.log816B
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.obj221KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/CL.command.1.tlog838B
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/CL.read.1.tlog15KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/CL.write.1.tlog512B
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/link.command.1.tlog1KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/link.read.1.tlog3KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/link.write.1.tlog782B
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/trichloromethane.lastbuildstate211B
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/vc140.pdb140KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/vc141.pdb60KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/trichloromethane-safety.cpp16KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/trichloromethane.vcxproj.xml 6KB
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/trichloromethane.vcxproj.filters996B
-
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/trichloromethane.vcxproj.user168B
-
trichloromethane.exe-Malware-main/trichloromethane.exe.exe 120KB
-
trichloromethane.exe-Malware-main/trichloromethane.zip.zip 104KB
-
readme.txt3KB
-
trichloromethane-safety.exe.exe 83KB
-
trichloromethane.exe.exe 120KB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Create.bat397B
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Data/decompress.asm1018B
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Data/kernel.asm5KB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Image/Custom.bin12KB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Image/Custom.png.png 18KB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/SDL.dll.dll 1.0MB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/bios.bin128KB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/libcurl-4.dll.dll 295KB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/pxe-e1000.bin70KB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/qemu.exe.exe 2.5MB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/vgabios-cirrus.bin35KB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/compress.cpp2KB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/compress.exe.exe 50KB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/nasm.exe.exe 1.2MB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.exe.exe 8.5MB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.py1KB
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.spec416B
-
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/disk.img32KB
-
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.exe.exe 120KB
-
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.iobj104KB
-
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.ipdb26KB
-
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.pdb3.4MB
-
trichloromethane.exe-Malware-main/trichloromethane/readme.txt3KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane.sln1KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane.zip.zip 104KB
-
readme.txt3KB
-
trichloromethane-safety.exe.exe 83KB
-
trichloromethane.exe.exe 120KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.log621B
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.obj221KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/CL.command.1.tlog838B
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/CL.read.1.tlog15KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/CL.write.1.tlog512B
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/link.command.1.tlog1KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/link.read.1.tlog3KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/link.write.1.tlog782B
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/trichloromethane.lastbuildstate211B
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/vc140.pdb140KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/vc141.pdb60KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/mbr.h194KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/trichloromethane.cpp18KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/trichloromethane.vcxproj.xml 6KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/trichloromethane.vcxproj.filters1KB
-
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/trichloromethane.vcxproj.user168B
trichloromethane.exe-Malware-main/readme.txt
- SHA256 ccfd86be4bd348d669d619daf3239c616a1fc6bded7f7489af3c4dfbfcee36e2
- MD5 ecb6d902c35c9a01c37620457e4d1908
- SHA1 936208f7e3665abbd7d28e939c4dd2512b9123c9
- SHA512 eba7f9ad42a2ebd56f424084a3b80352b8b6ab9be9b832827379515cea17f67b51790ad5ba7a345b3526b3563660afaa1c68ef073d14e2627e7e5c696e18a1e4
- TLSH T1F1518D36E084733107AE4E6111F1FCAD63A628E2CA775511F4EEAAD0BF76C24EC199C4
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety.exe
- IMPHASH 706501924a0d42ff7e58e5d69ef7c49c
- SHA256 da79e0317881f0600ddaddf593184b1e7d6eb54604de089e4d625741e21c004b
- MD5 1453f56916c0ea96b9ba5b49f09757e2
- SHA1 3e25edc13b69e5db4769f061f586e42b812996bf
- SHA512 37febf9c7bd3f35b45de356e8dc92a9bd5e065471669cb9afdb7048308df0c852b3cbfc5f2a3cab2887d67c9dab4f2fb2bb21ee9de42d13b700784367d1f8ca6
- SSDEEP 1536:X5RkE0HODVj5XVgyi31RRzuo3tpwOcr2zS5KTV8yYJcsWrcd6/MAedu:X590HODVViFRRz3dpxe2zSwTXoj6/Mz0
- TLSH T1C0836B51F5D0C871E4B71A350478CEA09A2EFD614F159EAB3388062F8FA81C19A39D7F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12252
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ACER\source\repos\trichloromethane-safety\Release\trichloromethane-safety.pdb
kernel32
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
CreateFileW
CreateThread
CloseHandle
TerminateThread
Sleep
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
SetStdHandle
GetFileType
RaiseException
user32
ReleaseDC
InvalidateRect
GetDesktopWindow
GetSystemMetrics
GetDC
GetWindowRect
gdi32
DeleteObject
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
PatBlt
DeleteDC
TextOutW
SetTextColor
Rectangle
SelectClipRgn
SetBkColor
CreateEllipticRgn
CreateSolidBrush
Ellipse
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=120, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=112, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.exe
- IMPHASH 706501924a0d42ff7e58e5d69ef7c49c
- SHA256 da79e0317881f0600ddaddf593184b1e7d6eb54604de089e4d625741e21c004b
- MD5 1453f56916c0ea96b9ba5b49f09757e2
- SHA1 3e25edc13b69e5db4769f061f586e42b812996bf
- SHA512 37febf9c7bd3f35b45de356e8dc92a9bd5e065471669cb9afdb7048308df0c852b3cbfc5f2a3cab2887d67c9dab4f2fb2bb21ee9de42d13b700784367d1f8ca6
- SSDEEP 1536:X5RkE0HODVj5XVgyi31RRzuo3tpwOcr2zS5KTV8yYJcsWrcd6/MAedu:X590HODVViFRRz3dpxe2zSwTXoj6/Mz0
- TLSH T1C0836B51F5D0C871E4B71A350478CEA09A2EFD614F159EAB3388062F8FA81C19A39D7F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12252
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ACER\source\repos\trichloromethane-safety\Release\trichloromethane-safety.pdb
kernel32
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
CreateFileW
CreateThread
CloseHandle
TerminateThread
Sleep
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
SetStdHandle
GetFileType
RaiseException
user32
ReleaseDC
InvalidateRect
GetDesktopWindow
GetSystemMetrics
GetDC
GetWindowRect
gdi32
DeleteObject
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
PatBlt
DeleteDC
TextOutW
SetTextColor
Rectangle
SelectClipRgn
SetBkColor
CreateEllipticRgn
CreateSolidBrush
Ellipse
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=120, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=112, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.iobj
- SHA256 610c3741130639623768b80f9895583019e8d4b9bb318e60720fb2758dc74c0b
- MD5 3dcb7f68f92ee26aab75e81125e06c27
- SHA1 e21093d5f3d616377001cc02a11548125c8aa5b6
- SHA512 211143ff72f280e0fa6ed1700079f2975eddaa6fa3b099dd82309cf8f4f6ceec5609b9fd984ee1d194405b37ca64f8c71b694bee641087d09c7537fef340147a
- SSDEEP 1536:l5JeP+Qan7QyePEVEDdTpxxjnvNHO28Rn8rxSnJQivIGKle765useXkiV2OUnDih:vJePm0rESrxxjnVu28CxSn6GKlg6wsej
- TLSH T1FA639217F084E522CE3D053575478ECD733DE241AA9F234B336CF66969C232ACAA50D9
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.ipdb
- SHA256 a4f48957aadd131e0854a3542f65f299a517ec9387169e7640f5653ab28457a4
- MD5 81e07466c337dcdf0272f56ae16755de
- SHA1 c1dc9ee6c95925fc4b8034f387ae90eb11bc078f
- SHA512 849fd10c6c9b380a0fa21ba947fd25601e30c37d38429563065f5de872296d512726557fe9504b2854d2e13c116248daf843b197d0fda3428016359e383b816f
- SSDEEP 96:zuIbaP60Acq9RYX/igkuk0MYSoi8v7M2id4uu746wg2h4tqiccok04NFRDzl2fPP:zuyPEJp55Mbd4u046wfhbiZdzl2fPrj
- TLSH T1B3A20E6DBB92CE32CC2D0A7008A78F110B63E45169D2132713766C0C9C776E45F32EBA
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/Release/trichloromethane-safety.pdb
- SHA256 bde0b4ec4b569969dd2012f135531d67257a6f33fb2850531878b67b6f20c1bb
- MD5 4e571701a0bd22fc5a90d8c2ef8f07d9
- SHA1 bbb1e1c79fe7aa45d90b5f94735b291d65a2a3cd
- SHA512 384a205f7dc6d39ee4d478cc566d181aebe4e4bef246ada29ec3beec86b66856e54b22d898672d2ed09adf509dfa86745d5b5ab16077ebb961e033440fff1696
- SSDEEP 49152:Fxtcaao2lVYhSl7qoeONc/jQPJLtpWZmjwP2gKIgM+nG8+wI2fSQW/9r3dzpB8UE:FDcaao2lVYhSl7qoeONc/jQPJLtpWZmj
- TLSH T115E5187DE9906F22C40EBD7D553F0B4E93809E2A8FFA17E5911CF60C1AE2360E564E16
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane-safety.sln
- SHA256 efc3319a3c08059fb50eb66772526578205815dc34991c79472f164fd8865455
- MD5 83205a07c8cecbeff9d4bccb74bcfeb0
- SHA1 677c7da6562aa0af4d28f230b05b3d73358b93e5
- SHA512 2c921cc70dc7604784b44312a2cf58bc9646093ea693af16cfbce3a5d01f785b78793cb8e59824f8b10f54ae3a67005576b98edb54842d608a0b99ffeae22824
- TLSH T187315CEC725E9592978A33AFC4704EC93F7786459298553EF086208C6B1BF03815F59B
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/CL.command.1.tlog
- SHA256 98dd978236f446418476ecf57e6516209e7ccafb96dfd74487e8c0004b6a2de3
- MD5 b693f472170dd498b610380868f52d2a
- SHA1 86384e9d109470f6416b2976fb0b6ec62edb6747
- SHA512 5f55bf1fb0a535d0675b0844a9889b7984c77a14e976ab6518b749f262a8165dc6d08653458980df88b3051a4ad75bf428b161fa6465353e6b5397dfc521538f
- TLSH T1AB119E11A0EC610A5373B2CD4FCFDADBCAB4E2B94277093B01B801035760E48DE02B79
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/CL.read.1.tlog
- SHA256 f1d92cb61ba8193ee383ffb7357ec9f9eb6538edd36d76602ac0ebda7fe151d9
- MD5 aca0c1b7946cdd4eaebfd99da0b0ad2a
- SHA1 a5b1f6b456e395ae3285ef35425628f54f8eb9e3
- SHA512 14bd86c63cf0249f8edc4b79410591905b68bc77faef436929f539d98d5722c17847c44c4e9db833e5896e0068154f0ef2b37dd6049a7e16289a566787aff381
- SSDEEP 96:WE0v0Ae7RrvlNcpy6b5ixJlJqJ/JewOsuPoWuQQyqs4/Dxg1SYEL9UMNtHBnE:WE0vJef0yqs4/FS
- TLSH T18962DE2870FE1248231775D6AFCBAA99CB27F278833F532F1594420306919564E9AF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/CL.write.1.tlog
- SHA256 fd9568404771f25f673a4c54aea9ba8d4bb6e6d005086da4ec231df0f2f8b1d8
- MD5 beab29462363e38227a4dadbf454ef2a
- SHA1 e6285eee4f81fe3657be3197168587c6f8ce9525
- SHA512 e36be19ddb930f9f246505911ac46f316c71ede9d55ad5961ae64a1c09ac46611c181cc7eed89829795b3ac653a07d9040e0a380f7c9b4243cb69b11ec34571f
- TLSH T195F02855E4E561454377F1C10FC6EEE8DEF9D179977B0A7B05DC4003AB906888E035B5
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/link.command.1.tlog
- SHA256 e649b13ba6ff2cb4fa179db80a9eaafa036d186339ac59f7290c9dcb7471c834
- MD5 ddcf0fe7b5e031d14b5ac9dd9b161c94
- SHA1 555e0641a78b4ba716fdfca33ae0feebf84ac7da
- SHA512 36acef4d839fe6f56912c4fb87342f936b2fcd8720742f90538856dd95e4fb7dfbf5b3ec4879f981d8431485d9d08a67479a69334494068a030a822d1ccd771a
- TLSH T1D331AE19B4E821084377F1C50FCACAF9CB79F66A967B0A7F08E4844B4761A85AE02674
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/link.read.1.tlog
- SHA256 94a43cf3b14fb63c7e6538fd89f0b80dee4bf37d7c4d96ec767eef7a0c5ffec6
- MD5 d7fd423406740602f859f80761c04ba0
- SHA1 9faa43afa14644d321821350265b04c11e613501
- SHA512 48c18516964955df1de73a8fd7654a051f47ecc27b6e7ed2c8b6d74877738bcb4fd09cfce182bb23541d5624a256b9b63cd20fc1a7a06502da8e693805e1b85f
- TLSH T13D711B2574FA22541346B0C54BCAE6B9CB27F228963F133F49D4424707E25974E4BBAA
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/link.write.1.tlog
- SHA256 7869fe9cf4195a53ef7ce59c6f5cbe5a68faf68db96fb66a1a9e45ca94b3584d
- MD5 3284545df18764c2b02fd9b72aec022d
- SHA1 c2d4da000d1ab58fb1c292a9de837eb9290945e9
- SHA512 d7cfaa654de9fd14789b0a5f085840866eb23a1bca824685fa6fe1b0fab8b984428d5095e113c15b4d8082c81e49ecde802004e683392681be16cfa1157fc2d7
- TLSH T1F8114C66F4E5A1454377F0C10FC6EEE8DEB9D17A97BB097B04DC4403AB90A888E035B4
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichlor.fdde3bcc.tlog/trichloromethane-safety.lastbuildstate
- SHA256 1469713f0be00218afbb81368b1af56b4c2a4bb735075af7e099335f1ef11ab5
- MD5 1670c02d3c0a116c9b63a516bfa947ca
- SHA1 d120146627dce7fd97e5f8f33433e48e204570bf
- SHA512 0c78746125c25f9d9377b85885748bcb52aae2e27a5f86b3759480e758a916bbc619120668b5872e83f4817dfbe9980f2d2d08b8ba0d73ae585f2f697a6f259c
- TLSH T1C5D0A704A63C56A72067181B79F28A4943784480B174301D5641A408F7B945D10533B3
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane-safety.obj
- SHA256 4f8f64957bf31ce4218c8f85f230c783fdab2c1af409037f2cf279e90eca9ced
- MD5 c95bff83bec14a7d49af2fb37016ee7e
- SHA1 16c90bb4fcbcf54d0fd31b97fe1d705132df7311
- SHA512 986ac4c076d1f6f976c159ea04f87dae0e1c865676f702bdc715805917a19c3011f25ed0293c3ec6777bed207981ac7892da9af36f1098344db456ea04a1e3e3
- SSDEEP 1536:c1EFpAwizuwrnUEJ+j+mIw4sd8yl8ORu3Wo4aHUHS95HREGL:c1EpAwvwrUEJC+mIVsd8yl8Os3Wo4vH2
- TLSH T10293D8C9C1D8DECBDE571532E1BD12233082D6DA8FF255819A3CCADD8A6F255887C1A3
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.log
- SHA256 00309d65aedcd4b1fcd3fe488879668ef42b96a8405556ea575567752c019950
- MD5 a88088bbf931f4762b656e1bbe9b30b4
- SHA1 a8e35ea444756239ee95f0d2942604e5afa2c359
- SHA512 246c85267289639fd04cca7aad0a58adebcb473725abe377aeac5e3c516b25ca5b84c72aeace09866806a590410bcbc580ab2d7e3fee36962ffae8b298515b9e
- TLSH T1E601C23EE16D43D7703B35567E878925E93359517234332A3589DB0CF3C293585322D1
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.obj
- SHA256 9e39b5b8ce3c980971a4a0b8e8d3dafee81d169cdbb8d1d44ec9385abd807651
- MD5 4452a0d0ff8f643c1af01aef1664de8a
- SHA1 ff22a6547642a0e24acca63f826946cc4628c8ef
- SHA512 1ac3960a3fae04a9423d3b00c94f1ebb6a6dddc87fcea1600347d5b3f092ae382c3d2c60958424f29867963f0ffdd5d3649e0e8e2bad89bbf44b02c501876472
- SSDEEP 3072:EgHpAwtw9qWGhTxO+qTfPahmIVsd8yl8Os3Wo4VSOXBt:E4RO7OhmIVsd8yl8Os3WoRC/
- TLSH T18924D8CBF0849B87ED9E1732B57A0333349066C58BBD6AA5552CC6DC8A772F884350DE
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/CL.command.1.tlog
- SHA256 12df0124ffbb84e17aceb27d9f68db45c40091e42754443e6030e9c430ffd917
- MD5 2e8f229c30677aa88babf0b2cd3e1d7a
- SHA1 566ee3b73bda143cd2d02c9738fb3bd1e2ff095e
- SHA512 db4e0fbd4dd47f75d53685d93c1ee173ed8fbf8d0fbdcca0d38c7c4d95fcde41a55c7fa0f0f9e1e7a0def6a7c17a6ccd59e7327ad64436cde4f0b67720618586
- TLSH T10B017C11A1ECA10A537372CD4FDFD6CBCEB4E2B95677053B41B841079324A44EE01B79
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/CL.read.1.tlog
- SHA256 c12509e290321aa5b7722b0aa9ad3922b48603e7e26b28c2e372e54acd26359c
- MD5 8cab0c96b4aaa477914e122cbdf2481c
- SHA1 e3a63abeeab8ae1648a19bf1898c21091063f6c1
- SHA512 9a17d9409b2fa5b8647e15a2f5406a26a0c20b1554a94a401d1f1893083f0f75d6292214c585cb6a768f466b76c5483c307b85e19fc164c472d6752da4bc723c
- SSDEEP 96:WEvv/Ae7RrvlNcpy6b5ixJlJqJ/JewOsuPoWuQQyqs4/Dxg1SYEL9UMNtHBnQEvI:WEvvIef0yqs4/F+EvI
- TLSH T15F62DF2870FE1248231775D6AFCBAA99CB27F378833F532F1594420306919564E9AF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/CL.write.1.tlog
- SHA256 d867a72b7888b9f84abf5239fd6928dda7636205677be6c94f0fd75efa69a2aa
- MD5 b36f3456f3d7ae0dcab247ca5c4d2df4
- SHA1 b4182b9a67670c66be5fd5da49746e1de248d7ff
- SHA512 033ef0b2204d72ec883a79725b7cd827a53386b3ab3c13d88dae3251051abb361e323a5c6b0bfa4f2be377fad5f6a8f3d7bdf2a2d3a2c3bea2839fc7ba52f758
- TLSH T1C2F04556E8D96146033371C10EC6EBD8DEF5D2B9976B0A3B05DC8003E3605C8CF011B9
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/link.command.1.tlog
- SHA256 971f25518beadb59ea7c68019bcd4cd0c729c4dd613fd870dc80be4f9b36e541
- MD5 1e56c346721edb4cb483c89d76da43aa
- SHA1 52bc600867039fe167b0d2b55ed37428fa377d39
- SHA512 050e6dd0bba3a5ada43d0758131887dcb225f78142bb56c3242ab338969edd072f318fa4f92d779d042e1bbbeebb0063686d2c8abb10475c1b79e3ecf36462db
- TLSH T181317E19B4D971494333B1C50FDAD6BACB7AF669977B0B3F08E4844F9321981AE01774
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/link.read.1.tlog
- SHA256 09be7e8a685a68e1e9f6b2712ad4cc4797de32eb2144bd9de4d46e3cabd373bf
- MD5 c2d7215f077c74d846ec8149e217dc9c
- SHA1 f66b0b720150af284d85f18fd43830b7c93e5f04
- SHA512 95037b4569097c15f62d7ef51c12f14ea3cef7e61cf36e00876f0e2cc6b0b314ab547ae254f0058d108058b1ceee8a679e3acb8af6aff160a296f319842aa414
- TLSH T1E3811E2574FA22541316B0C54FCAE6A9CB67F238963F133F49D8424707A24974E4BBBA
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/link.write.1.tlog
- SHA256 027e608c020387acfcf16c0b272f911ab5be016e1efc6b286d30b4f4cfa868f1
- MD5 6d912132c19aa5f185e525157d93ccbb
- SHA1 f90aa0596ee80222172de678577ec97139fac877
- SHA512 687cebd3c19f4d28311e41d88b75b98e593a6a37c7c92169db830880356737f2e9e5ade1f5e9d6c8b5f768fba8605a8d582d7171b08f99525e686a42b050b62d
- TLSH T1D101666AF4D9A146033370C10FC6EAD8DEF5E2B99BAB063B04DC8407E3605C88E011B4
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/trichloromethane.tlog/trichloromethane.lastbuildstate
- SHA256 e96fa817c6a0848c64a49b21281d07a042f9079ed1628128eaf39952449a7e05
- MD5 644eb67dbc52d7bbe5224e5e8ce936c5
- SHA1 7e8ca4cde6b1df61d094d91ba6c68d2c5fab4739
- SHA512 7930132600dc7ecec2ff261393d7572fa17f5504449bc9a5ce3f6a4268cd75de55cc233d85d23a1e0774bd4177fb27a100113e3efc0f8299267a40f5d497a71c
- TLSH T10AD02304A73C56E73067581B74F1468D437444C0B174301C5541740CE7FA45D10533F3
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/vc140.pdb
- SHA256 5029811fc1333b7a4891992b0301d4e98550362d52dec40de808fbce74942d39
- MD5 f14afbeba9a7df948ea8472f065dec41
- SHA1 f2a60b18356c8ef00449f7e950cb79a2e0bc3edd
- SHA512 a9f3f01e381de8bfbdf1ac277d64b2277f99873c31be6045495508a6fc4d47d123a507b158109814055bb1d0f50460327e8489a5b3d0d75ef36a167cd3faa710
- SSDEEP 1536:GRqRsrr14H/tB5K16qShGEyz4wIcBGrSrD71Qiq1GNzLg0LkRqR2i128428:GARJ/tTu6qS8HtQBEg4kARd28428
- TLSH T1CFE3933AF951BDB3D55E2B3D580B1624732E5E80D7CC538426A5BB3904FB368AEB8341
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/Release/vc141.pdb
- SHA256 add1ac4d1b42eeb7f8b3a3c863e4b4c0de748761ce8c79e486ecf296c25ac79b
- MD5 3dd7556e728cdbca24bffbd1978a3bc2
- SHA1 d2775bada22cb19beb5f18f55d9b32029c3462c3
- SHA512 35870231b34987762d57bdb3a1de3b8c19281cdd6de290419a5e1d385e20e8f33245ba33752e22b12e255e24f7e35a444187db558e8987a73f2a0eac7a790700
- SSDEEP 192:dy+A1gq+HNhG7GWcI4IBG6ZeMxS6SWumeeXdwxVsTKgny+A1gq+HNhG7GXkcI4IE:vX+7GeeosWCetwQ95X+7G
- TLSH T1E1533E2AA696B863D24E6F38190F491473262EC0C7DC53C13A95773888F7778EDB4791
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/trichloromethane-safety.cpp
- SHA256 03347324f3612a8e78ffe75c89963e642ba8f075402451220975f16502ae4825
- MD5 05af043650cf1b0373c4a1270f3a9281
- SHA1 6753d450cd87f0f73728e30d75023493cdf12493
- SHA512 7d437d107ba4a86ae2e147941658e827245b52a86102aa84fb556d40fcf6db65f692cce6d819a6776dfc2a30c1c015cdae3047daaf6df0c6cac39f81da70e4f4
- SSDEEP 384:tZgyrwS+xMnujBAjACN8yrwlyrwTyrwP/zTPBArqq7LBDqk0DjJ2TCrqq7LRJDDI:tmSGMsvFfPl1jTKv
- TLSH T1837275FAB95C65BC9AA2C93BC7BDCC05C9BDC0002229591F7CCDD56AE4A84D2C770E52
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/trichloromethane.vcxproj
- SHA256 4d4eac1fd2efc036c22ef6cb1a2a1a53a29d77a88510361653e0dc766eaa865d
- MD5 77135cb4db27bfc6bca6b6044a53ddbb
- SHA1 df21387155099a8bba62ce00856d9d7ab8936dc5
- SHA512 0bf634182059dcadb500f575eaa26aac9f8e55da5102fdd38eb4aa58ec1ad64afd285b2490679f685c98bc33e72a9cae80e3408e8c19dacc4385a639cad9d882
- SSDEEP 192:e/zcR4s+4hp/YPcX8JznXfrXJ/gPcL/xPc/:G4f/cO8FXzXJ/k2/lS
- TLSH T181E1FB94E0E02A5681B3422BE5E34991EF71C3830D5B4C6CFA9EE34B4F775586223B32
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/trichloromethane.vcxproj.filters
- SHA256 3b607c76ae0c41bcfdc6b0f1a68d23d8ba1a5b4afc69ef9857453468bad230bb
- MD5 8e725005aab8edfefbb45917fcad09a2
- SHA1 f0b521ae2a70434991ed766a832f385697102871
- SHA512 e0d22b726cdbd494f0a7cfb60169f13f0cb8a6a421d9ea99df7d2bc0d3b52020070268c930c44ed16ac3ce48a9ff822870dcb6d559eae284b6144ef8132956aa
- TLSH T10D117D1188DC3B942137A82BFFC0CA55EF69A1F331D1114176E9C4071BF2318A537754
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane-safety/trichloromethane/trichloromethane.vcxproj.user
- SHA256 c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676
- MD5 244d056f5e959be6d9a2f7e94686f1c8
- SHA1 3ba38385380485d9ff25eb142eca0a01d8ce2fab
- SHA512 8d5c4c9e54c85c90224f7610fef69d9c7e8d0db6be369181ebed13e2be9c86b651a438f1978f99c3ef432a8cb6bc5b8df26c476e7e5b32511d0d31cd49b55f20
- TLSH T149C08C449600E821B7B0AA3493ACD87CF3FAB2E324F088ACF6D4D90D21071A860213A3
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane.exe
- IMPHASH bc9cfcce00a17456eb9bd280263e0da3
- SHA256 2829a026d0c7f6ca2fcba66eeef48606c3307312898fefef8af269dcb2158155
- MD5 5e8ce90547acca8bd050fccb885558a2
- SHA1 a65ca5ddbcabeca7a5b9a243131bf8ce6798e15a
- SHA512 ac4aace898b8fa9037590edcce478c649aed9daf4d7fc2285f045aecf0f86d25a69903b1458b96964f6f7e9d4fb8f79ce923896b5ff84008f9f32bf86ff11d8f
- SSDEEP 3072:87Vs+B4vSgLkgjIldksHYfYjbyKK03T9zqKyM:24vSuKXHtl
- TLSH T1AEC36A20F4D1C472E4B259320875CEA19E2DFE712F555BAB33D4127A4E340C19A7AEBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12644
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ACER\source\repos\trichloromethane\Release\trichloromethane.pdb
kernel32
FlushFileBuffers
HeapReAlloc
GetConsoleCP
GetProcessHeap
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
ExitProcess
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
TerminateThread
Sleep
CreateFileW
HeapSize
WriteFile
GetStringTypeW
GetFileType
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
RaiseException
user32
GetCursorPos
ReleaseDC
SetCursorPos
InvalidateRect
GetDesktopWindow
GetWindowRect
GetDC
MessageBoxW
GetSystemMetrics
BlockInput
gdi32
SelectObject
CreateDIBSection
CreateCompatibleDC
PatBlt
DeleteDC
TextOutW
SetTextColor
Rectangle
SelectClipRgn
SetBkColor
Ellipse
DeleteObject
CreateSolidBrush
CreateEllipticRgn
BitBlt
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=131, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=18, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=122, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
trichloromethane.exe-Malware-main/trichloromethane.zip
- SHA256 d163f4cf4abd7933bc09af260e30890c36267048fcf9faa848203304f5d90fbc
- MD5 2edc3e912f5586761f10022adb9e11e1
- SHA1 d112c7c9eea191a74171857506a851d6f12cb7f5
- SHA512 0607c7144cad30f104a6f25845f32cb61e3bf529048fca03339149b9610cc011e2a384d57dd9927b8d048e563ec6fac5773347e33612c5bef505205222e2dec0
- SSDEEP 3072:Np7OYRdZKMMJnkk84GU6S24C+XtxwVTXEvB:7NnKMG984Gz2C+HwV7EZ
- TLSH T12AA312A1921B7F01EA175F6E7581BFBA384EF5DB2B136891BD84D4421DA19F0090BE0F
- MD5 SHA1 SHA512 SSDEEP TLSH
readme.txt
- SHA256 ccfd86be4bd348d669d619daf3239c616a1fc6bded7f7489af3c4dfbfcee36e2
- MD5 ecb6d902c35c9a01c37620457e4d1908
- SHA1 936208f7e3665abbd7d28e939c4dd2512b9123c9
- SHA512 eba7f9ad42a2ebd56f424084a3b80352b8b6ab9be9b832827379515cea17f67b51790ad5ba7a345b3526b3563660afaa1c68ef073d14e2627e7e5c696e18a1e4
- TLSH T1F1518D36E084733107AE4E6111F1FCAD63A628E2CA775511F4EEAAD0BF76C24EC199C4
- MD5 SHA1 SHA512 TLSH
trichloromethane-safety.exe
- IMPHASH 706501924a0d42ff7e58e5d69ef7c49c
- SHA256 da79e0317881f0600ddaddf593184b1e7d6eb54604de089e4d625741e21c004b
- MD5 1453f56916c0ea96b9ba5b49f09757e2
- SHA1 3e25edc13b69e5db4769f061f586e42b812996bf
- SHA512 37febf9c7bd3f35b45de356e8dc92a9bd5e065471669cb9afdb7048308df0c852b3cbfc5f2a3cab2887d67c9dab4f2fb2bb21ee9de42d13b700784367d1f8ca6
- SSDEEP 1536:X5RkE0HODVj5XVgyi31RRzuo3tpwOcr2zS5KTV8yYJcsWrcd6/MAedu:X590HODVViFRRz3dpxe2zSwTXoj6/Mz0
- TLSH T1C0836B51F5D0C871E4B71A350478CEA09A2EFD614F159EAB3388062F8FA81C19A39D7F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12252
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ACER\source\repos\trichloromethane-safety\Release\trichloromethane-safety.pdb
kernel32
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
CreateFileW
CreateThread
CloseHandle
TerminateThread
Sleep
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
SetStdHandle
GetFileType
RaiseException
user32
ReleaseDC
InvalidateRect
GetDesktopWindow
GetSystemMetrics
GetDC
GetWindowRect
gdi32
DeleteObject
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
PatBlt
DeleteDC
TextOutW
SetTextColor
Rectangle
SelectClipRgn
SetBkColor
CreateEllipticRgn
CreateSolidBrush
Ellipse
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=120, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=112, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
trichloromethane.exe
- IMPHASH bc9cfcce00a17456eb9bd280263e0da3
- SHA256 2829a026d0c7f6ca2fcba66eeef48606c3307312898fefef8af269dcb2158155
- MD5 5e8ce90547acca8bd050fccb885558a2
- SHA1 a65ca5ddbcabeca7a5b9a243131bf8ce6798e15a
- SHA512 ac4aace898b8fa9037590edcce478c649aed9daf4d7fc2285f045aecf0f86d25a69903b1458b96964f6f7e9d4fb8f79ce923896b5ff84008f9f32bf86ff11d8f
- SSDEEP 3072:87Vs+B4vSgLkgjIldksHYfYjbyKK03T9zqKyM:24vSuKXHtl
- TLSH T1AEC36A20F4D1C472E4B259320875CEA19E2DFE712F555BAB33D4127A4E340C19A7AEBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12644
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ACER\source\repos\trichloromethane\Release\trichloromethane.pdb
kernel32
FlushFileBuffers
HeapReAlloc
GetConsoleCP
GetProcessHeap
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
ExitProcess
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
TerminateThread
Sleep
CreateFileW
HeapSize
WriteFile
GetStringTypeW
GetFileType
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
RaiseException
user32
GetCursorPos
ReleaseDC
SetCursorPos
InvalidateRect
GetDesktopWindow
GetWindowRect
GetDC
MessageBoxW
GetSystemMetrics
BlockInput
gdi32
SelectObject
CreateDIBSection
CreateCompatibleDC
PatBlt
DeleteDC
TextOutW
SetTextColor
Rectangle
SelectClipRgn
SetBkColor
Ellipse
DeleteObject
CreateSolidBrush
CreateEllipticRgn
BitBlt
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=131, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=18, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=122, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Create.bat
- SHA256 05a3a4faa2422e5d923439f6bafb331e0c1a2a2a334f376bdda6a49feef90e09
- MD5 61e988b23f22b1c21626df02ca92b010
- SHA1 bd60038f968325dbe556f583d0ae7ea306c6d332
- SHA512 cbc564bd2af5b901cacb2114ab26a4dce12575a3e6a2fb20547adfef0605b2481020faa9837556fcec3fbecee146ce373905535f58c86a8f1d81e624574b2538
- TLSH T15CE0ED645BB609F578CF0E2AB0C8DD8D51D3CD82CE8823483448022ACAEDF206405AE1
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Data/decompress.asm
- SHA256 3711c36eb6c4c93c88ee8fe31d2f32e4324b83a8336e7ca24e5adc3206dfa572
- MD5 92d328c40ad015ee16ca8e0a3024bddc
- SHA1 323f2cb3eb6f3315aab84dee013ace175c47d87f
- SHA512 f22b86fb492f07622a2fdfc4462e530f49bbc532cf0a2eddb4c17e7e91b55f8ca1a730cff49420bb8d84b248f54ad3987523a3fd4d404baaa4a5629a3558672e
- TLSH T14511591A305C2AE0301020BD87515DAF64D8769F31186D28B61C93B37F25664EDF00F4
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Data/kernel.asm
- SHA256 6eb08dcb31b524997c5c04101d75fc383c641e74f0e8e22f531ca0e32554d488
- MD5 cbbbdd6f0e7adf9e8a98744775875d42
- SHA1 185ed2eede1707d408a59b162ff0ec07c4405af8
- SHA512 59395fbf5008418064f68f37ff20fd84f3983af813763f174ad5f78ef9bde8c5a628920f476cf758b6101434015f4a81f6f3aa525969c46c72e0e19dc3dff928
- SSDEEP 96:C13zH/W+ie+3IXw+06pdF2flVihXhsUihMKlh8DdX9cous3:k/WLeMVGWdV4XaU4MKlaDlt3
- TLSH T198B141085014672220A230B5B79B8C6F2698B2FF91DA9A09734D93771FD93FC59F64D0
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Image/Custom.bin
- SHA256 be15e2418475042f994d52b0d37d65c2479e4b0cc28c3269f124e51b9b2acec9
- MD5 5802ac7c83a11248f5e8062f947f5f0f
- SHA1 ef145498aff5cf45a1dfea75140e31ebef23d211
- SHA512 764389d788d1dda34b689abd14d96b29963981af5ac2ac309aafa7f4a7ccc7c7965427fee51dcb8cb3239561b898bdf38927f1d8531116a1d8be0f54b27072c9
- SSDEEP 384:xKurFJX3xJgHiVZ/JoUqH1KU2yK4E82IHEP+Iy9gA:xKurFJTZ/zqR+8yH2h
- TLSH T18242BEBB1DBAE44091A353B34D3EEE5798C4BE2249C429247DE31458E1B184C5BFF2D6
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Image/Custom.png
- SHA256 2dbce8a49be2862982a2ce60310c3d749d189b89766429fc1e16ab135641f1d9
- MD5 03e0844db3748bde486fe2ecef33a32a
- SHA1 ce47ec465d6c9af0c4c1d9d7432a11749574d947
- SHA512 ba25a6ea4edab4ddb68b809fd26a4f8e6316ab5025177e57aaab4fcf9cba73d7a864bce16132cf3b0c266538949300ea777891877b2e39395a44b5fc4c20c3c3
- SSDEEP 384:eJuIJdMGwpQiuc2CUX5g0MIbtR0vQVq1WWXOOemQtQcHix:eJbJbwZb0M+Si1W+OAt3Hix
- TLSH T17A82D0FA354F1B486D4868433DA1AED326F4837FAAD154E1D9AA670CBD440E0069CABC
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/SDL.dll
- IMPHASH 07715dfbd2fb762d2b3fd8ef4273adc9
- SHA256 0cce4795789a49c433d7f9d1ce7663f265f948f672ebde5fec41f2447fcd8741
- MD5 cea03998e710dc5bfc4954cde440333d
- SHA1 a6490955fa171fd85a6e64d06642e129493c7ba4
- SHA512 c2aa76413fa9526abad2a3a61f3d0595027df32bcb7e0005a654625a7c894f386563d277ccda89d6eb96fdb869d262252927cfdf764c26c2dfd5cc966d23cfa3
- SSDEEP 12288:lFqs6ZgPvI6bw3uJwV/MRb2F6t1YAG7S86OIYO8iJghIQoXk6MEgw4u8XcQexssC:lFqs6gvIgoYSF6vE7CwoQ6LwUGdL
- TLSH T127356CE6B7934C8FDA1207FC4CCF67255328F1642B838B6B261495F81A57397EAC490B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4288
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
gdi32
BitBlt
ChoosePixelFormat
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreatePalette
DeleteDC
DeleteObject
DescribePixelFormat
GetDIBits
GetDeviceGammaRamp
GetSystemPaletteEntries
GetSystemPaletteUse
RealizePalette
SelectObject
SelectPalette
SetDIBColorTable
SetDeviceGammaRamp
SetPaletteEntries
SetPixelFormat
SetSystemPaletteUse
SwapBuffers
UnrealizeObject
kernel32
CloseHandle
CreateFileA
CreateMutexA
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
FormatMessageA
FreeLibrary
GetACP
GetCurrentThread
GetCurrentThreadId
GetDriveTypeA
GetEnvironmentVariableA
GetLastError
GetLocaleInfoA
GetModuleHandleA
GetProcAddress
GetVersionExA
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
ReleaseMutex
ReleaseSemaphore
SetEnvironmentVariableA
SetErrorMode
SetFilePointer
SetThreadPriority
Sleep
TerminateThread
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
_strdup
__dllonexit
__lc_codepage
__mb_cur_max
_beginthreadex
_endthreadex
_errno
_iob
_isctype
_pctype
_stricmp
atof
atoi
fclose
fflush
fputc
fread
free
fseek
ftell
fwrite
getenv
localeconv
log
malloc
memcpy
memset
pow
qsort
raise
realloc
signal
sscanf
strchr
strlen
strstr
wcslen
user32
AdjustWindowRect
AdjustWindowRectEx
BeginPaint
CallWindowProcA
ChangeDisplaySettingsA
ClientToScreen
ClipCursor
CreateCursor
CreateIconFromResourceEx
CreateWindowExA
DefWindowProcA
DestroyCursor
DestroyIcon
DestroyWindow
DispatchMessageA
EndPaint
EnumDisplaySettingsA
GetClassInfoA
GetClientRect
GetCursor
GetCursorPos
GetDC
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutNameA
GetKeyboardState
GetMenu
GetMessageA
GetSystemMetrics
GetWindowLongA
GetWindowRect
InvalidateRect
IsZoomed
KillTimer
LoadImageA
LoadKeyboardLayoutA
MapVirtualKeyExA
MapWindowPoints
PeekMessageA
PostMessageA
PostQuitMessage
PtInRect
RegisterClassA
ReleaseCapture
ReleaseDC
SetCapture
SetClassLongA
SetCursor
SetCursorPos
SetFocus
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
ToAsciiEx
ToUnicode
TranslateMessage
UnregisterClassA
WindowFromPoint
winmm
joyGetDevCapsA
joyGetNumDevs
joyGetPosEx
mciGetErrorStringA
mciSendCommandA
timeBeginPeriod
timeEndPeriod
timeGetTime
timeKillEvent
timeSetEvent
waveOutClose
waveOutGetErrorTextA
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
SDL_AddTimer
SDL_AllocRW
SDL_AudioDriverName
SDL_AudioInit
SDL_AudioQuit
SDL_BuildAudioCVT
SDL_CDClose
SDL_CDEject
SDL_CDName
SDL_CDNumDrives
SDL_CDOpen
SDL_CDPause
SDL_CDPlay
SDL_CDPlayTracks
SDL_CDResume
SDL_CDStatus
SDL_CDStop
SDL_ClearError
SDL_CloseAudio
SDL_CondBroadcast
SDL_CondSignal
SDL_CondWait
SDL_CondWaitTimeout
SDL_ConvertAudio
SDL_ConvertSurface
SDL_CreateCond
SDL_CreateCursor
SDL_CreateMutex
SDL_CreateRGBSurface
SDL_CreateRGBSurfaceFrom
SDL_CreateSemaphore
SDL_CreateThread
SDL_CreateYUVOverlay
SDL_Delay
SDL_DestroyCond
SDL_DestroyMutex
SDL_DestroySemaphore
SDL_DisplayFormat
SDL_DisplayFormatAlpha
SDL_DisplayYUVOverlay
SDL_EnableKeyRepeat
SDL_EnableUNICODE
SDL_Error
SDL_EventState
SDL_FillRect
SDL_Flip
SDL_FreeCursor
SDL_FreeRW
SDL_FreeSurface
SDL_FreeWAV
SDL_FreeYUVOverlay
SDL_GL_GetAttribute
SDL_GL_GetProcAddress
SDL_GL_LoadLibrary
SDL_GL_Lock
SDL_GL_SetAttribute
SDL_GL_SwapBuffers
SDL_GL_Unlock
SDL_GL_UpdateRects
SDL_GetAppState
SDL_GetAudioStatus
SDL_GetClipRect
SDL_GetCursor
SDL_GetError
SDL_GetEventFilter
SDL_GetGammaRamp
SDL_GetKeyName
SDL_GetKeyRepeat
SDL_GetKeyState
SDL_GetModState
SDL_GetMouseState
SDL_GetRGB
SDL_GetRGBA
SDL_GetRelativeMouseState
SDL_GetThreadID
SDL_GetTicks
SDL_GetVideoInfo
SDL_GetVideoSurface
SDL_GetWMInfo
SDL_Has3DNow
SDL_Has3DNowExt
SDL_HasAltiVec
SDL_HasMMX
SDL_HasMMXExt
SDL_HasRDTSC
SDL_HasSSE
SDL_HasSSE2
SDL_Init
SDL_InitSubSystem
SDL_JoystickClose
SDL_JoystickEventState
SDL_JoystickGetAxis
SDL_JoystickGetBall
SDL_JoystickGetButton
SDL_JoystickGetHat
SDL_JoystickIndex
SDL_JoystickName
SDL_JoystickNumAxes
SDL_JoystickNumBalls
SDL_JoystickNumButtons
SDL_JoystickNumHats
SDL_JoystickOpen
SDL_JoystickOpened
SDL_JoystickUpdate
SDL_KillThread
SDL_Linked_Version
SDL_ListModes
SDL_LoadBMP_RW
SDL_LoadFunction
SDL_LoadObject
SDL_LoadWAV_RW
SDL_LockAudio
SDL_LockSurface
SDL_LockYUVOverlay
SDL_LowerBlit
SDL_MapRGB
SDL_MapRGBA
SDL_MixAudio
SDL_NumJoysticks
SDL_OpenAudio
SDL_PauseAudio
SDL_PeepEvents
SDL_PollEvent
SDL_PumpEvents
SDL_PushEvent
SDL_Quit
SDL_QuitSubSystem
SDL_RWFromConstMem
SDL_RWFromFP
SDL_RWFromFile
SDL_RWFromMem
SDL_ReadBE16
SDL_ReadBE32
SDL_ReadBE64
SDL_ReadLE16
SDL_ReadLE32
SDL_ReadLE64
SDL_RegisterApp
SDL_RemoveTimer
SDL_SaveBMP_RW
SDL_SemPost
SDL_SemTryWait
SDL_SemValue
SDL_SemWait
SDL_SemWaitTimeout
SDL_SetAlpha
SDL_SetClipRect
SDL_SetColorKey
SDL_SetColors
SDL_SetCursor
SDL_SetError
SDL_SetEventFilter
SDL_SetGamma
SDL_SetGammaRamp
SDL_SetModState
SDL_SetModuleHandle
SDL_SetPalette
SDL_SetTimer
SDL_SetVideoMode
SDL_ShowCursor
SDL_SoftStretch
SDL_ThreadID
SDL_UnloadObject
SDL_UnlockAudio
SDL_UnlockSurface
SDL_UnlockYUVOverlay
SDL_UnregisterApp
SDL_UpdateRect
SDL_UpdateRects
SDL_UpperBlit
SDL_VideoDriverName
SDL_VideoInit
SDL_VideoModeOK
SDL_VideoQuit
SDL_WM_GetCaption
SDL_WM_GrabInput
SDL_WM_IconifyWindow
SDL_WM_SetCaption
SDL_WM_SetIcon
SDL_WM_ToggleFullScreen
SDL_WaitEvent
SDL_WaitThread
SDL_WarpMouse
SDL_WasInit
SDL_WriteBE16
SDL_WriteBE32
SDL_WriteBE64
SDL_WriteLE16
SDL_WriteLE32
SDL_WriteLE64
SDL_getenv
SDL_iconv
SDL_iconv_close
SDL_iconv_open
SDL_iconv_string
SDL_mutexP
SDL_mutexV
SDL_putenv
SDL_strlcat
SDL_strlcpy
Name
.text
Size
228KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
292B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/19
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/35
Size
370KB
Virtual Size
369KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/47
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/61
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/73
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/86
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/97
Size
180KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
Name
/108
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
generic
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/bios.bin
- SHA256 e8587df7c290525cf5fd6f5869fd00ca29a8635cd5096dfcf08e0be25f15318c
- MD5 1ef20d0614ffaf802f5b1fd408078241
- SHA1 e054fdd02f7ef664ea75aaafb551b7444b9c33c8
- SHA512 dbd53b5af960367502796d9a0b7935fc287a53e3a401cc3c311977efcd5dc960b653cb497e487cfb18de25a30722498f020062f52da40704d22dfaa72816a969
- SSDEEP 3072:leyfHyyKq+o2g6xFAyMxhJKPNJOh/eH6rrVY8Bzl1XOspA:lfxJuNJOteH6FY8Bzl1XA
- TLSH T1F5D39D55E2DF61B6EC0A1A302E597D33FBBF945CF92EA741F3A81F5098D6A308538418
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/libcurl-4.dll
- IMPHASH 591bfb96218654ea9677f9b7123d0d31
- SHA256 cde6e2b58641afd108ae2606337a71775021127a6109d6d64eadb056ca4598b7
- MD5 baae54b1157b4c9587cceb4680b13da5
- SHA1 939642b482d3e7697cec88d11aebc07bb076c2d1
- SHA512 433f411f740bb2978a47776fa856874717531985ca3bfbf17cb2f6d1e106585132a7a90ef7b803a10f1293aaad63f2264ee8a8aea2806593d6944e189e0ff813
- SSDEEP 6144:wK0GMvBI/QtKUbp9pDKRCzKuGpHTBI9yAR17rRH:wKEvB7Ke9pDXgHTdm7dH
- TLSH T140543C95755F5CF3E92301384287A33F2B3CB6B142529787E6A4AD3ACE63AD13589343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4192
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
kernel32
AddAtomA
CloseHandle
CreateEventA
CreateMutexA
DuplicateHandle
ExpandEnvironmentStringsA
FindAtomA
FormatMessageA
FreeLibrary
GetAtomNameA
GetCurrentProcess
GetExitCodeThread
GetFileType
GetLastError
GetProcAddress
GetStdHandle
GetTickCount
LoadLibraryA
PeekNamedPipe
ReadFile
ReleaseMutex
SetEvent
SetLastError
Sleep
SleepEx
TerminateThread
WaitForMultipleObjects
WaitForSingleObject
msvcrt
_close
_open
_read
_strdup
_stricmp
__dllonexit
__mb_cur_max
_beginthreadex
_errno
_fstati64
_iob
_isctype
_lseeki64
_pctype
_stati64
_stricmp
_strnicmp
_sys_nerr
abort
atoi
calloc
fclose
fflush
fgets
fopen
fprintf
fputc
fread
free
fseek
fwrite
getenv
gmtime
malloc
mbstowcs
memchr
memcpy
memmove
memset
rand
realloc
setlocale
sprintf
srand
sscanf
strchr
strcpy
strerror
strlen
strncmp
strncpy
strrchr
strstr
strtol
strtoul
time
tolower
wcstombs
wldap32
ber_free
ldap_err2stringA
ldap_first_attributeA
ldap_first_entry
ldap_get_dnA
ldap_get_values_lenA
ldap_initA
ldap_memfreeA
ldap_msgfree
ldap_next_attributeA
ldap_next_entry
ldap_search_sA
ldap_set_optionA
ldap_simple_bind_sA
ldap_unbind_s
ldap_value_free_len
ws2_32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
getsockname
getsockopt
htons
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info
Name
.text
Size
185KB
Virtual Size
185KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/pxe-e1000.bin
- SHA256 b15e5c6355795acb4dd0a93854f1b528775a1a13d8f08362d5fa18c80180093f
- MD5 8226b7e99dd7f341265b450299c72e73
- SHA1 31705a716e4842e9d8911f01287dc04b90438469
- SHA512 483fb62ef9b55d4700ed340a533d09dd8529f22112a2d06fbdc45b0459d6cd289146232f21630f7c9e9a2e5c6a5955abe742d9a9665a309444174eb03077d20f
- SSDEEP 1536:4T7vz7mAkLcHL6PUMRLHjQ+BOOqclD+Ax/TZq6+npAvqdO8PrwP:o7HmkHL633aOqk+sTZH+o38DwP
- TLSH T19A6301452CEB5111D32AC8BA2E5411294FA44CF61036ACBED0BCF82B0AFA738DB705D7
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/qemu.exe
- IMPHASH 9334847cc8edb5e7f67fbdf914c4dd65
- SHA256 fa2255e47506aa291b59f003b298b98b4ab50b4138a0be87fcbdc5a90696b9bc
- MD5 98dfea60ecff618c2940823119a279b4
- SHA1 aab26cb098fdb76a4643044f494d9b09a7796038
- SHA512 306d9a66a0209d4c805fafbfbff88a9788574ab4999956fd03cda784a67b8dab2fb5d02ca0a7bdf269c7efc1e4564c0bd2f2e1c610ddf54b401c89e705d8613d
- SSDEEP 49152:mH1QTnKjzdXskm4AwiiBfFS28OSNI6EsGC+T:mSLKjRXskmPwLBfFGOSNhEsGC
- TLSH T141C54B457E0B47FAE617033169C2667FEF30AB598350C6AADDC8DC5DBA2B1D9242F201
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4736
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
sdl
SDL_CloseAudio
SDL_CreateCursor
SDL_CreateMutex
SDL_CreateRGBSurfaceFrom
SDL_CreateSemaphore
SDL_DestroyMutex
SDL_DestroySemaphore
SDL_EnableKeyRepeat
SDL_EnableUNICODE
SDL_FillRect
SDL_FreeCursor
SDL_FreeSurface
SDL_GetAppState
SDL_GetCursor
SDL_GetError
SDL_GetModState
SDL_GetMouseState
SDL_GetVideoInfo
SDL_Init
SDL_InitSubSystem
SDL_LoadBMP_RW
SDL_MapRGB
SDL_OpenAudio
SDL_PauseAudio
SDL_PollEvent
SDL_Quit
SDL_QuitSubSystem
SDL_RWFromFile
SDL_SemPost
SDL_SemWait
SDL_SetColorKey
SDL_SetCursor
SDL_SetModuleHandle
SDL_SetVideoMode
SDL_ShowCursor
SDL_UpdateRect
SDL_UpperBlit
SDL_WM_GrabInput
SDL_WM_SetCaption
SDL_WM_SetIcon
SDL_WarpMouse
SDL_mutexP
SDL_mutexV
SDL_strlcpy
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
libcurl-4
curl_easy_cleanup
curl_easy_getinfo
curl_easy_init
curl_easy_perform
curl_easy_setopt
curl_global_init
curl_multi_add_handle
curl_multi_cleanup
curl_multi_info_read
curl_multi_init
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket_all
iphlpapi
GetNetworkParams
kernel32
AddAtomA
ChangeTimerQueueTimer
ClearCommError
CloseHandle
CommConfigDialogA
ConnectNamedPipe
CreateEventA
CreateFileA
CreateNamedPipeA
CreateSemaphoreA
CreateThread
CreateTimerQueueTimer
DeleteCriticalSection
DeleteTimerQueueTimer
DeviceIoControl
DuplicateHandle
EnterCriticalSection
ExitProcess
ExitThread
FindAtomA
FlushFileBuffers
FormatMessageA
FreeLibrary
GetAtomNameA
GetCommandLineA
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetDefaultCommConfigA
GetDiskFreeSpaceExA
GetDriveTypeA
GetFileAttributesA
GetFileSize
GetLastError
GetLogicalDriveStringsA
GetModuleFileNameA
GetModuleHandleA
GetOverlappedResult
GetProcessAffinityMask
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetVersion
GlobalAlloc
GlobalFree
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseSemaphore
ResetEvent
SetCommMask
SetCommState
SetCommTimeouts
SetConsoleCtrlHandler
SetEndOfFile
SetEvent
SetFilePointer
SetProcessAffinityMask
SetUnhandledExceptionFilter
SetupComm
SignalObjectAndWait
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualAlloc
VirtualFree
VirtualProtect
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
WriteFileEx
lstrlenA
msvcrt
_access
_close
_dup2
_fdopen
_fstat
_getpid
_mkdir
_open
_pclose
_popen
_putenv
_read
_rmdir
_stat
_strdup
_unlink
_write
__getmainargs
__lc_codepage
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_assert
_beginthreadex
_cexit
_commit
_errno
_exit
_findclose
_findfirst
_findnext
_ftime
_fullpath
_get_osfhandle
_iob
_isctype
_lseeki64
_onexit
_pctype
_setjmp
_setmode
_stricmp
_strnicmp
abort
atan2
atexit
atoi
bsearch
calloc
ceil
clearerr
cos
exit
fclose
fflush
fgets
floor
fopen
fputc
fread
free
fseek
ftell
fwrite
getenv
gmtime
ldexp
localeconv
localtime
log
longjmp
malloc
memchr
memcpy
memmove
memset
mktime
modf
perror
pow
puts
qsort
rand
realloc
rename
setbuf
signal
sin
sqrt
srand
sscanf
strchr
strcmp
strcpy
strerror
strftime
strlen
strncmp
strncpy
strrchr
strstr
strtok
strtol
strtoul
tan
time
tolower
toupper
wcslen
winmm
waveInAddBuffer
waveInClose
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutClose
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutRestart
waveOutUnprepareHeader
waveOutWrite
ws2_32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Name
.text
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
142KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
678KB
Virtual Size
677KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/QEMU/vgabios-cirrus.bin
- SHA256 de727fd5bbda54d2ab04116ec2bdb349e8a8f18e3d919900fbb5e943c57aa8db
- MD5 b2c0e52d8c74a30b5af63f44f49456fe
- SHA1 b9aa495d16ad3647c606d805877c277a6f31d78c
- SHA512 ef2062c6bc843524a9ae895a634574ad15605bbac6b9d6cf36429de4a6949551ba0f3d24c9bc67db692809059f2e283a233f1ed825e0c311c8cd40a915fdb4e6
- SSDEEP 384:1XjfaJHokcnmdPRfNQqAlKGkVPd0QqJDR39lfPAcW4AK/iXKJ2c:hjGHDx5GkVPd+JDR3TQWAFXw
- TLSH T1A1F21C053D356E2CD62F00FBFD1A45EDACC1DA7549F24C5097C1AF2AD8362A591326B3
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/compress.cpp
- SHA256 92fa743a1c1cd0eb4761b134aeaad712e7281210f8c565d291a5a00498cdac49
- MD5 180299633ade892cc8090493aa2d6684
- SHA1 b3ca088b863d213084a95da2b6be40d6613055a1
- SHA512 5d0210c24287867964cf1aaf9891e9867150dc4d5fa8dcb362bf2b7ecf4272f50d86e284c3f7248e62356749b83842d0330b5663aeb44215f9facd6753fdf936
- TLSH T13B4111919BCD80233236B06E9711598E1E3DC4376CE15CA72C8972E8266183F93FCC7A
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/compress.exe
- IMPHASH 9468839a33cefa14b007ce8a0bd988e6
- SHA256 abccc981147d5f9b43463e0f9ec6b7f168b7444626048c6c6a1c4dd7f8137096
- MD5 884e43a197998dfeac6865c525321935
- SHA1 32c27b036332e795fbe1060bcb43fe84468e423b
- SHA512 558d587ec0d0f07555d13d9d3262dcfdd5c344d735a2b5220356554467f255c42345b2b2443ea373537a9c4098c66ad0368fb8b2c62dd1922308276df5a3775e
- SSDEEP 768:K4u2i8xCuM5AFEApuz7WHLeEA6vyFuu8A5U:ru0MApuereN6j
- TLSH T1583383D0BDE99DD6EE55933D81FBD276663DB1E04A038B53A730BA310B53A9239C1207
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5376
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_iob
_lock
_onexit
_unlock
abort
calloc
exit
fclose
fopen
fprintf
fread
free
fwrite
malloc
memcpy
memset
printf
signal
strlen
strncmp
system
vfprintf
Name
.text
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
52B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
/14
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/29
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/41
Size
512B
Virtual Size
307B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/55
Size
1024B
Virtual Size
553B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/67
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/nasm.exe
- IMPHASH 245fd5847db29ac01003e87f2fc0fe30
- SHA256 442f6f984804c2e08c151f5565c2fdddda3a899d8e380512f271a3edbbf34cb4
- MD5 288f2be6334f4ea09abf3209166f9ac1
- SHA1 c6c613aea50ee2f51518b2e5e0e1041ee101beb5
- SHA512 470ad18548d290bfbe4de768258ac6fc0863d28f4ad5bd8d169cff0d84f1326fb33351c5549c8f888258a7226ad8701ec2d913a8de300a96333403d60a510baa
- SSDEEP 12288:dzMVtmYR2GGsxc7rjzWzzEqGc3I/Iga5/:dQCYEGGsxcvjzWX5/
- TLSH T1BB459006B6C3DBA5C01A7231CDC3D3603D71F0A46B2A925B3ADCA3BF6974B913D89546
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5376
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__C_specific_handler
__dllonexit
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_chsize
_errno
_filelengthi64
_fileno
_fmode
_fullpath
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_onexit
_stat64
_stricmp
_strnicmp
_time64
_unlock
_vsnprintf
_write
abort
atoi
calloc
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getenv
isalnum
isalpha
isspace
isxdigit
malloc
memcmp
memcpy
memset
perror
printf
putc
puts
qsort
realloc
remove
signal
sprintf
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strtoul
tolower
toupper
ungetc
vfprintf
_fileno
_access
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
552B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
876KB
Virtual Size
875KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
104B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.exe
- IMPHASH 91ae93ed3ff0d6f8a4f22d2edd30a58e
- SHA256 b6f3a0a6345932dca7df51b7cd7ec56d9c4fee9217772c4fd3efd8a37547a413
- MD5 c6f98ceec41c080120ebd6121fab72a1
- SHA1 d4e06fafc5807055acccad44bf31031f765868f7
- SHA512 06d8a957d3f69cb89e4172e11b0c3f6377dfacfd119d7da364781cff18edcfe04b2f5a6c8741088241fe3b9c2cd5c5b5c6112e0ff90e94e160a46caecea56f24
- SSDEEP 196608:rgF+h90+7s8H9EmtqZiIP/Kr1zBB0PTAjQDCwkWt5JvVlkzKssOZK:rgF+h9fBGvrY1lOXHkW3O2ss
- TLSH T104963396E2F28CE7F4325B33B5F5D1B53E389236477C49AB9E0828B5569D3C42B70212
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
31187
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxW
MessageBoxA
kernel32
SystemTimeToTzSpecificLocalTime
DecodePointer
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
GetShortPathNameW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
SetEndOfFile
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
RaiseException
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
CreateDirectoryW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
ws2_32
ntohl
Name
.text
Size
123KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=241, version=40116,
count=172, id=243, version=40116,
count=24, id=242, version=40116,
count=18, id=259, version=24123,
count=29, id=261, version=24123,
count=18, id=260, version=24123,
count=7, id=203, version=65501,
count=115, id=1, productName=Unmarked objects,
count=17, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.py
- SHA256 f12bf9386320e3bf1419cc0227430d86c280d40a855b35aff36939f0396b11c7
- MD5 32dfd28117b185e4870eaf506bb38af7
- SHA1 b3f3572f0f4403d90889ee5cae7f0774759a1328
- SHA512 247b2ab09495f1a596bfcd567df5a39742591164b1472fd5e6c13d02dbcef0906212a8c06ddfdc8233e11af01cbf8b32536fff1550d7dc7599153d55edcf974d
- TLSH T1A231461AD3262A1F1D3351CD71C9F4F4038860AA5D294B067D6B1A1AA204D16FBB7FD0
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.spec
- SHA256 9eef8dde3c8b19b41bf2e35105778aa2af734fae5266a7b21d55c2e91852cc72
- MD5 75b2b94d50349f896b07076bcfe2b6c9
- SHA1 fe8f88e1228b4ceeb51cac5cdd969998822746cb
- SHA512 c1a24099969ad4eb03a471a9184ad8ce7616e0f8cecf772c216b6ad4e8038d6c490a982076bd0ea8d03978f9a1c48219aac1c30a5a0fb47be9904a4979f8bdbd
- TLSH T16EE0F1832CA2211DC3F64B08884E0A532792B4652D1D445204C037786F208D960D8D3E
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/disk.img
- SHA256 910ab1fbfad51a7e4bd5dcb433025b13da21e78320d4a1daaab599c152209609
- MD5 094782da3538e8525e650c107688aa20
- SHA1 6f80466b48b7c9391be5fee3a2a9f64948f884d8
- SHA512 1fd04998ffa0f0fef254848899a8d7030d324ca453282809c91c6571a52d1751d3ec5121f7624cd3b323bb807f38add996c6451229b107383f838f3898f63576
- SSDEEP 384:cKurFJX3xJgHiVZ/JoUqH1KU2yK4E82IHEP+Iy9g:cKurFJTZ/zqR+8yH2
- TLSH T192E2CE7B0DBAE544C06353B34D3EEE6798C4BE224DC428607CE21468A1B188C1BEF6D6
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.exe
- IMPHASH bc9cfcce00a17456eb9bd280263e0da3
- SHA256 2829a026d0c7f6ca2fcba66eeef48606c3307312898fefef8af269dcb2158155
- MD5 5e8ce90547acca8bd050fccb885558a2
- SHA1 a65ca5ddbcabeca7a5b9a243131bf8ce6798e15a
- SHA512 ac4aace898b8fa9037590edcce478c649aed9daf4d7fc2285f045aecf0f86d25a69903b1458b96964f6f7e9d4fb8f79ce923896b5ff84008f9f32bf86ff11d8f
- SSDEEP 3072:87Vs+B4vSgLkgjIldksHYfYjbyKK03T9zqKyM:24vSuKXHtl
- TLSH T1AEC36A20F4D1C472E4B259320875CEA19E2DFE712F555BAB33D4127A4E340C19A7AEBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12644
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ACER\source\repos\trichloromethane\Release\trichloromethane.pdb
kernel32
FlushFileBuffers
HeapReAlloc
GetConsoleCP
GetProcessHeap
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
ExitProcess
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
TerminateThread
Sleep
CreateFileW
HeapSize
WriteFile
GetStringTypeW
GetFileType
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
RaiseException
user32
GetCursorPos
ReleaseDC
SetCursorPos
InvalidateRect
GetDesktopWindow
GetWindowRect
GetDC
MessageBoxW
GetSystemMetrics
BlockInput
gdi32
SelectObject
CreateDIBSection
CreateCompatibleDC
PatBlt
DeleteDC
TextOutW
SetTextColor
Rectangle
SelectClipRgn
SetBkColor
Ellipse
DeleteObject
CreateSolidBrush
CreateEllipticRgn
BitBlt
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=131, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=18, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=122, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.iobj
- SHA256 24a4279d7a0d7de40e32481e925d2588b815695df5fa414dc8d22cd6d67423b2
- MD5 2bdbfd1cb4a6b089b969f3918c252a78
- SHA1 9fcf72697b29730b5f6924de7685dc74a13e74aa
- SHA512 fab215bddc03b75a99eabac2eed733ab7a92347a78720e82bb84c7548acf693ce4b012bdae4cf412dac182cee52b3d683789399d1250372d83d2cd1235ec63c8
- SSDEEP 3072:I52b/GK03T9zVZZEd1xxjnp6XJ8MxSnK3UMMMM65qlExMeXRPXr:IIbeHOdG9hr
- TLSH T1CFA3072BF088E612CD2D053561478E9DB37CF2217A5F070B379CF67A59C6319CEA609A
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.ipdb
- SHA256 2de1fd676cd6e8af96b9f018b657d98560865d8239b3e78e1359b6a293a50bcd
- MD5 d793887fd4acb35b1d3a00019d5ac4dc
- SHA1 92a7c155e8543ab47ba6571e7fa3104a503d7b86
- SHA512 2ead78162f5f8e00599de259be0ced3018a1d4bb61df87fd965f925ad639eea34f15d26715949c0cde2467d4d4eea10b22171a95bfc0a3ade8353eded7dbbe36
- SSDEEP 192:Zul/ykdPtGKN5MfHhg9flBHQxk1LkO2fP2j4:ZNGtGQ5MfHSBHQW1LR2fP2j
- TLSH T193C2EB7DB791CE72CC1D0A7158A78F022BA7E05215D2171313365D0DACB7AE49F22EAA
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/Release/trichloromethane.pdb
- SHA256 3f7dec9a18d5168562b41ca9ee65cb20d800398fab2ed57c4c4d46bc34142434
- MD5 f8d204294519383d2be5a99c802b0b1e
- SHA1 340790dbbf6d0b9846a003c08790ba09e258d6d2
- SHA512 32d890d12142bb432e3cf90b7889fb62c001065c4f0cd625b6f31ed2c807c0a13883aa3d56026a587e0655110c5617a69488f4544c44a0d1939df31661887f02
- SSDEEP 24576:YotV3qwGQ2PaokUaWtsdGCANpVrQMb5eTJNj3Ks1NBLE371SM9jnkNNu5G6JaOWl:dAao3t
- TLSH T10DF51A3CE9045F31C10DBE7D957F1F4E93948EBE6AFB23E2911CA20C1AD23628965D19
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/readme.txt
- SHA256 ccfd86be4bd348d669d619daf3239c616a1fc6bded7f7489af3c4dfbfcee36e2
- MD5 ecb6d902c35c9a01c37620457e4d1908
- SHA1 936208f7e3665abbd7d28e939c4dd2512b9123c9
- SHA512 eba7f9ad42a2ebd56f424084a3b80352b8b6ab9be9b832827379515cea17f67b51790ad5ba7a345b3526b3563660afaa1c68ef073d14e2627e7e5c696e18a1e4
- TLSH T1F1518D36E084733107AE4E6111F1FCAD63A628E2CA775511F4EEAAD0BF76C24EC199C4
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane.sln
- SHA256 efc3319a3c08059fb50eb66772526578205815dc34991c79472f164fd8865455
- MD5 83205a07c8cecbeff9d4bccb74bcfeb0
- SHA1 677c7da6562aa0af4d28f230b05b3d73358b93e5
- SHA512 2c921cc70dc7604784b44312a2cf58bc9646093ea693af16cfbce3a5d01f785b78793cb8e59824f8b10f54ae3a67005576b98edb54842d608a0b99ffeae22824
- TLSH T187315CEC725E9592978A33AFC4704EC93F7786459298553EF086208C6B1BF03815F59B
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane.zip
- SHA256 d163f4cf4abd7933bc09af260e30890c36267048fcf9faa848203304f5d90fbc
- MD5 2edc3e912f5586761f10022adb9e11e1
- SHA1 d112c7c9eea191a74171857506a851d6f12cb7f5
- SHA512 0607c7144cad30f104a6f25845f32cb61e3bf529048fca03339149b9610cc011e2a384d57dd9927b8d048e563ec6fac5773347e33612c5bef505205222e2dec0
- SSDEEP 3072:Np7OYRdZKMMJnkk84GU6S24C+XtxwVTXEvB:7NnKMG984Gz2C+HwV7EZ
- TLSH T12AA312A1921B7F01EA175F6E7581BFBA384EF5DB2B136891BD84D4421DA19F0090BE0F
- MD5 SHA1 SHA512 SSDEEP TLSH
readme.txt
- SHA256 ccfd86be4bd348d669d619daf3239c616a1fc6bded7f7489af3c4dfbfcee36e2
- MD5 ecb6d902c35c9a01c37620457e4d1908
- SHA1 936208f7e3665abbd7d28e939c4dd2512b9123c9
- SHA512 eba7f9ad42a2ebd56f424084a3b80352b8b6ab9be9b832827379515cea17f67b51790ad5ba7a345b3526b3563660afaa1c68ef073d14e2627e7e5c696e18a1e4
- TLSH T1F1518D36E084733107AE4E6111F1FCAD63A628E2CA775511F4EEAAD0BF76C24EC199C4
- MD5 SHA1 SHA512 TLSH
trichloromethane-safety.exe
- IMPHASH 706501924a0d42ff7e58e5d69ef7c49c
- SHA256 da79e0317881f0600ddaddf593184b1e7d6eb54604de089e4d625741e21c004b
- MD5 1453f56916c0ea96b9ba5b49f09757e2
- SHA1 3e25edc13b69e5db4769f061f586e42b812996bf
- SHA512 37febf9c7bd3f35b45de356e8dc92a9bd5e065471669cb9afdb7048308df0c852b3cbfc5f2a3cab2887d67c9dab4f2fb2bb21ee9de42d13b700784367d1f8ca6
- SSDEEP 1536:X5RkE0HODVj5XVgyi31RRzuo3tpwOcr2zS5KTV8yYJcsWrcd6/MAedu:X590HODVViFRRz3dpxe2zSwTXoj6/Mz0
- TLSH T1C0836B51F5D0C871E4B71A350478CEA09A2EFD614F159EAB3388062F8FA81C19A39D7F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12252
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ACER\source\repos\trichloromethane-safety\Release\trichloromethane-safety.pdb
kernel32
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
CreateFileW
CreateThread
CloseHandle
TerminateThread
Sleep
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
GetStringTypeW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
SetStdHandle
GetFileType
RaiseException
user32
ReleaseDC
InvalidateRect
GetDesktopWindow
GetSystemMetrics
GetDC
GetWindowRect
gdi32
DeleteObject
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
PatBlt
DeleteDC
TextOutW
SetTextColor
Rectangle
SelectClipRgn
SetBkColor
CreateEllipticRgn
CreateSolidBrush
Ellipse
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=120, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=17, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=112, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
trichloromethane.exe
- IMPHASH bc9cfcce00a17456eb9bd280263e0da3
- SHA256 2829a026d0c7f6ca2fcba66eeef48606c3307312898fefef8af269dcb2158155
- MD5 5e8ce90547acca8bd050fccb885558a2
- SHA1 a65ca5ddbcabeca7a5b9a243131bf8ce6798e15a
- SHA512 ac4aace898b8fa9037590edcce478c649aed9daf4d7fc2285f045aecf0f86d25a69903b1458b96964f6f7e9d4fb8f79ce923896b5ff84008f9f32bf86ff11d8f
- SSDEEP 3072:87Vs+B4vSgLkgjIldksHYfYjbyKK03T9zqKyM:24vSuKXHtl
- TLSH T1AEC36A20F4D1C472E4B259320875CEA19E2DFE712F555BAB33D4127A4E340C19A7AEBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12644
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\ACER\source\repos\trichloromethane\Release\trichloromethane.pdb
kernel32
FlushFileBuffers
HeapReAlloc
GetConsoleCP
GetProcessHeap
GetConsoleMode
SetFilePointerEx
WriteConsoleW
DecodePointer
ExitProcess
GetProcAddress
CreateThread
LoadLibraryW
CloseHandle
TerminateThread
Sleep
CreateFileW
HeapSize
WriteFile
GetStringTypeW
GetFileType
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CompareStringW
LCMapStringW
RaiseException
user32
GetCursorPos
ReleaseDC
SetCursorPos
InvalidateRect
GetDesktopWindow
GetWindowRect
GetDC
MessageBoxW
GetSystemMetrics
BlockInput
gdi32
SelectObject
CreateDIBSection
CreateCompatibleDC
PatBlt
DeleteDC
TextOutW
SetTextColor
Rectangle
SelectClipRgn
SetBkColor
Ellipse
DeleteObject
CreateSolidBrush
CreateEllipticRgn
BitBlt
winmm
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
Name
.text
Size
56KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
55KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
172B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=131, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=24237,
count=29, id=261, version=24237,
count=18, id=260, version=24237,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=122, id=1, productName=Unmarked objects,
count=1, id=265, version=24245,
count=1, id=255, version=24245,
count=1, id=258, version=24245,
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.log
- SHA256 af563630e110000a4f892809da36d9d5920193376e8bb971550ba3c074b2d8e4
- MD5 b9171f09967dea3209622ce971842b2e
- SHA1 9aaca5e6a05ce5ae79dea177fab14a6f2e86567d
- SHA512 bf4402389837e68b06f101a99531e031b0b6c51a6d028679ca05728188e6b1e810c26ed4ed1cade0a4f2725a44a408b9d49c182dcb4ff859d2ac3aaab978fb51
- TLSH T160F0A279642D13E7703B3559BEC28056BA76A8903719731931CEA50CF3D6824457368D
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.obj
- SHA256 9e39b5b8ce3c980971a4a0b8e8d3dafee81d169cdbb8d1d44ec9385abd807651
- MD5 4452a0d0ff8f643c1af01aef1664de8a
- SHA1 ff22a6547642a0e24acca63f826946cc4628c8ef
- SHA512 1ac3960a3fae04a9423d3b00c94f1ebb6a6dddc87fcea1600347d5b3f092ae382c3d2c60958424f29867963f0ffdd5d3649e0e8e2bad89bbf44b02c501876472
- SSDEEP 3072:EgHpAwtw9qWGhTxO+qTfPahmIVsd8yl8Os3Wo4VSOXBt:E4RO7OhmIVsd8yl8Os3WoRC/
- TLSH T18924D8CBF0849B87ED9E1732B57A0333349066C58BBD6AA5552CC6DC8A772F884350DE
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/CL.command.1.tlog
- SHA256 12df0124ffbb84e17aceb27d9f68db45c40091e42754443e6030e9c430ffd917
- MD5 2e8f229c30677aa88babf0b2cd3e1d7a
- SHA1 566ee3b73bda143cd2d02c9738fb3bd1e2ff095e
- SHA512 db4e0fbd4dd47f75d53685d93c1ee173ed8fbf8d0fbdcca0d38c7c4d95fcde41a55c7fa0f0f9e1e7a0def6a7c17a6ccd59e7327ad64436cde4f0b67720618586
- TLSH T10B017C11A1ECA10A537372CD4FDFD6CBCEB4E2B95677053B41B841079324A44EE01B79
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/CL.read.1.tlog
- SHA256 c12509e290321aa5b7722b0aa9ad3922b48603e7e26b28c2e372e54acd26359c
- MD5 8cab0c96b4aaa477914e122cbdf2481c
- SHA1 e3a63abeeab8ae1648a19bf1898c21091063f6c1
- SHA512 9a17d9409b2fa5b8647e15a2f5406a26a0c20b1554a94a401d1f1893083f0f75d6292214c585cb6a768f466b76c5483c307b85e19fc164c472d6752da4bc723c
- SSDEEP 96:WEvv/Ae7RrvlNcpy6b5ixJlJqJ/JewOsuPoWuQQyqs4/Dxg1SYEL9UMNtHBnQEvI:WEvvIef0yqs4/F+EvI
- TLSH T15F62DF2870FE1248231775D6AFCBAA99CB27F378833F532F1594420306919564E9AF7E
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/CL.write.1.tlog
- SHA256 d867a72b7888b9f84abf5239fd6928dda7636205677be6c94f0fd75efa69a2aa
- MD5 b36f3456f3d7ae0dcab247ca5c4d2df4
- SHA1 b4182b9a67670c66be5fd5da49746e1de248d7ff
- SHA512 033ef0b2204d72ec883a79725b7cd827a53386b3ab3c13d88dae3251051abb361e323a5c6b0bfa4f2be377fad5f6a8f3d7bdf2a2d3a2c3bea2839fc7ba52f758
- TLSH T1C2F04556E8D96146033371C10EC6EBD8DEF5D2B9976B0A3B05DC8003E3605C8CF011B9
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/link.command.1.tlog
- SHA256 971f25518beadb59ea7c68019bcd4cd0c729c4dd613fd870dc80be4f9b36e541
- MD5 1e56c346721edb4cb483c89d76da43aa
- SHA1 52bc600867039fe167b0d2b55ed37428fa377d39
- SHA512 050e6dd0bba3a5ada43d0758131887dcb225f78142bb56c3242ab338969edd072f318fa4f92d779d042e1bbbeebb0063686d2c8abb10475c1b79e3ecf36462db
- TLSH T181317E19B4D971494333B1C50FDAD6BACB7AF669977B0B3F08E4844F9321981AE01774
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/link.read.1.tlog
- SHA256 09be7e8a685a68e1e9f6b2712ad4cc4797de32eb2144bd9de4d46e3cabd373bf
- MD5 c2d7215f077c74d846ec8149e217dc9c
- SHA1 f66b0b720150af284d85f18fd43830b7c93e5f04
- SHA512 95037b4569097c15f62d7ef51c12f14ea3cef7e61cf36e00876f0e2cc6b0b314ab547ae254f0058d108058b1ceee8a679e3acb8af6aff160a296f319842aa414
- TLSH T1E3811E2574FA22541316B0C54FCAE6A9CB67F238963F133F49D8424707A24974E4BBBA
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/link.write.1.tlog
- SHA256 027e608c020387acfcf16c0b272f911ab5be016e1efc6b286d30b4f4cfa868f1
- MD5 6d912132c19aa5f185e525157d93ccbb
- SHA1 f90aa0596ee80222172de678577ec97139fac877
- SHA512 687cebd3c19f4d28311e41d88b75b98e593a6a37c7c92169db830880356737f2e9e5ade1f5e9d6c8b5f768fba8605a8d582d7171b08f99525e686a42b050b62d
- TLSH T1D101666AF4D9A146033370C10FC6EAD8DEF5E2B99BAB063B04DC8407E3605C88E011B4
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/trichloromethane.tlog/trichloromethane.lastbuildstate
- SHA256 e96fa817c6a0848c64a49b21281d07a042f9079ed1628128eaf39952449a7e05
- MD5 644eb67dbc52d7bbe5224e5e8ce936c5
- SHA1 7e8ca4cde6b1df61d094d91ba6c68d2c5fab4739
- SHA512 7930132600dc7ecec2ff261393d7572fa17f5504449bc9a5ce3f6a4268cd75de55cc233d85d23a1e0774bd4177fb27a100113e3efc0f8299267a40f5d497a71c
- TLSH T10AD02304A73C56E73067581B74F1468D437444C0B174301C5541740CE7FA45D10533F3
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/vc140.pdb
- SHA256 4bbf2bd3711f90e4d665ea2cbef3236b04d907feddb5fdcaeb33d97a495a7601
- MD5 fd52c1b7d19f5253fe63ebf6866bc5a0
- SHA1 fea4e66a4ee78a676086afe1f2bf85dec9dc886a
- SHA512 0ff006cbb85df7b7f829d65b3a15e4433cb94b618d3a977fc407f0d419e40338246236eb97b2809ce1bee37a6417884c91093cc5210aed299617d051d8f7e1f8
- SSDEEP 1536:jRqRWeRqRCr14H/tB5K16qShGEyz4wIcBGrSrD71Qiq1GNzLg0LMRqR2iy28G28:jARHAR//tTu6qS8HtQBEg4MARq28G28
- TLSH T139E3A33AF941BDB3D55F1B3D580B1624631E6E80D7CC53C426A5BB3A04FB768AEA8341
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/Release/vc141.pdb
- SHA256 add1ac4d1b42eeb7f8b3a3c863e4b4c0de748761ce8c79e486ecf296c25ac79b
- MD5 3dd7556e728cdbca24bffbd1978a3bc2
- SHA1 d2775bada22cb19beb5f18f55d9b32029c3462c3
- SHA512 35870231b34987762d57bdb3a1de3b8c19281cdd6de290419a5e1d385e20e8f33245ba33752e22b12e255e24f7e35a444187db558e8987a73f2a0eac7a790700
- SSDEEP 192:dy+A1gq+HNhG7GWcI4IBG6ZeMxS6SWumeeXdwxVsTKgny+A1gq+HNhG7GXkcI4IE:vX+7GeeosWCetwQ95X+7G
- TLSH T1E1533E2AA696B863D24E6F38190F491473262EC0C7DC53C13A95773888F7778EDB4791
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/mbr.h
- SHA256 24906a87bbe5c46bdf484d5973a7878d04163958044849535d20d0bdf880c1b0
- MD5 ccf326a57fcc8bdffb9933f21055f8b9
- SHA1 48db1088e5360188cc728108dfbae6b97ce5b6fd
- SHA512 4ff390139a9e5d41306dcd1079fcad71881b80947970c6a46099b0bb94af48903e4247b178651be683d71bb1b3f662e2db1f227f733a35fb7a63bf33b2852017
- SSDEEP 768:1jzrgAl93jq9NdUMTecf/x37gS0i1Pz0uh64AnJ+z3uSfz3DbVpql7CI9zwAkimX:tgQQZ+T1kua+y35
- TLSH T1F21484D5B30D69C4394B22BCCB676D52A6CCA53805E1C58AF79E871EF0CB81E40BA71D
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/trichloromethane.cpp
- SHA256 b7d2b6a0c5b702f5cee8fce2fee968cbd443836d05221e8ca386d98aead57074
- MD5 699add26dd6d83bcf7257b5d1077752d
- SHA1 2b58820600e5658cc986eedaccd6dac09394192a
- SHA512 2f2409d21c2167a3573baf806d19af87bca633ca0f83c77714bf251ce6de0ca7c0bb9024d88f2eac56fdc27557e9043decd150e924a44746426ad120a7010673
- SSDEEP 384:Tg8zjBwyrwS+xMnujBAjACN8yrwlyrwTyrwP/zTPBArqq7LBDqk0DjJ2TCrqq7LI:TOSGMsvFfPl1jTre
- TLSH T1BA8286E9B85C65BC9AA2DA3EC7BDCC05C9BDC0002139591F7CCDD56AE8A84D2C770E52
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/trichloromethane.vcxproj
- SHA256 370abeda69e6281eb112875b940934bb24066974ce0f4e2820bc3c6e385d63be
- MD5 7d4d130ac92f6c33f354e1ba39a7b376
- SHA1 c38ec643787f7dfd2e39f6bf4356b749df7d1d11
- SHA512 fffd1fdc3167cc229e8d7c8058ca0c28328575de5fa63b3659d0c3bda1a26fd2a9783b2b4fb2b26afbc87f7f0b480035383f09eeb0111e1aaf421388a54ef069
- SSDEEP 192:e/zcR4l+4hp/YPcX8JznXfrXNZ/gPcL/xPcM:G4A/cO8FXzXNZ/k2/lv
- TLSH T1E6E1EB94E4D02A5681B3422BE5E34981EF71C3830D5B4C6CFA9EE35B4F775586223B32
- MD5 SHA1 SHA512 SSDEEP TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/trichloromethane.vcxproj.filters
- SHA256 d1aff25a99638542ba4ec54444f73e052f20788416c108d070d8557f89319abf
- MD5 d9ecd9e737fe0ce55ac01e18a5a95f42
- SHA1 81c13981e0faa3fac1ccd4358441d07272ca1f77
- SHA512 f7cdba876b861a89dca0daebfbe849e76880e0f8dde461e0fc780060144e952dd28e9215598da496aae81f677a21af8759b000fc5c487cebe4e8cef6251a04ed
- TLSH T169118C2088DC3B882037A82BFBC0CA05EF69B2E360D1154476D9D0072BF2318A627764
- MD5 SHA1 SHA512 TLSH
trichloromethane.exe-Malware-main/trichloromethane/trichloromethane/trichloromethane.vcxproj.user
- SHA256 c06a75b13f855a94d46616796e024c52b499f8f92cf00ccb571ddbc6ff574676
- MD5 244d056f5e959be6d9a2f7e94686f1c8
- SHA1 3ba38385380485d9ff25eb142eca0a01d8ce2fab
- SHA512 8d5c4c9e54c85c90224f7610fef69d9c7e8d0db6be369181ebed13e2be9c86b651a438f1978f99c3ef432a8cb6bc5b8df26c476e7e5b32511d0d31cd49b55f20
- TLSH T149C08C449600E821B7B0AA3493ACD87CF3FAB2E324F088ACF6D4D90D21071A860213A3
- MD5 SHA1 SHA512 TLSH