Antivirus scan for 729ca6ea8e6604111755070596ed5fad6afcf6fdc8dac0b9ebaeafb47a25b39b at 2018-07-03 19:23:24 UTC

Antivirus	Result	Update
AVG	FileRepMalware	20180703
Bkav	HW32.Packed.1713	20180703
Comodo	Heur.Packed.Unknown	20180703
CrowdStrike Falcon (ML)	malicious_confidence_80% (D)	20180530
Endgame	malicious (high confidence)	20180612
Fortinet	W32/Kryptik.GEWE!tr	20180703
McAfee	Emotet-FHR!F7B04BB2AA6B	20180703
McAfee-GW-Edition	BehavesLike.Win32.Emotet.nc	20180703
Qihoo-360	HEUR/QVM20.1.4285.Malware.Gen	20180703
SentinelOne (Static ML)	static engine - malicious	20180701
Sophos AV	Mal/EncPk-ANX	20180703
Symantec	Packed.Generic.517	20180703
Ad-Aware		20180703
AegisLab		20180703
AhnLab-V3		20180703
ALYac		20180703
Antiy-AVL		20180703
Arcabit		20180703
Avast		20180703
Avast-Mobile		20180703
Avira (no cloud)		20180703
AVware		20180703
Babable		20180406
Baidu		20180703
BitDefender		20180703
CAT-QuickHeal		20180703
ClamAV		20180703
CMC		20180703
Cybereason		20180225
Cyren		20180703
DrWeb		20180703
eGambit		20180703
Emsisoft		20180703
ESET-NOD32		20180703
F-Prot		20180703
F-Secure		20180703
GData		20180703
Ikarus		20180703
Sophos ML		20180601
Jiangmin		20180703
K7AntiVirus		20180703
K7GW		20180703
Kaspersky		20180703
Kingsoft		20180703
Malwarebytes		20180703
MAX		20180703
Microsoft		20180703
eScan		20180703
NANO-Antivirus		20180703
Palo Alto Networks (Known Signatures)		20180703
Panda		20180703
SUPERAntiSpyware		20180703
TACHYON		20180703
Tencent		20180703
TheHacker		20180628
TotalDefense		20180703
Trustlook		20180703
VBA32		20180629
VIPRE		20180703
ViRobot		20180703
Webroot		20180703
Yandex		20180703
Zillya		20180703
ZoneAlarm by Check Point		20180703
Zoner		20180702

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

FileVersionInfo properties

Original name PrintnHost.exe

Internal name PrintIsolationHost.exe

Description БИГUnicode

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2018-07-03 19:20:41

Entry Point 0x00012DE8

Number of sections 5

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 77452 77824 7.74 aab5576233ff549a3a91984bdebe8564

.data 81920 4484 512 5.34 6f3b7e7740962a69c06cea12c55c6e88

.pdata 90112 498 512 4.10 5f1e4f702731d561e439c4b3f615be3c

.rsrc 94208 13040 13312 3.89 984fdd56b7dd86857e7076164cd5284b

.reloc 110592 192 512 2.73 9b42995860c14b9345182640c259cbe1

PE imports

Number of PE resources by type

RT_DIALOG 21

RT_MANIFEST 1

RT_VERSION 1

Number of PE resources by language

ENGLISH US 2

HEBREW DEFAULT 1

HUNGARIAN DEFAULT 1

VIETNAMESE DEFAULT 1

CHINESE SIMPLIFIED 1

SLOVENIAN DEFAULT 1

CZECH DEFAULT 1

FINNISH DEFAULT 1

KOREAN 1

NEUTRAL DEFAULT 1

PORTUGUESE 1

POLISH DEFAULT 1

JAPANESE DEFAULT 1

DANISH DEFAULT 1

SLOVAK DEFAULT 1

GREEK DEFAULT 1

TURKISH DEFAULT 1

ROMANIAN 1

THAI DEFAULT 1

SERBIAN DEFAULT 1

NEUTRAL 1

RUSSIAN 1

PE resources

04a996eba648a3625572df91e920bdebd3cb3a6a85fdf915cf39e7cc19402083 data

0abc7004ed789223b95787c40a31a73628c56bf107893e3717d886f3f44b3f30 data

19a7a1da7f9d70a37126f8627aa6f2b33debec0569f6145942b54b3ad7538c5e data

1cc21e501af578cf31816c51e4acb7744fa33d32ba66a42aced687ef42c12325 data

261bb880056d6b961343fc1618828618ff09e4f16b0b3fdee6d191f27b432301 data

30c8ed24ed66369af16d7e6e51e65583a7c29df6ef4464032473913355c0fa07 data

36f1119b7cb3f9376bf590e2e6441f16944ae16a05d20a64edc0a600947f2a4a data

388f75e900f0c15fd66249d7b2e7edf6e14eeefb859e6f766b75058e44f27af6 ASCII text

4123a368821236ba995c5dd1884548f0d62168a08b7a15431f3fb88cf6179569 data

4194517b8138c799413ff5c46850bdd610755748c869c44bd1868544555e1ffd data

Debug information

Type Timestamp Offset Size

IMAGE_DEBUG_TYPE_CODEVIEW (2) Tue Jul 3 19:20:41 2018 1376 44 Bytes

12 (12) Tue Jul 3 19:20:41 2018 1500 20 Bytes

ExifTool file metadata

SubsystemVersion

5.0

LinkerVersion

14.1

ImageVersion

0.0

FileVersionNumber

1.2.0.6

UninitializedDataSize

LanguageCode

Neutral

FileFlagsMask

0x003f

CharacterSet

Unicode

InitializedDataSize

18944

EntryPoint

0x12de8

OriginalFileName

PrintnHost.exe

MIMEType

application/octet-stream

LegalCopyright

TimeStamp

2018:07:03 20:20:41+01:00

FileType

Win32 EXE

PEType

PE32

InternalName

PrintIsolationHost.exe

ProductVersion

36.1.27601

FileDescription

Unicode

OSVersion

5.0

FileOS

Win32

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

CompanyName

11111 Corporation

CodeSize

77824

FileSubtype

ProductVersionNumber

1.2.0.6

FileTypeExtension

exe

ObjectFileType

Dynamic link library

Compressed bundles

This file was also submitted to VirusTotal in the following compressed file bundles.

3ea0a476266866ef3bb0ded03f44d316d97dacbcc00c0feb24a833ef7e5f3d81

File identification

MD5 f7b04bb2aa6b6c4e5e822015687296c6

SHA1 743d9deae3b38aa335fa541b3aaa760b41ac1c69

SHA256 729ca6ea8e6604111755070596ed5fad6afcf6fdc8dac0b9ebaeafb47a25b39b

ssdeep

1536:YAlUyEPIQ0dlZob+O6gkCgBJzggb977uOqL:YKEwQ0lzhkwzb77uJ

authentihash 17c05bd7c0aa4ee84cc01b124cb43dbfd4483d6ace28591147abc60099b209ec

imphash 8d58ef6addb8ab31979ba267a3ee0e18

File size 91.5 KB ( 93696 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit system file

TrID	Win32 Executable (generic) (35.7%) Win16/32 Executable Delphi generic (16.4%) OS/2 Executable (generic) (16.0%) Generic Win/DOS Executable (15.8%) DOS Executable Generic (15.8%)

VirusTotal metadata

First submission 2018-07-03 19:23:24 UTC ( 7 months, 3 weeks ago )

Last submission 2018-07-03 19:23:24 UTC ( 7 months, 3 weeks ago )

File names

C6LN.exe
PrintIsolationHost.exe
PrintnHost.exe

SHA256:	729ca6ea8e6604111755070596ed5fad6afcf6fdc8dac0b9ebaeafb47a25b39b
File name:	C6LN.exe
Detection ratio:	12 / 64
Analysis date:	2018-07-03 19:23:24 UTC ( 7 months, 3 weeks ago ) View latest

Ciphered bundle