putty.exe
First submission 2024-10-15 18:13:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1664.78 KB (1704736 bytes) |
| Compile time: | 1992-06-20 00:22:17 |
| MD5: | b15ed5517d17dc03b4391f34c81f9697 |
| SHA1: | cdf3c4713c01362b5cfaf9084fa4b1fcdacc2fbf |
| SHA256: | 9f96931855f7a2b61a6ba1f0bb14bd3c088c0c2d3a51da28b517569b5c305a57 |
| Import Hash : | 9f4693fc0c511135129493f2161d1e86 |
| Sections 8 | CODE DATA BSS .idata .tls .rdata .reloc .rsrc |
| Directories 4 | import resource tls relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 69/77 VT report date: 2024-10-14 22:09:05 |
| Malware Type 2 | virus trojan |
| Threat Type 3 | neshta hllp apanas |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://194.87.31.235/putty.exe  |
194.87.31.235 |
2024-10-15 18:13:02 |
PE Sections 3 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| CODE | 0x1000 | 0x722c | 29696 | d8e5632fdd666820b7dabaa20495c25a6389f778 | ca3464d4f08c9010e7ffa2fe3e890344 | |
| DATA | 0x9000 | 0x218 | 1024 | a47fe8a4fd97fa97a36e545b5f135e580fb0f57a | 7ffc3168a7f3103634abdf3a768ed128 | |
| BSS | 0xa000 | 0xa899 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
| .idata | 0x15000 | 0x864 | 2560 | 3f7c121baf4a9bd57538b97806920cc8a1d1ba24 | 6e7a45521bfca94f1e506361f70e7261 | |
| .tls | 0x16000 | 0x8 | 0 | da39a3ee5e6b4b0d3255bfef95601890afd80709 | d41d8cd98f00b204e9800998ecf8427e | |
| .rdata | 0x17000 | 0x18 | 512 | 5fc2d532c93cc509a9e75941fc9cfed27be87979 | 7e6c0f4f4435abc870eb550d5072bad6 | |
| .reloc | 0x18000 | 0x5cc | 1536 | fd6e0154406bd02a1b8596ca6fe904c176f2372b | 16968c66d220638496d6b095f21de777 | |
| .rsrc | 0x19000 | 0x1400 | 5120 | c5d4fb3d0fd3906788c314d1d109020cc846298f | 65a386253bbe5d53953879683c9f25df |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_RUSSIAN | SUBLANG_RUSSIAN | 0x19150 | 4264 | |
| RT_RCDATA | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x1a208 | 172 | |
| RT_GROUP_ICON | LANG_RUSSIAN | SUBLANG_RUSSIAN | 0x1a2b4 | 20 |
Packers detected 2
| Borland Delphi 3.0 (???) |
| Borland Delphi 4.0 |
Anti debug functions 3
| GetLastError |
| RaiseException |
| UnhandledExceptionFilter |
Strings analysis - File found
| Log |
| putty.log |
| Object |
| hhctrl.ocx |
| Library |
| mscoree.dll |
| Shcore.dll |
| SSPICLI.DLL |
| secur32.dll |
| Crypt32.dll |
| ADVAPI32.dll |
| Using SSPI from SECUR32.DLL |
| *.dll |
| USER32.dll |
| SHELL32.dll |
| dwmapi.dll |
| i64.dll |
| IMM32.dll |
| COMCTL32.dll |
| COMDLG32.dll |
| ole32.dll |
| KERNEL32.dll |
| spoolss.dll |
| GDI32.dll |
| WSOCK32.dll |
| OLEAUT32.dll |
| Microsoft SSPI SECUR32.DLL |
| MIT Kerberos GSSAPI64.DLL |
| Using GSSAPI from GSSAPI64.DLL |
| WINMM.dll |
| wship6.dll |
| WS2_32.dll |
Strings analysis - Possible URLs found 19
| http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0 |
| http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0# |
| http://ocsp.sectigo.com0 |
| https://sectigo.com/CPS0 |
| http://crl.comodoca.com/AAACertificateServices.crl06 |
| http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0% |
| http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y |
| http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v |
| https://www.chiark.greenend.org.uk/~sgtatham/putty/0 |
| http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0# |
| http://ocsp.comodoca.com0 |
| https://www.chiark.greenend.org.uk/~sgtatham/putty/ |
| http://crl.comodo.net/AAACertificateServices.crl0 |
| http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0# |
| http://ocsp.usertrust.com0 |
| http://schemas.microsoft.com/SMI/2016/WindowsSettings |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings |
| http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t |
| http://crl.comodoca.com/AAACertificateServices.crl04 |
Import functions
| Name | Latest seen | MD5 |
|---|---|---|
| world.exe | 2022-10-12 19:32:02 | 4c596d32f75e3a84e48c36e8fc8025fd |
| 1.bat | 2022-11-18 07:20:08 | 49140280d15498a146873199b563852f |
| kapo.exe | 2022-11-18 07:21:09 | 6ed53a0273682d74b8ebdd50fa1b2a19 |
| java_update.exe | 2024-07-02 08:06:02 | bc4206081a6f4206dc5b63948b05ef4b |
| F.exe | 2024-07-02 08:08:04 | e501c275814bfcb58fe845c38227d5c5 |
| Build.exe | 2024-07-02 08:09:03 | 2f6f4f9674c6721b5ea8319ed90a8f20 |
| x.exe | 2024-07-02 08:10:02 | d27e7c560c09eb318c80cab58baea1b2 |