Architecture |
IMAGE_FILE_MACHINE_I386
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 2024-Apr-06 09:49:39 |
Detected languages |
English - United Kingdom
English - United States |
CompanyName | Simon Tatham |
ProductName | PuTTY suite |
FileDescription | SSH, Telnet, Rlogin, and SUPDUP client |
InternalName | PuTTY |
OriginalFilename | PuTTY |
FileVersion | Release 0.81 (with embedded help) |
ProductVersion | Release 0.81 |
LegalCopyright | Copyright © 1997-2024 Simon Tatham. |
Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
Info | Interesting strings found in the binary: |
Contains domain names:
|
Info | Cryptographic algorithms detected in the binary: |
Uses constants related to MD5
Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to Blowfish Uses known Diffie-Helman primes |
Suspicious | The PE is possibly packed. | Unusual section name found: .voltbl |
Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
Info | The PE is digitally signed. |
Signer: Simon Tatham
Issuer: Sectigo Public Code Signing CA R36 |
Malicious | VirusTotal score: 3/75 (Scanned on 2024-08-12 08:33:05) |
Jiangmin:
Trojan.Shelm.arq
MaxSecure: Trojan.Malware.121218.susgen Zillya: Trojan.Rozena.Win32.216888 |
e_magic | MZ |
---|---|
e_cblp | 0x78 |
e_cp | 0x1 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0 |
e_ss | 0 |
e_sp | 0 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0x78 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections | 8 |
TimeDateStamp | 2024-Apr-06 09:49:39 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xe0 |
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Magic | PE32 |
---|---|
LinkerVersion | 14.0 |
SizeOfCode | 0xc7200 |
SizeOfInitializedData | 0x9ee00 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x000A0126 (Section: .text) |
BaseOfCode | 0x1000 |
BaseOfData | 0 |
ImageBase | 0x400000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 5.1 |
ImageVersion | 0.0 |
SubsystemVersion | 5.1 |
Win32VersionValue | 0 |
SizeOfImage | 0x170000 |
SizeOfHeaders | 0x400 |
Checksum | 0x16c3ef |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
GDI32.dll |
BitBlt
CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreateFontIndirectA CreatePalette CreatePen CreateSolidBrush DeleteDC DeleteObject ExcludeClipRect ExtTextOutA ExtTextOutW GetBkMode GetCharABCWidthsFloatA GetCharWidth32A GetCharWidth32W GetCharWidthA GetCharWidthW GetCharacterPlacementW GetCurrentObject GetDIBits GetDeviceCaps GetObjectA GetOutlineTextMetricsA GetPixel GetStockObject GetTextExtentExPointA GetTextExtentPoint32A GetTextMetricsA IntersectClipRect LineTo MoveToEx Polyline RealizePalette Rectangle SelectObject SelectPalette SetBkColor SetBkMode SetMapMode SetPaletteEntries SetPixel SetTextAlign SetTextColor TextOutA TranslateCharsetInfo UnrealizeObject UpdateColors |
---|---|
IMM32.dll |
ImmGetCompositionStringW
ImmGetContext ImmReleaseContext ImmSetCompositionFontA ImmSetCompositionWindow |
ole32.dll |
CoCreateInstance
CoInitialize CoUninitialize |
USER32.dll |
AppendMenuA
BeginPaint CheckDlgButton CheckMenuItem CheckRadioButton CloseClipboard CreateCaret CreateDialogParamA CreateMenu CreatePopupMenu CreateWindowExA CreateWindowExW DefDlgProcA DefWindowProcA DefWindowProcW DeleteMenu DestroyCaret DestroyIcon DestroyWindow DialogBoxParamA DispatchMessageA DispatchMessageW DrawEdge DrawIconEx EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint FindWindowA FlashWindow GetCapture GetCaretBlinkTime GetClientRect GetClipboardData GetClipboardOwner GetCursorPos GetDC GetDesktopWindow GetDlgItem GetDlgItemTextA GetDoubleClickTime GetForegroundWindow GetKeyboardLayout GetKeyboardState GetMessageA GetMessageTime GetParent GetQueueStatus GetScrollInfo GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowPlacement GetWindowRect GetWindowTextA GetWindowTextLengthA HideCaret InsertMenuA InvalidateRect IsDialogMessageA IsDlgButtonChecked IsIconic IsWindow IsZoomed KillTimer LoadCursorA LoadIconA LoadImageA MapDialogRect MessageBeep MessageBoxA MessageBoxIndirectA MoveWindow MsgWaitForMultipleObjects OffsetRect OpenClipboard PeekMessageA PeekMessageW PostMessageA PostQuitMessage RegisterClassA RegisterClassW RegisterClipboardFormatA RegisterWindowMessageA ReleaseCapture ReleaseDC ScreenToClient SendDlgItemMessageA SendMessageA SetActiveWindow SetCapture SetCaretPos SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetFocus SetForegroundWindow SetKeyboardState SetScrollInfo SetTimer SetWindowLongA SetWindowPlacement SetWindowPos SetWindowTextA SetWindowTextW ShowCaret ShowCursor ShowWindow SystemParametersInfoA ToAsciiEx TrackPopupMenu TranslateMessage UpdateWindow |
KERNEL32.dll |
Beep
ClearCommBreak CloseHandle CompareStringW ConnectNamedPipe CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreatePipe CreateProcessA CreateThread DecodePointer DeleteCriticalSection DeleteFileA EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileA FindFirstFileExW FindNextFileA FindNextFileW FindResourceA FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommState GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableA GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoA GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemTimeAsFileTime GetTempPathA GetThreadTimes GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatus GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDBCSLeadByteEx IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadResource LocalAlloc LocalFileTimeToFileTime LocalFree LockResource MapViewOfFile MulDiv MultiByteToWideChar OpenProcess OutputDebugStringW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseMutex RtlUnwind SetCommBreak SetCommState SetCommTimeouts SetCurrentDirectoryA SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile WaitForSingleObject WaitNamedPipeA WideCharToMultiByte WriteConsoleW WriteFile |
SHELL32.dll |
ShellExecuteA
|
COMDLG32.dll |
ChooseColorA
ChooseFontA GetOpenFileNameA GetSaveFileNameA |
ADVAPI32.dll |
AllocateAndInitializeSid
CopySid EqualSid GetLengthSid GetUserNameA InitializeSecurityDescriptor RegCloseKey RegCreateKeyExA RegDeleteKeyA RegEnumKeyA RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA SetSecurityDescriptorDacl SetSecurityDescriptorOwner |
Signature | 0xfeef04bd |
---|---|
StructVersion | 0x10000 |
FileVersion | 0.81.0.0 |
ProductVersion | 0.81.0.0 |
FileFlags | (EMPTY) |
FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
FileType |
VFT_APP
|
Language | English - United Kingdom |
CompanyName | Simon Tatham |
ProductName | PuTTY suite |
FileDescription | SSH, Telnet, Rlogin, and SUPDUP client |
InternalName | PuTTY |
OriginalFilename | PuTTY |
FileVersion (#2) | Release 0.81 (with embedded help) |
ProductVersion (#2) | Release 0.81 |
LegalCopyright | Copyright © 1997-2024 Simon Tatham. |
Resource LangID | English - United States |
---|
StartAddressOfRawData | 0x508000 |
---|---|
EndAddressOfRawData | 0x508008 |
AddressOfIndex | 0x505724 |
AddressOfCallbacks | 0x4ff3d0 |
SizeOfZeroFill | 0 |
Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
Callbacks | (EMPTY) |
Size | 0xc0 |
---|---|
TimeDateStamp | 1970-Jan-01 00:00:00 |
Version | 0.0 |
GlobalFlagsClear | (EMPTY) |
GlobalFlagsSet | (EMPTY) |
CriticalSectionDefaultTimeout | 0 |
DeCommitFreeBlockThreshold | 0 |
DeCommitTotalFreeThreshold | 0 |
LockPrefixTable | 0 |
MaximumAllocationSize | 0 |
VirtualMemoryThreshold | 0 |
ProcessAffinityMask | 0 |
ProcessHeapFlags | (EMPTY) |
CSDVersion | 0 |
Reserved1 | 0 |
EditList | 0 |
SecurityCookie | 0x502034 |
SEHandlerTable | 0x4ff36c |
SEHandlerCount | 12 |