| File name: | putty.exe |
| Full analysis: | https://app.any.run/tasks/0497cd0a-b6fe-4f84-884e-90ea93229610 |
| Verdict: | No threats detected |
| Analysis date: | November 03, 2019, 20:32:47 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | D9E402762E546C0046AD4748778472E1 |
| SHA1: | CDAC7286DD5C56183C384580F9F72F57FCBB38CF |
| SHA256: | 8C9611AB9A8A8DBC44F93E6F81CB2C46ED936CDDE7FB88B9410D50BDE750CFB6 |
| SSDEEP: | 24576:wpPg/wTlg6Xklt9e/Y/iIpNh6liEmE2CebHNpVffB:XwRg6X+twii8N0oCeLNbfB |
MALICIOUS
No malicious indicators.SUSPICIOUS
Creates files in the user directory
- filezilla.exe (PID: 3232)
INFO
Manual execution by user
- WINWORD.EXE (PID: 3764)
- WINWORD.EXE (PID: 4020)
- filezilla.exe (PID: 3232)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 4020)
- WINWORD.EXE (PID: 3764)
Creates files in the user directory
- WINWORD.EXE (PID: 3764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2019:07:14 11:03:49+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 579072 |
| InitializedDataSize: | 499200 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x6fdb6 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.72.0.0 |
| ProductVersionNumber: | 0.72.0.0 |
| FileFlagsMask: | 0x000b |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (British) |
| CharacterSet: | Unicode |
| CompanyName: | Simon Tatham |
| ProductName: | PuTTY suite |
| FileDescription: | SSH, Telnet and Rlogin client |
| InternalName: | PuTTY |
| OriginalFileName: | PuTTY |
| FileVersion: | Release 0.72 (with embedded help) |
| ProductVersion: | Release 0.72 |
| LegalCopyright: | Copyright © 1997-2019 Simon Tatham. |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 14-Jul-2019 09:03:49 |
| Detected languages: |
|
| CompanyName: | Simon Tatham |
| ProductName: | PuTTY suite |
| FileDescription: | SSH, Telnet and Rlogin client |
| InternalName: | PuTTY |
| OriginalFilename: | PuTTY |
| FileVersion: | Release 0.72 (with embedded help) |
| ProductVersion: | Release 0.72 |
| LegalCopyright: | Copyright © 1997-2019 Simon Tatham. |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0078 |
| Pages in file: | 0x0001 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0x0000 |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x0000 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000078 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 7 |
| Time date stamp: | 14-Jul-2019 09:03:49 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x0008D57E | 0x0008D600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.63006 |
.rdata | 0x0008F000 | 0x00026BD4 | 0x00026C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.80877 |
.data | 0x000B6000 | 0x00004E30 | 0x00000A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.14285 |
.00cfg | 0x000BB000 | 0x00000004 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0611629 |
.gfids | 0x000BC000 | 0x000000B4 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.80679 |
.rsrc | 0x000BD000 | 0x0004B020 | 0x0004B200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.82738 |
.reloc | 0x00109000 | 0x00007124 | 0x00007200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.72267 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 4.83462 | 1231 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 2.98271 | 744 | UNKNOWN | English - United States | RT_ICON |
3 | 2.67905 | 1640 | UNKNOWN | English - United States | RT_ICON |
4 | 2.38964 | 176 | UNKNOWN | English - United States | RT_ICON |
5 | 3.48609 | 304 | UNKNOWN | English - United States | RT_ICON |
6 | 2.62978 | 816 | UNKNOWN | English - United States | RT_ICON |
7 | 3.16607 | 296 | UNKNOWN | English - United States | RT_ICON |
8 | 3.57192 | 744 | UNKNOWN | English - United States | RT_ICON |
9 | 3.24629 | 1640 | UNKNOWN | English - United States | RT_ICON |
10 | 2.59447 | 176 | UNKNOWN | English - United States | RT_ICON |
Imports
ADVAPI32.dll |
COMDLG32.dll |
GDI32.dll |
IMM32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
Total processes
39
Monitored processes
4
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2740 | "C:\Users\admin\AppData\Local\Temp\putty.exe" | C:\Users\admin\AppData\Local\Temp\putty.exe | — | explorer.exe | |||||||||||
User: admin Company: Simon Tatham Integrity Level: MEDIUM Description: SSH, Telnet and Rlogin client Exit code: 0 Version: Release 0.72 (with embedded help) Modules
| |||||||||||||||
| 3232 | "C:\Program Files\FileZilla FTP Client\filezilla.exe" | C:\Program Files\FileZilla FTP Client\filezilla.exe | — | explorer.exe | |||||||||||
User: admin Company: FileZilla Project Integrity Level: MEDIUM Description: FileZilla FTP Client Exit code: 0 Version: 3, 36, 0, 0 Modules
| |||||||||||||||
| 3764 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\rentalssony.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 4020 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\rentalssony.rtf" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
Total events
1 651
Read events
1 297
Write events
202
Delete events
152
Modification events
| (PID) Process: | (3764) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | -!i |
Value: 2D216900B40E0000010000000000000000000000 | |||
| (PID) Process: | (3764) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (3764) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: Off | |||
| (PID) Process: | (3764) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: Off | |||
| (PID) Process: | (3764) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: Off | |||
| (PID) Process: | (3764) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: Off | |||
| (PID) Process: | (3764) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1040 |
Value: Off | |||
| (PID) Process: | (3764) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1049 |
Value: Off | |||
| (PID) Process: | (3764) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 3082 |
Value: Off | |||
| (PID) Process: | (3764) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1331888191 | |||
Executable files
0
Suspicious files
0
Text files
6
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3764 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR110D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 4020 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR12A3.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3764 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{12E8A178-4639-45A5-A2FD-E968BDF95BF7}.tmp | — | |
MD5:— | SHA256:— | |||
| 3764 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6FE4AA61-BD53-416E-B6BB-4016575237DF}.tmp | — | |
MD5:— | SHA256:— | |||
| 3764 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{06E85801-72CD-4587-AA4C-C33C19AF6E13}.tmp | — | |
MD5:— | SHA256:— | |||
| 3232 | filezilla.exe | C:\Users\admin\AppData\Roaming\FileZilla\layout.xml~ | — | |
MD5:— | SHA256:— | |||
| 3232 | filezilla.exe | C:\Users\admin\AppData\Roaming\FileZilla\filezilla.xml~ | — | |
MD5:— | SHA256:— | |||
| 3764 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\rentalssony.rtf.LNK | lnk | |
MD5:— | SHA256:— | |||
| 3764 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:— | SHA256:— | |||
| 3764 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\rentalssony.rtf (2).LNK | lnk | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report