× Cookies are disabled! This site requires cookies to be enabled to work properly
SHA256: d4ffa4559a1e22167933772d82cf714cd4bb7a0e79511c2424e18bdb619d63a4
File name: putty.exe
Detection ratio: 0 / 51
Analysis date: 2014-04-16 21:32:32 UTC ( 23 minutes ago )
Probably harmless! There are strong indicators suggesting that this file is safe to use.
Antivirus Result Update
AVG 20140416
Ad-Aware 20140416
AegisLab 20140416
Agnitum 20140416
AhnLab-V3 20140416
AntiVir 20140416
Antiy-AVL 20140416
Avast 20140416
Baidu-International 20140416
BitDefender 20140416
Bkav 20140416
ByteHero 20140416
CAT-QuickHeal 20140416
CMC 20140411
ClamAV 20140416
Commtouch 20140416
Comodo 20140416
DrWeb 20140416
ESET-NOD32 20140416
Emsisoft 20140416
F-Prot 20140416
F-Secure 20140416
Fortinet 20140416
GData 20140416
Ikarus 20140416
Jiangmin 20140416
K7AntiVirus 20140416
K7GW 20140416
Kaspersky 20140416
Kingsoft 20140416
Malwarebytes 20140416
McAfee 20140416
McAfee-GW-Edition 20140416
MicroWorld-eScan 20140416
Microsoft 20140416
NANO-Antivirus 20140416
Norman 20140416
Panda 20140416
Qihoo-360 20140416
Rising 20140416
SUPERAntiSpyware 20140416
Sophos 20140416
Symantec 20140416
TheHacker 20140416
TotalDefense 20140416
TrendMicro 20140416
TrendMicro-HouseCall 20140416
VBA32 20140416
VIPRE 20140416
ViRobot 20140416
nProtect 20140416
The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block
Copyright
Copyright © 1997-2011 Simon Tatham.

Publisher Simon Tatham
Product PuTTY suite
Original name PuTTY
Internal name PuTTY
File version Release 0.62
Description SSH, Telnet and Rlogin client
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2011-12-10 12:35:49
Link date 1:35 PM 12/10/2011
Entry Point 0x0004C4DF
Number of sections 4
PE sections
PE imports
RegDeleteKeyA
RegOpenKeyA
RegCloseKey
RegSetValueExA
CopySid
RegQueryValueExA
GetUserNameA
RegEnumKeyA
RegDeleteValueA
RegCreateKeyExA
GetLengthSid
RegCreateKeyA
Ord(15)
Ord(14)
Ord(17)
Ord(13)
SetMapMode
CreatePen
GetBkMode
GetCharWidth32W
TextOutA
CreateFontIndirectA
GetTextMetricsA
UpdateColors
GetPixel
Rectangle
GetDeviceCaps
ExcludeClipRect
TranslateCharsetInfo
LineTo
GetTextExtentExPointA
DeleteDC
SetBkMode
GetCharacterPlacementW
GetCharWidthW
SetPixel
IntersectClipRect
GetCharWidthA
RealizePalette
SetTextColor
GetObjectA
MoveToEx
ExtTextOutW
SetPaletteEntries
CreateBitmap
CreateFontA
CreatePalette
GetStockObject
SelectPalette
ExtTextOutA
UnrealizeObject
SetTextAlign
CreateCompatibleDC
SelectObject
GetTextExtentPoint32A
GetCharABCWidthsFloatA
CreateSolidBrush
Polyline
SetBkColor
GetCharWidth32A
DeleteObject
CreateCompatibleBitmap
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmSetCompositionFontA
GetStdHandle
GetOverlappedResult
WaitForSingleObject
HeapDestroy
GetLocalTime
FreeEnvironmentStringsA
CreatePipe
GetCurrentProcess
GetLocaleInfoA
LocalAlloc
FreeEnvironmentStringsW
SetStdHandle
IsDBCSLeadByteEx
WideCharToMultiByte
GetStringTypeA
InterlockedExchange
WriteFile
GetSystemTimeAsFileTime
GetThreadTimes
HeapReAlloc
GetStringTypeW
FreeLibrary
LocalFree
GetEnvironmentVariableA
FindClose
GetSystemTime
Beep
ExitProcess
GetVersionExA
GetModuleFileNameA
UnhandledExceptionFilter
MultiByteToWideChar
GetModuleHandleA
CreateThread
MulDiv
GetSystemDirectoryA
SetHandleInformation
SetEnvironmentVariableA
GlobalMemoryStatus
GetCommState
SetEndOfFile
GetCurrentThreadId
SetCurrentDirectoryA
HeapFree
SetHandleCount
SetEvent
QueryPerformanceCounter
GetTickCount
VirtualProtect
FlushFileBuffers
LoadLibraryA
RtlUnwind
GetStartupInfoA
GetDateFormatA
OpenProcess
DeleteFileA
GetWindowsDirectoryA
GetCPInfo
GlobalLock
CompareStringW
FindFirstFileA
CompareStringA
CreateFileMappingA
FindNextFileA
TerminateProcess
GetProcAddress
SetCommTimeouts
GetTimeZoneInformation
SetCommState
CreateEventA
GetFileType
CreateFileA
HeapAlloc
GetLastError
LCMapStringW
HeapCreate
GetSystemInfo
GlobalFree
LCMapStringA
GetProcessTimes
GlobalAlloc
GetEnvironmentStringsW
GlobalUnlock
VirtualQuery
GetEnvironmentStrings
GetCurrentProcessId
GetCurrentDirectoryA
ClearCommBreak
HeapSize
GetCommandLineA
GetCurrentThread
MapViewOfFile
SetFilePointer
SetCommBreak
ReadFile
CloseHandle
lstrcpynA
GetACP
GetSystemTimeAdjustment
CreateProcessA
UnmapViewOfFile
VirtualFree
VirtualAlloc
GetOEMCP
GetTimeFormatA
ShellExecuteA
SetDlgItemTextA
GetForegroundWindow
PostQuitMessage
SetWindowPos
IsWindow
DispatchMessageA
EndPaint
GetMessageTime
SetActiveWindow
GetDC
GetCursorPos
ReleaseDC
CreateWindowExA
SendMessageA
GetClientRect
GetWindowTextLengthA
TrackPopupMenu
ShowCursor
MsgWaitForMultipleObjects
GetWindowTextA
DestroyWindow
GetMessageA
GetParent
UpdateWindow
CheckRadioButton
CreateCaret
ShowWindow
SetClassLongA
EnableWindow
SetWindowPlacement
GetDlgItemTextA
PeekMessageA
TranslateMessage
DestroyCaret
GetQueueStatus
SetClipboardData
IsZoomed
GetWindowPlacement
IsIconic
RegisterClassA
GetWindowLongA
SetTimer
GetKeyboardLayout
FlashWindow
IsDialogMessageA
SetFocus
DrawEdge
SetCapture
BeginPaint
SetCaretPos
KillTimer
GetClipboardOwner
RegisterWindowMessageA
DefWindowProcA
ToAsciiEx
GetClipboardData
SendDlgItemMessageA
GetSystemMetrics
EnableMenuItem
GetWindowRect
PostMessageA
ReleaseCapture
SetWindowLongA
SetKeyboardState
CheckDlgButton
CreatePopupMenu
CheckMenuItem
CreateMenu
GetDlgItem
CreateDialogParamA
ScreenToClient
InsertMenuA
LoadCursorA
LoadIconA
GetKeyboardState
IsDlgButtonChecked
GetDesktopWindow
GetSystemMenu
SetForegroundWindow
OpenClipboard
EmptyClipboard
GetCaretBlinkTime
MapDialogRect
EndDialog
HideCaret
GetCapture
FindWindowA
MessageBeep
ShowCaret
AppendMenuA
RegisterClipboardFormatA
MessageBoxIndirectA
MoveWindow
MessageBoxA
DialogBoxParamA
GetSysColor
SetScrollInfo
SystemParametersInfoA
GetDoubleClickTime
WinHelpA
DeleteMenu
InvalidateRect
SetWindowTextA
DefDlgProcA
CloseClipboard
SetCursor
PlaySoundA
EnumPrintersA
EndPagePrinter
StartPagePrinter
StartDocPrinterA
OpenPrinterA
WritePrinter
EndDocPrinter
ClosePrinter
GetOpenFileNameA
ChooseColorA
GetSaveFileNameA
ChooseFontA
CoCreateInstance
CoUninitialize
CoInitialize
Number of PE resources by type
RT_ICON 12
RT_DIALOG 4
RT_GROUP_ICON 2
RT_VERSION 1
RT_MANIFEST 1
Number of PE resources by language
ENGLISH US 20
ExifTool file metadata
SubsystemVersion
4.0

LinkerVersion
7.1

ImageVersion
0.0

FileSubtype
0

FileVersionNumber
0.62.0.0

UninitializedDataSize
0

LanguageCode
English (British)

FileFlagsMask
0x000b

CharacterSet
Unicode

InitializedDataSize
163840

FileOS
Win32

MIMEType
application/octet-stream

LegalCopyright
Copyright 1997-2011 Simon Tatham.

FileVersion
Release 0.62

TimeStamp
2011:12:10 13:35:49+01:00

FileType
Win32 EXE

PEType
PE32

InternalName
PuTTY

FileAccessDate
2014:04:16 22:33:40+01:00

ProductVersion
Release 0.62

FileDescription
SSH, Telnet and Rlogin client

OSVersion
4.0

FileCreateDate
2014:04:16 22:33:40+01:00

OriginalFilename
PuTTY

Subsystem
Windows GUI

MachineType
Intel 386 or later, and compatibles

CompanyName
Simon Tatham

CodeSize
344064

ProductName
PuTTY suite

ProductVersionNumber
0.62.0.0

EntryPoint
0x4c4df

ObjectFileType
Executable application

CarbonBlack CarbonBlack acts as a surveillance camera for computers
While monitoring an end-user machine in-the-wild, CarbonBlack noticed the following files in execution wrote this sample to disk.
PE resource-wise parents
Compressed bundles
PCAP parents
File identification
MD5 a3ccfd0aa0b17fd23aa9fd0d84b86c05
SHA1 89c19274ad51b6fbd12fb59908316088c1135307
SHA256 d4ffa4559a1e22167933772d82cf714cd4bb7a0e79511c2424e18bdb619d63a4
ssdeep
12288:J743NHanev1s4kd83ubHX2+v1g8YyCCTlaG9PnV6I:RgN6nY13ebHX2+tlNl7V6

imphash 74638b0911b0c9268aae1edee5a60a9f
File size 472.0 KB ( 483328 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID InstallShield setup (42.0%)
Win32 Executable MS Visual C++ (generic) (30.4%)
Windows Screen Saver (12.7%)
Win32 Dynamic Link Library (generic) (6.4%)
Win32 Executable (generic) (4.3%)
Tags
peexe mz

VirusTotal metadata
First submission 2011-12-10 15:52:37 UTC ( 2 years, 4 months ago )
Last submission 2014-04-16 21:32:32 UTC ( 23 minutes ago )
File names imm-flt-46371
test.exe
puttyv2.exe
ea9d9c9a-16e8-4606-a4bc-f4ecaa6c906c.exe
puttybutty.exe
LinkStation Live et Samsung DLNA - 02 Telnet (h) - putty.exe
putty.old.exe
690648428
15.exe
4c009a0e-a62c-4589-8a5d-9455daad5840.exe
1534331801.putty.exe
d4ffa4559a1e22167933772d82cf714cd4bb7a0e79511c2424e18bdb619d63a4
o.exe
bot.exe
wHACK.exe
PUTTY.EXE
putty.exe
test98805742721473.bin
1.exe
772806%5B%2A%2Aqmark%2A%2A%5D
Putty v1.exe
8a336ec4-05a7-4a95-8b03-c94fc8f2c4f8.exe
a3ccfd0aa0b17fd23aa9fd0d84b86c05.exe
putty 0.62 chiark.greenend.org.uk 040513.exe
ssh-062.exe
Advanced heuristic and reputation engines
ClamAV PUA
Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain characteristics which depending on the user policies and environment may or may not represent a threat. For full details see: http://www.clamav.net/index.php?s=pua&lang=en .

Symantec reputation Suspicious.Insight
No comments. No VirusTotal Community member has commented on this item yet, be the first one to do so!

Leave your comment...

?
Post comment

You have not signed in. Only registered users can leave comments, sign in and have a voice!

No votes. No one has voted on this item yet, be the first one to do so!