e0089b66ab76a1e061255840eb25e497123d66361bd86c9a8f9d262292af3ecc

Sharing

Copy URL Twitter E-mail

General

Target
e0089b66ab76a1e061255840eb25e497123d66361bd86c9a8f9d262292af3ecc
Size 3.4MB
Sample261027-e437nsbt9k
SHA256 e0089b66ab76a1e061255840eb25e497123d66361bd86c9a8f9d262292af3ecc
MD5 69dfbbd4d5d0eb78a817a4ad9a40faf9
SHA1 202e0a53c81103f10c9fc2b7f51486b8fa1f120e
SHA512 9b37720e08ee1fda736273185ee0aa9f1baa132b5c979e3c23d0c1eb8f0980c0fbc1bc2e4619731675955c6254ade91f891e83d522ba79a09b4cad8c9bd38cc0
SSDEEP 98304:NPukCRdfuQegpu/BRtx7bZnkXk43JcukMbFLBwQ2:QkCRdf5Huj/7NRqkQAQ2
TLSH
T1E3F533EC4E0778BB82B610D1919DFF50FAD53947810690B6BB110F3FBAF46682894E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/pageant.exe
unpack001/plink.exe
unpack001/pscp.exe
unpack001/psftp.exe
unpack001/pterm.exe
unpack001/putty.exe
unpack001/puttygen.exe
unpack001/puttytel.exe

File Explorer

e0089b66ab76a1e061255840eb25e497123d66361bd86c9a8f9d262292af3ecc

.zip 3.4MB
pageant.exe

.exe 557KB
plink.exe

.exe 1005KB
pscp.exe

.exe 1008KB
psftp.exe

.exe 1024KB
pterm.exe

.exe 636KB
putty.exe

.exe 1.3MB
puttygen.exe

.exe 619KB
puttytel.exe

.exe 708KB

e0089b66ab76a1e061255840eb25e497123d66361bd86c9a8f9d262292af3ecc

SHA256 e0089b66ab76a1e061255840eb25e497123d66361bd86c9a8f9d262292af3ecc
MD5 69dfbbd4d5d0eb78a817a4ad9a40faf9
SHA1 202e0a53c81103f10c9fc2b7f51486b8fa1f120e
SHA512 9b37720e08ee1fda736273185ee0aa9f1baa132b5c979e3c23d0c1eb8f0980c0fbc1bc2e4619731675955c6254ade91f891e83d522ba79a09b4cad8c9bd38cc0
SSDEEP 98304:NPukCRdfuQegpu/BRtx7bZnkXk43JcukMbFLBwQ2:QkCRdf5Huj/7NRqkQAQ2
TLSH
T1E3F533EC4E0778BB82B610D1919DFF50FAD53947810690B6BB110F3FBAF46682894E4E
MD5 SHA1 SHA512 SSDEEP TLSH

pageant.exe

IMPHASH f02b5d2371f5a58bd466f2f7f9ecc0f6
SHA256 b75225475bba9a31ebb6e9b6faa68e70a8d8060fe1c5959466622ac7eca500eb
MD5 529ab877d1ba8d706ff20eccb6649188
SHA1 2b57c823533ae2e2a4dc0f9fdc3fb5b7c0767bfe
SHA512 67be9cb3391fb0013a95281714bf09a4e7e85ff9837b6599b528463cba855fef559c29e6862ce2dab6021c7b5530975383ec0a7727388e43bd5b619d43d88fcc
SSDEEP 12288:2Db/ammwc2WMpaNn2tYNsXSQY8OkiKzKRMRXYGni:2Dbzc5WXtY2XS983iuKKni
TLSH
T172C47DA9E3A402F8E977813CC6529617F7B1F8654360ABDF07A081761F236E25E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

258160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CopySid EqualSid GetLengthSid RegCloseKey RegEnumKeyA RegOpenKeyA AllocateAndInitializeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner RegCreateKeyExA RegOpenKeyExA RegQueryValueExA GetUserNameA

comdlg32

GetOpenFileNameW GetSaveFileNameA GetSaveFileNameW GetOpenFileNameA

gdi32

DeleteDC GetTextExtentPoint32A SelectObject SetBkColor SetTextColor ExtTextOutA

shell32

ShellExecuteA Shell_NotifyIconA

user32

GetWindowTextA MessageBoxIndirectW FindWindowA MapDialogRect IsDialogMessageA DestroyIcon LoadIconA GetDesktopWindow SetWindowLongPtrA GetWindowLongPtrA DrawFocusRect GetSysColor GetCursorPos MessageBeep MessageBoxA GetWindowRect GetDC SetForegroundWindow SetActiveWindow TabbedTextOutA SetMenuDefaultItem GetMenuDefaultItem SetMenuItemInfoA GetMenuItemInfoW InsertMenuItemA TrackPopupMenu RemoveMenu GetWindowTextLengthA GetMenuItemCount DestroyMenu CreatePopupMenu CreateMenu EnableWindow MsgWaitForMultipleObjects SendDlgItemMessageA SetDlgItemTextA GetDlgItem EndDialog DialogBoxParamA CreateDialogParamA SetWindowPos MoveWindow ShowWindow DestroyWindow IsWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA PostMessageA SendMessageA PeekMessageW DispatchMessageA TranslateMessage GetMessageA RegisterWindowMessageA AppendMenuA

kernel32

SetEndOfFile HeapSize GetTimeZoneInformation CreateFileW FlushFileBuffers GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode OutputDebugStringW DeleteFileW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect HeapAlloc SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree IsProcessorFeaturePresent WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle GetModuleHandleExW TerminateProcess ExitProcess RtlPcToFileHeader RaiseException EncodePointer RtlLookupFunctionEntry DeleteCriticalSection InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError CloseHandle GetLastError SetEvent WaitForSingleObject CreateEventA GetCurrentProcessId CreateThread OpenProcess VirtualQuery MapViewOfFile UnmapViewOfFile GetModuleFileNameA LocalFree OpenFileMappingA WideCharToMultiByte GetACP CreateFileA DeleteFileA WriteFile GetTempPathA FreeLibrary GetProcAddress LoadResource LockResource SizeofResource FindResourceA FindClose FindFirstFileA ReadFile GetCurrentThreadId LocalAlloc CreateFileMappingA SetHandleInformation ConnectNamedPipe CreateNamedPipeA WaitNamedPipeA GetOverlappedResult InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetTickCount SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryA GetCurrentDirectoryW FormatMessageA GetCurrentProcess ReleaseMutex CreateMutexA GetCommandLineW LoadLibraryA GetSystemDirectoryA MultiByteToWideChar GetOEMCP GetCPInfo QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlUnwind

Name

.text

Size

382KB

Virtual Size

382KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

plink.exe

IMPHASH f2ac92bd8201a51530df41195a6db01e
SHA256 b98c442bd43ba15620c85fbc3ea472e10fdc56bfd7b50b4ea967e204a10aa637
MD5 92253af3fa0dd00694097f610886fe2d
SHA1 16053098f582659a5b1a1d8e5a93c57bfc4e5b16
SHA512 e43fcfd31dab868ffa9f30229146540837a2e60b26f34b1e11fac904ca95888a50bae78f4f0b4cd3b95035d209fae29fcf9cd13683d79a4382c50583464d7246
SSDEEP 12288:LI7CfAdMvxORn5IQW+O2o0fYQs0W0LpsbpAg1X+1P4JIFWsHRlEojwU0W:LI7CfARJ5IQq0fY90W2sbpAgN+1PT70
TLSH
T1E2258D5DA3A400F8EA37D53CCA65C217E7B1B81617309ADF0BE186661F23AE15E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

538880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

EqualSid AllocateAndInitializeSid CopySid GetLengthSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner RegCloseKey RegCreateKeyExA RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA GetUserNameA

user32

SendMessageA GetCursorPos GetForegroundWindow GetCapture GetQueueStatus GetClipboardOwner FindWindowA

kernel32

SetEndOfFile HeapSize CreateFileW GetTimeZoneInformation GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetStdHandle GetFileType CloseHandle GetCurrentThreadId FormatMessageA GetConsoleMode SetConsoleMode SetConsoleCP SetConsoleOutputCP ReadFile WriteFile GetLastError GetOverlappedResult InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent WaitForSingleObject CreateEventA CreateThread WaitForMultipleObjects GetTickCount CreateFileA ReadConsoleW WriteConsoleW FindClose FindFirstFileA FindNextFileA QueryPerformanceCounter GetProcessTimes GetCurrentProcess GetCurrentProcessId GetCurrentThread GetThreadTimes GetSystemTimeAsFileTime GetWindowsDirectoryA GetProcAddress GlobalMemoryStatus LocalFileTimeToFileTime FreeLibrary LoadLibraryExA LoadLibraryExW ReleaseMutex MapViewOfFile UnmapViewOfFile LocalAlloc LocalFree CreateFileMappingA ClearCommBreak GetCommState SetCommBreak SetCommState SetCommTimeouts GetEnvironmentVariableA DeleteFileA SetHandleInformation CreatePipe CreateProcessA WaitNamedPipeA ConnectNamedPipe CreateNamedPipeA OpenProcess GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP GetCPInfo LoadLibraryA GetLocalTime FindFirstFileW CreateMutexA GetExitCodeProcess GetSystemDirectoryA GetEnvironmentStringsW InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameW IsProcessorFeaturePresent GetCommandLineA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx HeapReAlloc GetStringTypeW FindFirstFileExW FindNextFileW IsValidCodePage RtlUnwind

Name

.text

Size

707KB

Virtual Size

707KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

239KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

pscp.exe

IMPHASH 3393f5b439bbe12997657948d7032e9f
SHA256 2faf6b42dc6db644639ee6accbf9022f9acc3d6f00ec0f943f04c3614493278b
MD5 e410e916c31cd0989cd17ea1770be08c
SHA1 347fb6ba8e6e17abfb448555334a2c950ff1eddf
SHA512 25220d435f36b4e01bf3dea247ca69848b748ee2bb218a37c0d0c142390e73da2c88caff079ad346fc26409ef0b6284b8a1678935f53faf36bfdca61d9df787f
SSDEEP 12288:I1CCJovAu2ck3DgvUaEIIcdeJtWtvYxs+yptRsR2gEHLIBQlHRtSjNkEk41:5iovAuWRIIcttvYi+MtRsR2VHLiyi
TLSH
T13C259D59A3E400F8EA37D17CCA62C513E7B1B8151B70AADF0BA187651F23AE15E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

545920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

EqualSid GetUserNameA AllocateAndInitializeSid CopySid GetLengthSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner RegCloseKey RegCreateKeyExA RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA

user32

SendMessageA GetCursorPos GetForegroundWindow GetCapture GetQueueStatus GetClipboardOwner FindWindowA

kernel32

SetEndOfFile HeapSize CreateFileW GetTimeZoneInformation GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW CreateDirectoryA CreateFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileSize GetFileTime ReadFile SetFileTime WriteFile CloseHandle GetLastError SetEvent CreateEventA CreateThread GetTickCount LocalFree FormatMessageA SetConsoleCP SetConsoleOutputCP WaitForMultipleObjects GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleW WriteConsoleW QueryPerformanceCounter GetProcessTimes GetCurrentProcess GetCurrentProcessId GetCurrentThread GetThreadTimes GetSystemTimeAsFileTime GetWindowsDirectoryA GetProcAddress GlobalMemoryStatus LocalFileTimeToFileTime FreeLibrary LoadLibraryExA LoadLibraryExW ReleaseMutex GetCurrentThreadId MapViewOfFile UnmapViewOfFile LocalAlloc CreateFileMappingA GetEnvironmentVariableA DeleteFileA SetHandleInformation CreatePipe CreateProcessA WaitNamedPipeA ConnectNamedPipe CreateNamedPipeA GetOverlappedResult InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject GetCommandLineW OpenProcess MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP GetCPInfo GetLocalTime FindFirstFileW LoadLibraryA CreateMutexA GetExitCodeProcess GetSystemDirectoryA GetEnvironmentStringsW InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader ExitProcess TerminateProcess GetModuleHandleExW GetFileType GetModuleFileNameW IsProcessorFeaturePresent GetCommandLineA HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx OutputDebugStringW HeapReAlloc GetStringTypeW FindFirstFileExW FindNextFileW IsValidCodePage RtlUnwind

Name

.text

Size

714KB

Virtual Size

713KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

239KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

psftp.exe

IMPHASH fff59bcdbd490ea8f848d7d8cbf9abb3
SHA256 8de0f7d1582533c6932a94a9b1d99a61cd4b362c917e20319bacd904020da668
MD5 754880af73168505c3b07e56fa2ea3e5
SHA1 e68fa6d6549c8d0f1fa69f5e1391bd5a9702e644
SHA512 0bd3a47c0f0ac86d3d43a2836f3c43cd60e07369a8b7053f3e2537123589a18c00aec404a98e583e92f6444e420a7750dff8ad532a5828782c9ea724bad300e8
SSDEEP 12288:Wgey1IEw/Z3XPJUe+rUKtD9jWL0JksYMsZGpBmi2Q0rT6E5lMLRNkmjeJD:/eoIEwBQr9tDtksYxZgIi2Q0f6MikJ
TLSH
T126259E59A3E400E8DA37D13CCA65C213E7B1F4151770AADF0BA197661F23AE25E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

546016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

user32

SendMessageA GetCursorPos GetForegroundWindow GetCapture GetQueueStatus GetClipboardOwner FindWindowA

kernel32

SetEndOfFile HeapSize CreateFileW GetTimeZoneInformation GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW SetCurrentDirectoryA GetCurrentDirectoryA CreateDirectoryA CreateFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileSize GetFileTime ReadFile SetFilePointer WriteFile CloseHandle GetLastError SetEvent CreateEventA CreateThread GetTickCount LocalFree FormatMessageA SetConsoleCP SetConsoleOutputCP WaitForMultipleObjects GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleW WriteConsoleW QueryPerformanceCounter GetProcessTimes GetCurrentProcess GetCurrentProcessId GetCurrentThread GetThreadTimes GetSystemTimeAsFileTime GetWindowsDirectoryA GetProcAddress GlobalMemoryStatus LocalFileTimeToFileTime FreeLibrary LoadLibraryExA LoadLibraryExW ReleaseMutex GetCurrentThreadId MapViewOfFile UnmapViewOfFile LocalAlloc CreateFileMappingA GetEnvironmentVariableA DeleteFileA SetHandleInformation CreatePipe CreateProcessA WaitNamedPipeA ConnectNamedPipe CreateNamedPipeA GetOverlappedResult InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject GetCommandLineW OpenProcess MultiByteToWideChar WideCharToMultiByte GetACP GetOEMCP GetCPInfo GetLocalTime FindFirstFileW LoadLibraryA CreateMutexA GetExitCodeProcess GetSystemDirectoryA GetEnvironmentStringsW InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader ExitProcess TerminateProcess GetModuleHandleExW GetFileType GetModuleFileNameW IsProcessorFeaturePresent GetCommandLineA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreateProcessW GetFileAttributesExW OutputDebugStringW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx HeapReAlloc GetStringTypeW FindFirstFileExW FindNextFileW IsValidCodePage RtlUnwind

Name

.text

Size

720KB

Virtual Size

719KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

246KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

pterm.exe

IMPHASH 0a06b0578cd1d19145b5fc33d918c12a
SHA256 67ef675d2dafa85f4d9ba5d573f1271eee63f45ab0298c865a440e5a30643574
MD5 c5b29030e75fd2e8ab9ea8044f70b101
SHA1 6ae1577f66059ba2b05e4c4ea9d2b08ebcfbef68
SHA512 ac19204c8286376aaaa74377db5931d870f66c4d785c0d710b1b23b280df0cf739a918edbc946ee7850e5f1c4d60e8deaa7a52941403cc2f8abbef08cbe78a2b
SSDEEP 12288:eLcXSR9+zTE/s6o7WWBnb7i90d2w9tXF1OdfNRR:eLcXSH1U6CWWBnb7wyPaj
TLSH
T1E9D4AE55B3E504FDE27B8139C9A28623FB7174161721ABDF07A086662F37AD41F3A720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

284208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CopySid GetLengthSid RegCloseKey RegCreateKeyExA RegDeleteKeyA RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA GetUserNameA

comdlg32

ChooseFontA GetOpenFileNameA GetOpenFileNameW GetSaveFileNameA GetSaveFileNameW ChooseColorA

gdi32

CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreatePalette CreatePen CreateSolidBrush DeleteDC DeleteObject ExcludeClipRect GetBkMode GetCharWidthA GetCharWidthW GetCharWidth32A GetCharWidth32W GetCharABCWidthsFloatA GetDeviceCaps GetOutlineTextMetricsA GetPixel GetStockObject TranslateCharsetInfo GetCharacterPlacementW IntersectClipRect LineTo Rectangle RealizePalette SelectObject SelectPalette SetBkColor SetBkMode SetPaletteEntries SetPixel SetTextColor SetTextAlign UpdateColors GetTextMetricsA GetObjectA MoveToEx ExtTextOutA ExtTextOutW Polyline UnrealizeObject CreateFontIndirectA GetTextExtentPointA GetTextExtentPoint32A GetTextExtentExPointA SetMapMode TextOutA BitBlt GetCurrentObject GetDIBits

imm32

ImmReleaseContext ImmGetCompositionStringW ImmSetCompositionFontA ImmSetCompositionWindow ImmGetContext

ole32

CoInitialize CoUninitialize CoCreateInstance

shell32

ShellExecuteA

user32

GetWindowTextW MoveWindow DefDlgProcA DispatchMessageA GetMessageA MessageBoxIndirectW SystemParametersInfoA GetWindowTextLengthA GetWindowTextA DefWindowProcA IsDlgButtonChecked CheckRadioButton CheckDlgButton SetDlgItemTextW DrawEdge MapDialogRect GetParent GetSysColorBrush SetActiveWindow GetSystemMetrics EnableWindow KillTimer SetTimer SetFocus SendDlgItemMessageA SetDlgItemTextA GetDlgItem EndDialog DialogBoxParamA SetWindowPlacement GetWindowPlacement CreateWindowExA GetScrollInfo SetScrollInfo IsDialogMessageA DrawIconEx LoadImageA DestroyIcon LoadIconA LoadCursorA GetDesktopWindow SetClassLongPtrA SetWindowLongPtrA GetWindowLongPtrA OffsetRect GetSysColor ScreenToClient GetWindowTextLengthW SetCaretPos ShowCaret HideCaret DestroyCaret CreateCaret GetCursorPos SetCursor ShowCursor GetCaretBlinkTime MessageBoxA GetWindowRect CreateDialogParamA SetWindowTextW SetWindowTextA InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetForegroundWindow UpdateWindow TrackPopupMenu DeleteMenu AppendMenuA InsertMenuA EnableMenuItem CheckMenuItem CreatePopupMenu CreateMenu GetSystemMenu MsgWaitForMultipleObjects ReleaseCapture SetCapture GetCapture ToAsciiEx SetKeyboardState GetKeyboardState EmptyClipboard RegisterClipboardFormatA GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsZoomed IsIconic SetWindowPos FlashWindow ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassW RegisterClassA GetDoubleClickTime PostQuitMessage DefWindowProcW PostMessageA SendMessageA GetMessageTime PeekMessageW PeekMessageA DispatchMessageW TranslateMessage RegisterWindowMessageA GetKeyboardLayout MessageBeep GetClientRect

kernel32

SetEndOfFile HeapSize CreateFileW GetTimeZoneInformation GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetStringTypeW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers OutputDebugStringW HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW TerminateProcess ExitProcess RtlPcToFileHeader RaiseException EncodePointer RtlLookupFunctionEntry DeleteCriticalSection InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter FindFirstFileW GetCurrentDirectoryW GetCurrentDirectoryA SetCurrentDirectoryW SetCurrentDirectoryA GetLocalTime GetSystemDirectoryA GetCommandLineW LocalFree LocalAlloc OpenProcess GetCurrentProcess FormatMessageA LoadLibraryA SetHandleInformation CreateEventA WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult ReadFile GetACP UpdateProcThreadAttribute InitializeProcThreadAttributeList CreateProcessW GetExitCodeProcess CreatePipe FindResourceA SizeofResource LockResource LoadResource FreeLibrary GetCurrentProcessId GetTempPathA WriteFile DeleteFileA CreateFileA IsDBCSLeadByteEx GetLocaleInfoA GetCPInfo GetOEMCP WideCharToMultiByte MultiByteToWideChar CreateFileMappingA MulDiv GlobalFree Beep CloseHandle GetLastError CreateThread CreateProcessA GetTickCount MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetProcAddress GlobalAlloc GlobalUnlock GlobalLock

Name

.text

Size

429KB

Virtual Size

429KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

putty.exe

IMPHASH d22f10e355b38952799c1ef87f655e82
SHA256 3ab9603e82c6f4c6e4a3091c4f1df2ebbeb88cf8c805a47bcd4c054807cc84c8
MD5 728b764e9535764366c8ab7f0a7c8d3d
SHA1 c9f160cd33088440b0e8b4f62df620cf5740fc0d
SHA512 0912c369b6755b3961e63d91570f514b74fbe4baafe5e2ba0d229ec0de586e56f7ba089a891e7eed822fd5a52bbd8bd0eaf453a4fc24d3c54fececec3d5fe6b2
SSDEEP 24576:8WKm+F60kepeBiJyRd3lZNBd08DDYWESSCF/kNlZTmVAbdQ8:8WKm+F60jpacyLlZh0itEKFczZCw
TLSH
T125559D59B3E400E8D66BD138C656860BEBB1B4151370ABEF0BAC86661F33BD15D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

752048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

EqualSid AllocateAndInitializeSid CopySid GetLengthSid InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner RegCloseKey RegCreateKeyExA RegDeleteKeyA RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA GetUserNameA

comdlg32

ChooseFontA GetOpenFileNameA GetOpenFileNameW GetSaveFileNameA GetSaveFileNameW ChooseColorA

gdi32

imm32

ImmReleaseContext ImmGetCompositionStringW ImmSetCompositionFontA ImmSetCompositionWindow ImmGetContext

ole32

CoInitialize CoUninitialize CoCreateInstance

shell32

ShellExecuteA

user32

GetWindowTextW MoveWindow DefDlgProcA DispatchMessageA GetMessageA MessageBoxIndirectW FindWindowA GetQueueStatus GetClipboardOwner SystemParametersInfoA GetWindowTextLengthA GetWindowTextA DefWindowProcA IsDlgButtonChecked CheckRadioButton CheckDlgButton SetDlgItemTextW DrawEdge MapDialogRect GetParent GetSysColorBrush SetActiveWindow GetSystemMetrics EnableWindow SetTimer SetFocus SendDlgItemMessageA SetDlgItemTextA GetDlgItem EndDialog DialogBoxParamA CreateDialogParamA SetWindowPlacement GetWindowPlacement CreateWindowExA GetScrollInfo SetScrollInfo IsDialogMessageA DrawIconEx LoadImageA DestroyIcon LoadIconA LoadCursorA GetDesktopWindow SetClassLongPtrA SetWindowLongPtrA GetWindowLongPtrA OffsetRect GetSysColor ScreenToClient SetCaretPos ShowCaret HideCaret DestroyCaret CreateCaret GetCursorPos GetWindowTextLengthW GetCaretBlinkTime ShowCursor MessageBeep KillTimer GetWindowRect GetClientRect SetWindowTextW SetWindowTextA InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetForegroundWindow UpdateWindow TrackPopupMenu DeleteMenu AppendMenuA InsertMenuA EnableMenuItem CheckMenuItem CreatePopupMenu CreateMenu GetSystemMenu MsgWaitForMultipleObjects ReleaseCapture SetCapture GetCapture ToAsciiEx SetKeyboardState GetKeyboardState EmptyClipboard RegisterClipboardFormatA GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsZoomed IsIconic SetWindowPos FlashWindow ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassW RegisterClassA GetDoubleClickTime PostQuitMessage DefWindowProcW PostMessageA SendMessageA GetMessageTime PeekMessageW PeekMessageA DispatchMessageW TranslateMessage RegisterWindowMessageA GetKeyboardLayout SetCursor MessageBoxA

kernel32

SetEndOfFile HeapSize GetTimeZoneInformation CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsValidCodePage FindNextFileW FindFirstFileExW GetStringTypeW HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect SetFilePointerEx GetFileSizeEx GetConsoleOutputCP FlushFileBuffers ReadConsoleW GetConsoleMode OutputDebugStringW HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW TerminateProcess ExitProcess RtlPcToFileHeader RaiseException EncodePointer RtlLookupFunctionEntry DeleteCriticalSection InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemDirectoryA GetExitCodeProcess CreateMutexA FindFirstFileW GetCurrentDirectoryW GetCurrentDirectoryA SetCurrentDirectoryW SetCurrentDirectoryA GetLocalTime GetCommandLineW OpenProcess FormatMessageA LoadLibraryA WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult CreateNamedPipeA CreateEventA ConnectNamedPipe WaitNamedPipeA CreatePipe SetHandleInformation GetEnvironmentVariableA SetCommTimeouts SetCommState SetCommBreak GetCommState ClearCommBreak LocalFree RtlUnwind LocalAlloc GetCurrentThreadId ReadFile ReleaseMutex LoadLibraryExW LoadLibraryExA LocalFileTimeToFileTime GlobalMemoryStatus GetWindowsDirectoryA GetSystemTimeAsFileTime GetThreadTimes GetCurrentThread GetCurrentProcess GetProcessTimes QueryPerformanceCounter FindNextFileA FindFirstFileA FindClose GetACP FindResourceA SizeofResource LockResource LoadResource FreeLibrary GetCurrentProcessId GetTempPathA WriteFile Beep CloseHandle GetLastError CreateThread CreateProcessA GetTickCount MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetProcAddress GlobalAlloc GlobalUnlock GlobalLock GlobalFree MulDiv CreateFileMappingA MultiByteToWideChar WideCharToMultiByte GetOEMCP GetCPInfo GetLocaleInfoA IsDBCSLeadByteEx CreateFileA DeleteFileA

Name

.text

Size

915KB

Virtual Size

915KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

308KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

puttygen.exe

IMPHASH 198501e64f8ee2a381fb998f8d0c9112
SHA256 f5e0a0be0c248e9bd26bcf17fad27e57e9aec0d65cd8845978c68414ccb74651
MD5 b154bc8185e33b0a5f74e3002df0e08d
SHA1 115e6fccd72fbcc64492bf7eed504d583da4e7a1
SHA512 39fda90724323651ee6cfb9efe0774894a4615aee918118ab2ffb1e3118d4e6dd2bbcc4f483f787822afc88819e12283d919871665a51c91ced5a89c831661e1
SSDEEP 12288:2vVdYEQh/5qp4M7JY2sNIiN8kBpH8nrRpjh0zd:2vHYEQh/eDJY/NIiNHBC6
TLSH
T180D48D55E3A500ECE97BC538C6528627F7B2F81643A0ABDB03A081B62F176E54F3E751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

279552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CopySid GetLengthSid RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA

comdlg32

GetOpenFileNameA GetOpenFileNameW GetSaveFileNameA GetSaveFileNameW

gdi32

DeleteObject SelectObject BitBlt CreateCompatibleBitmap CreateCompatibleDC GetCurrentObject GetDIBits GetObjectA

shell32

ShellExecuteA

user32

MessageBoxIndirectW IsDialogMessageA LoadCursorA DefDlgProcA CreateDialogParamA DestroyWindow RegisterClassA PostQuitMessage DispatchMessageA GetMessageA GetClientRect ReleaseDC GetDC GetCursorPos GetForegroundWindow GetCapture GetQueueStatus GetClipboardOwner MapDialogRect LoadIconA CheckMenuRadioItem GetDesktopWindow SetWindowLongPtrA MessageBeep MessageBoxA GetWindowRect GetWindowTextLengthA GetWindowTextA SetForegroundWindow SetActiveWindow AppendMenuA EnableMenuItem CheckMenuItem CreateMenu SetMenu EnableWindow KillTimer SetTimer SendDlgItemMessageA IsDlgButtonChecked CheckRadioButton GetDlgItemTextA SetDlgItemTextA GetDlgItemInt SetDlgItemInt GetDlgItem EndDialog DialogBoxParamA SetWindowPos MoveWindow ShowWindow CreateWindowExA PostMessageA SendMessageA GetMessageTime GetWindowLongPtrA

kernel32

SetEndOfFile HeapSize CreateFileW FlushFileBuffers GetTimeZoneInformation GetProcessHeap LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode SetFilePointerEx GetFileSizeEx OutputDebugStringW HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW TerminateProcess ExitProcess RtlPcToFileHeader RaiseException EncodePointer RtlLookupFunctionEntry DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead CloseHandle CreateThread FindClose FindFirstFileA FindNextFileA QueryPerformanceCounter GetProcessTimes GetCurrentProcess GetCurrentProcessId GetCurrentThread GetThreadTimes GetSystemTimeAsFileTime GetTickCount GetWindowsDirectoryA GetProcAddress GlobalMemoryStatus GetEnvironmentVariableA CreateFileA DeleteFileA ReadFile WriteFile GetLastError GetTempPathA FreeLibrary LoadResource LockResource SizeofResource FindResourceA GetACP SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryA GetCurrentDirectoryW OpenProcess LocalAlloc LocalFree GetLocalTime GetCommandLineW LoadLibraryA FormatMessageA GetSystemDirectoryA MultiByteToWideChar WideCharToMultiByte GetOEMCP GetCPInfo GetCurrentThreadId RtlUnwind

Name

.text

Size

428KB

Virtual Size

428KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

puttytel.exe

IMPHASH 453df94cd4b23752eca0d0e025227766
SHA256 85ab62c39313553874484be6632a845e66d4489ec3cf9a0d9b8a749c7b1bc8ed
MD5 eda65d760a0b6bf4cdd27894c62ca3b3
SHA1 253e282516379dadbb96ea6319b48ed1bdc3369c
SHA512 90b4d2b7e4d1e0723dcfc00589fe3add4c13d5466ef4b297e2e7e26e8e7a996d6fd6b59cb448731dbcca82c177bdda9d7992f6d246b3361725ed4c9bdf73e54b
SSDEEP 12288:7a5BUR8zJcunmLlSugNPABBR47L5kRdhY895vFoFRmasgxFE:7azUR8zJjnQGtABBC7L5kvhgLmasgx
TLSH
T113F48D75B3F504FDE26B8139C9628613FBB174151730ABDF07A0866A2F23AD55E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

334672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CopySid GetLengthSid RegCloseKey RegCreateKeyExA RegDeleteKeyA RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA GetUserNameA

comdlg32

ChooseFontA GetOpenFileNameA GetOpenFileNameW GetSaveFileNameA GetSaveFileNameW ChooseColorA

gdi32

imm32

ImmReleaseContext ImmGetCompositionStringW ImmSetCompositionFontA ImmSetCompositionWindow ImmGetContext

ole32

CoInitialize CoUninitialize CoCreateInstance

shell32

ShellExecuteA

user32

GetWindowTextW MoveWindow DefDlgProcA DispatchMessageA GetMessageA MessageBoxIndirectW SystemParametersInfoA GetWindowTextLengthA GetWindowTextA DefWindowProcA IsDlgButtonChecked CheckRadioButton CheckDlgButton SetDlgItemTextW DrawEdge MapDialogRect GetParent GetSysColorBrush SetActiveWindow GetSystemMetrics EnableWindow KillTimer SetTimer SetFocus SendDlgItemMessageA SetDlgItemTextA GetDlgItem EndDialog CreateDialogParamA SetWindowPlacement GetWindowPlacement CreateWindowExA GetScrollInfo SetScrollInfo IsDialogMessageA DrawIconEx LoadImageA DestroyIcon LoadIconA LoadCursorA GetDesktopWindow SetClassLongPtrA SetWindowLongPtrA GetWindowLongPtrA OffsetRect GetSysColor ScreenToClient GetWindowTextLengthW SetCaretPos ShowCaret HideCaret DestroyCaret CreateCaret GetCursorPos SetCursor ShowCursor GetCaretBlinkTime MessageBoxA GetWindowRect DialogBoxParamA SetWindowTextW SetWindowTextA InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetForegroundWindow UpdateWindow TrackPopupMenu DeleteMenu AppendMenuA InsertMenuA EnableMenuItem CheckMenuItem CreatePopupMenu CreateMenu GetSystemMenu MsgWaitForMultipleObjects ReleaseCapture SetCapture GetCapture ToAsciiEx SetKeyboardState GetKeyboardState EmptyClipboard RegisterClipboardFormatA GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsZoomed IsIconic SetWindowPos FlashWindow ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassW RegisterClassA GetDoubleClickTime PostQuitMessage DefWindowProcW PostMessageA SendMessageA GetMessageTime PeekMessageW PeekMessageA DispatchMessageW TranslateMessage RegisterWindowMessageA GetKeyboardLayout MessageBeep GetClientRect

kernel32

SetEndOfFile HeapSize GetTimeZoneInformation CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetStringTypeW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect HeapReAlloc SetFilePointerEx GetFileSizeEx GetConsoleOutputCP FlushFileBuffers ReadConsoleW GetConsoleMode OutputDebugStringW HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW TerminateProcess ExitProcess RtlPcToFileHeader RaiseException EncodePointer RtlLookupFunctionEntry DeleteCriticalSection InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetSystemDirectoryA GetExitCodeProcess FindFirstFileW GetCurrentDirectoryW GetCurrentDirectoryA SetCurrentDirectoryW SetCurrentDirectoryA GetLocalTime GetCommandLineW LocalFree LocalAlloc OpenProcess GetCurrentProcess FormatMessageA LoadLibraryA CreatePipe CreateEventA WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetOverlappedResult SetHandleInformation GetWindowsDirectoryA ReadFile GetEnvironmentVariableA SetCommTimeouts SetCommState SetCommBreak GetCommState ClearCommBreak GetACP FindResourceA SizeofResource LockResource LoadResource FreeLibrary GetCurrentProcessId GetTempPathA WriteFile DeleteFileA CreateFileA IsDBCSLeadByteEx GetLocaleInfoA GetCPInfo GetOEMCP WideCharToMultiByte MultiByteToWideChar CreateFileMappingA Beep CloseHandle GetLastError CreateThread CreateProcessA GetTickCount MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetProcAddress GlobalAlloc GlobalUnlock GlobalLock GlobalFree MulDiv

Name

.text

Size

479KB

Virtual Size

478KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

182KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e0089b66ab76a1e061255840eb25e497123d66361bd86c9a8f9d262292af3ecc

pageant.exe

advapi32

comdlg32

gdi32

shell32

user32

kernel32

generic

plink.exe

advapi32

user32

kernel32

generic

pscp.exe

advapi32

user32

kernel32

generic

psftp.exe

advapi32

user32

kernel32

generic

pterm.exe

advapi32

comdlg32

gdi32

imm32

ole32

shell32

user32

kernel32

generic

putty.exe

advapi32

comdlg32

gdi32

imm32

ole32

shell32

user32

kernel32

generic

puttygen.exe

advapi32

comdlg32

gdi32

shell32

user32

kernel32

generic

puttytel.exe

advapi32

comdlg32

gdi32

imm32

ole32

shell32

user32

kernel32

generic