Report - putty.exe

Malicious Library UPX PE File PE64 OS Processor Check
ScreenShot
Created 2023.10.10 18:25 Machine s1_win7_x6401
Filename putty.exe
Type PE32+ executable (GUI) x86-64, for MS Windows
AI Score
5
Behavior Score
3.0
ZERO API file : clean
VT API (file) 38 detected (AIDetectMalware, Malicious, score, GenericKD, Nukesped, Vj3f, confidence, 100%, MalwareX, CLOUD, ouvlk, VSNTJ623, high, Generic Reputation PUA, ai score=83, Wacatac, ScarletFlash, Detected, Artemis, unsafe, Ncnw)
md5 1d5ad4a60ec9be32c11ad99f234bfe8f
sha256 f59035192098e44b86c4648a0de4078edbe80352260276f4755d15d354f5fc58
ssdeep 24576:tMBcqyK86pA7yPxYdC70iQMN+PeTNzA9NIVzlMRGKwQ7Yv0IgvIgXxv7zMo:tMBc2QyJ0iQMNkeTNzA9NIVzJXQ7+0YV
imphash ac4e395abebae66f006427a8579a8bb9
impfuzzy 96:eKNmR1rBXfkMfUeqHDuVXcFjf/GngQecfsvLgSeftGRCXKWTyPHu0Tb:eFBXfkMfUeqHDuVsFjf/Gn9YHuib
  Network IP location

Signature (7cnts)

Level Description
danger File has been identified by 38 AntiVirus engines on VirusTotal as malicious
watch Harvests credentials from local FTP client softwares
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (5cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE64 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

ADVAPI32.dll
 0x1400b0000 RegCloseKey
 0x1400b0008 RegOpenKeyA
 0x1400b0010 RegQueryValueExA
 0x1400b0018 GetUserNameA
 0x1400b0020 RegCreateKeyA
 0x1400b0028 EqualSid
 0x1400b0030 AllocateAndInitializeSid
 0x1400b0038 CopySid
 0x1400b0040 GetLengthSid
 0x1400b0048 InitializeSecurityDescriptor
 0x1400b0050 SetSecurityDescriptorDacl
 0x1400b0058 SetSecurityDescriptorOwner
 0x1400b0060 RegCreateKeyExA
 0x1400b0068 RegDeleteKeyA
 0x1400b0070 RegDeleteValueA
 0x1400b0078 RegEnumKeyA
 0x1400b0080 RegSetValueExA
COMDLG32.dll
 0x1400b0090 ChooseFontA
 0x1400b0098 GetOpenFileNameA
 0x1400b00a0 GetSaveFileNameA
 0x1400b00a8 ChooseColorA
GDI32.dll
 0x1400b00b8 CreateCompatibleDC
 0x1400b00c0 CreateFontIndirectA
 0x1400b00c8 CreateSolidBrush
 0x1400b00d0 DeleteDC
 0x1400b00d8 DeleteObject
 0x1400b00e0 GetStockObject
 0x1400b00e8 GetTextExtentPoint32A
 0x1400b00f0 Rectangle
 0x1400b00f8 SelectObject
 0x1400b0100 SetBkColor
 0x1400b0108 SetTextColor
 0x1400b0110 TextOutA
 0x1400b0118 CreateFontA
 0x1400b0120 GetDeviceCaps
 0x1400b0128 GetTextExtentExPointA
 0x1400b0130 SetMapMode
 0x1400b0138 GetTextMetricsA
 0x1400b0140 SetBkMode
 0x1400b0148 GetObjectA
 0x1400b0150 CreateBitmap
 0x1400b0158 CreateCompatibleBitmap
 0x1400b0160 CreatePalette
 0x1400b0168 CreatePen
 0x1400b0170 ExcludeClipRect
 0x1400b0178 GetBkMode
 0x1400b0180 GetCharWidthA
 0x1400b0188 GetCharWidthW
 0x1400b0190 GetCharWidth32A
 0x1400b0198 GetCharWidth32W
 0x1400b01a0 GetCharABCWidthsFloatA
 0x1400b01a8 GetOutlineTextMetricsA
 0x1400b01b0 GetPixel
 0x1400b01b8 TranslateCharsetInfo
 0x1400b01c0 GetCharacterPlacementW
 0x1400b01c8 IntersectClipRect
 0x1400b01d0 LineTo
 0x1400b01d8 RealizePalette
 0x1400b01e0 SelectPalette
 0x1400b01e8 SetPaletteEntries
 0x1400b01f0 SetPixel
 0x1400b01f8 SetTextAlign
 0x1400b0200 UpdateColors
 0x1400b0208 MoveToEx
 0x1400b0210 ExtTextOutA
 0x1400b0218 ExtTextOutW
 0x1400b0220 Polyline
 0x1400b0228 UnrealizeObject
IMM32.dll
 0x1400b0238 ImmReleaseContext
 0x1400b0240 ImmGetCompositionStringW
 0x1400b0248 ImmSetCompositionFontA
 0x1400b0250 ImmSetCompositionWindow
 0x1400b0258 ImmGetContext
ole32.dll
 0x1400b0ab8 CoInitialize
 0x1400b0ac0 CoUninitialize
 0x1400b0ac8 CoCreateInstance
SHELL32.dll
 0x1400b0700 ShellExecuteA
USER32.dll
 0x1400b0710 GetQueueStatus
 0x1400b0718 GetClipboardOwner
 0x1400b0720 GetScrollInfo
 0x1400b0728 SetScrollInfo
 0x1400b0730 DrawIconEx
 0x1400b0738 DestroyIcon
 0x1400b0740 SetClassLongPtrA
 0x1400b0748 OffsetRect
 0x1400b0750 SetCaretPos
 0x1400b0758 ShowCaret
 0x1400b0760 HideCaret
 0x1400b0768 DestroyCaret
 0x1400b0770 CreateCaret
 0x1400b0778 SetCursor
 0x1400b0780 ShowCursor
 0x1400b0788 SetForegroundWindow
 0x1400b0790 GetForegroundWindow
 0x1400b0798 UpdateWindow
 0x1400b07a0 TrackPopupMenu
 0x1400b07a8 DeleteMenu
 0x1400b07b0 AppendMenuA
 0x1400b07b8 InsertMenuA
 0x1400b07c0 EnableMenuItem
 0x1400b07c8 CheckMenuItem
 0x1400b07d0 CreatePopupMenu
 0x1400b07d8 CreateMenu
 0x1400b07e0 GetSystemMenu
 0x1400b07e8 KillTimer
 0x1400b07f0 SetTimer
 0x1400b07f8 MsgWaitForMultipleObjects
 0x1400b0800 ToAsciiEx
 0x1400b0808 SetKeyboardState
 0x1400b0810 GetKeyboardState
 0x1400b0818 EmptyClipboard
 0x1400b0820 RegisterClipboardFormatA
 0x1400b0828 GetClipboardData
 0x1400b0830 SetClipboardData
 0x1400b0838 CloseClipboard
 0x1400b0840 OpenClipboard
 0x1400b0848 IsZoomed
 0x1400b0850 IsIconic
 0x1400b0858 FindWindowA
 0x1400b0860 FlashWindow
 0x1400b0868 IsWindow
 0x1400b0870 CreateWindowExW
 0x1400b0878 RegisterClassW
 0x1400b0880 GetDoubleClickTime
 0x1400b0888 DefWindowProcW
 0x1400b0890 PostMessageA
 0x1400b0898 GetMessageTime
 0x1400b08a0 PeekMessageW
 0x1400b08a8 PeekMessageA
 0x1400b08b0 DispatchMessageW
 0x1400b08b8 TranslateMessage
 0x1400b08c0 GetKeyboardLayout
 0x1400b08c8 MessageBoxIndirectA
 0x1400b08d0 LoadImageA
 0x1400b08d8 LoadIconA
 0x1400b08e0 GetCursorPos
 0x1400b08e8 GetParent
 0x1400b08f0 GetDesktopWindow
 0x1400b08f8 GetWindowLongPtrA
 0x1400b0900 GetSysColorBrush
 0x1400b0908 SetActiveWindow
 0x1400b0910 GetSystemMetrics
 0x1400b0918 EnableWindow
 0x1400b0920 ReleaseCapture
 0x1400b0928 GetCapture
 0x1400b0930 DefDlgProcA
 0x1400b0938 EndDialog
 0x1400b0940 DialogBoxParamA
 0x1400b0948 CreateDialogParamA
 0x1400b0950 SetWindowPlacement
 0x1400b0958 GetWindowPlacement
 0x1400b0960 MoveWindow
 0x1400b0968 PostQuitMessage
 0x1400b0970 DispatchMessageA
 0x1400b0978 GetMessageA
 0x1400b0980 MapDialogRect
 0x1400b0988 SetWindowLongPtrA
 0x1400b0990 ScreenToClient
 0x1400b0998 MessageBeep
 0x1400b09a0 MessageBoxA
 0x1400b09a8 ReleaseDC
 0x1400b09b0 GetDC
 0x1400b09b8 SetCapture
 0x1400b09c0 SetFocus
 0x1400b09c8 SendDlgItemMessageA
 0x1400b09d0 IsDlgButtonChecked
 0x1400b09d8 CheckRadioButton
 0x1400b09e0 CheckDlgButton
 0x1400b09e8 GetDlgItemTextA
 0x1400b09f0 SetDlgItemTextA
 0x1400b09f8 GetDlgItem
 0x1400b0a00 SendMessageA
 0x1400b0a08 DrawEdge
 0x1400b0a10 RegisterWindowMessageA
 0x1400b0a18 SystemParametersInfoA
 0x1400b0a20 GetSysColor
 0x1400b0a28 GetWindowRect
 0x1400b0a30 GetClientRect
 0x1400b0a38 GetWindowTextLengthA
 0x1400b0a40 GetWindowTextA
 0x1400b0a48 SetWindowTextA
 0x1400b0a50 InvalidateRect
 0x1400b0a58 EndPaint
 0x1400b0a60 BeginPaint
 0x1400b0a68 SetWindowPos
 0x1400b0a70 ShowWindow
 0x1400b0a78 DestroyWindow
 0x1400b0a80 CreateWindowExA
 0x1400b0a88 RegisterClassA
 0x1400b0a90 DefWindowProcA
 0x1400b0a98 GetCaretBlinkTime
 0x1400b0aa0 IsDialogMessageA
 0x1400b0aa8 LoadCursorA
KERNEL32.dll
 0x1400b0268 WriteConsoleW
 0x1400b0270 HeapSize
 0x1400b0278 SetEndOfFile
 0x1400b0280 SetEnvironmentVariableW
 0x1400b0288 FreeEnvironmentStringsW
 0x1400b0290 GetEnvironmentStringsW
 0x1400b0298 GetCommandLineW
 0x1400b02a0 GetCommandLineA
 0x1400b02a8 IsValidCodePage
 0x1400b02b0 FindNextFileW
 0x1400b02b8 FindFirstFileExW
 0x1400b02c0 GetStringTypeW
 0x1400b02c8 SetStdHandle
 0x1400b02d0 GetTimeZoneInformation
 0x1400b02d8 LCMapStringW
 0x1400b02e0 CompareStringW
 0x1400b02e8 GetTimeFormatW
 0x1400b02f0 GetDateFormatW
 0x1400b02f8 FlsFree
 0x1400b0300 FlsSetValue
 0x1400b0308 FlsGetValue
 0x1400b0310 FlsAlloc
 0x1400b0318 HeapReAlloc
 0x1400b0320 SetFilePointerEx
 0x1400b0328 GetFileSizeEx
 0x1400b0330 GetConsoleOutputCP
 0x1400b0338 FlushFileBuffers
 0x1400b0340 ReadConsoleW
 0x1400b0348 GetModuleFileNameW
 0x1400b0350 GetStdHandle
 0x1400b0358 GetModuleHandleExW
 0x1400b0360 GetFileType
 0x1400b0368 CreateFileW
 0x1400b0370 RtlPcToFileHeader
 0x1400b0378 RaiseException
 0x1400b0380 EncodePointer
 0x1400b0388 LoadLibraryExW
 0x1400b0390 TlsFree
 0x1400b0398 TlsSetValue
 0x1400b03a0 TlsGetValue
 0x1400b03a8 TlsAlloc
 0x1400b03b0 InitializeCriticalSectionAndSpinCount
 0x1400b03b8 DeleteCriticalSection
 0x1400b03c0 LeaveCriticalSection
 0x1400b03c8 EnterCriticalSection
 0x1400b03d0 SetLastError
 0x1400b03d8 RtlUnwindEx
 0x1400b03e0 GetModuleHandleW
 0x1400b03e8 GetStartupInfoW
 0x1400b03f0 IsDebuggerPresent
 0x1400b03f8 InitializeSListHead
 0x1400b0400 IsProcessorFeaturePresent
 0x1400b0408 TerminateProcess
 0x1400b0410 SetUnhandledExceptionFilter
 0x1400b0418 UnhandledExceptionFilter
 0x1400b0420 RtlVirtualUnwind
 0x1400b0428 RtlLookupFunctionEntry
 0x1400b0430 RtlCaptureContext
 0x1400b0438 GetCurrentDirectoryA
 0x1400b0440 SetCurrentDirectoryA
 0x1400b0448 GetACP
 0x1400b0450 GetLocalTime
 0x1400b0458 GetEnvironmentVariableA
 0x1400b0460 CreateMutexA
 0x1400b0468 ReleaseMutex
 0x1400b0470 SetCommTimeouts
 0x1400b0478 SetCommState
 0x1400b0480 SetCommBreak
 0x1400b0488 GetCommState
 0x1400b0490 ClearCommBreak
 0x1400b0498 OpenProcess
 0x1400b04a0 CreatePipe
 0x1400b04a8 GetCurrentThreadId
 0x1400b04b0 CreateNamedPipeA
 0x1400b04b8 ConnectNamedPipe
 0x1400b04c0 WaitNamedPipeA
 0x1400b04c8 GlobalMemoryStatus
 0x1400b04d0 GetWindowsDirectoryA
 0x1400b04d8 GetThreadTimes
 0x1400b04e0 GetCurrentThread
 0x1400b04e8 GetCurrentProcess
 0x1400b04f0 GetProcessTimes
 0x1400b04f8 QueryPerformanceCounter
 0x1400b0500 FindNextFileA
 0x1400b0508 FindFirstFileA
 0x1400b0510 FindClose
 0x1400b0518 RtlUnwind
 0x1400b0520 SetHandleInformation
 0x1400b0528 GetConsoleMode
 0x1400b0530 FormatMessageA
 0x1400b0538 GetSystemDirectoryA
 0x1400b0540 GetFileAttributesExA
 0x1400b0548 FindResourceA
 0x1400b0550 SizeofResource
 0x1400b0558 LockResource
 0x1400b0560 LoadResource
 0x1400b0568 GetCurrentProcessId
 0x1400b0570 GetTempPathA
 0x1400b0578 DeleteFileA
 0x1400b0580 CreateFileA
 0x1400b0588 CreateEventA
 0x1400b0590 WaitForSingleObject
 0x1400b0598 SetEvent
 0x1400b05a0 GetOverlappedResult
 0x1400b05a8 GetTickCount
 0x1400b05b0 LocalAlloc
 0x1400b05b8 Sleep
 0x1400b05c0 ExitProcess
 0x1400b05c8 VirtualProtect
 0x1400b05d0 LocalFree
 0x1400b05d8 HeapAlloc
 0x1400b05e0 HeapFree
 0x1400b05e8 GetProcessHeap
 0x1400b05f0 VirtualAlloc
 0x1400b05f8 VirtualFree
 0x1400b0600 FreeLibrary
 0x1400b0608 GetProcAddress
 0x1400b0610 LoadLibraryA
 0x1400b0618 IsBadReadPtr
 0x1400b0620 MulDiv
 0x1400b0628 Beep
 0x1400b0630 CloseHandle
 0x1400b0638 CreateThread
 0x1400b0640 CreateProcessA
 0x1400b0648 GetVersionExA
 0x1400b0650 MapViewOfFile
 0x1400b0658 UnmapViewOfFile
 0x1400b0660 GetModuleFileNameA
 0x1400b0668 GetModuleHandleA
 0x1400b0670 GlobalAlloc
 0x1400b0678 GlobalUnlock
 0x1400b0680 GlobalLock
 0x1400b0688 GlobalFree
 0x1400b0690 CreateFileMappingA
 0x1400b0698 MultiByteToWideChar
 0x1400b06a0 WideCharToMultiByte
 0x1400b06a8 GetOEMCP
 0x1400b06b0 GetCPInfo
 0x1400b06b8 GetLocaleInfoA
 0x1400b06c0 IsDBCSLeadByteEx
 0x1400b06c8 LocalFileTimeToFileTime
 0x1400b06d0 GetSystemTimeAsFileTime
 0x1400b06d8 LoadLibraryExA
 0x1400b06e0 ReadFile
 0x1400b06e8 WriteFile
 0x1400b06f0 GetLastError

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure