filenamePUTTY.exe
size593920 (0x91000)
md5b5c88d5af37afd13f89957150f9311ca
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Stealzilla-1 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
152201152
1714021937
1584021926
1473072925
10330
17040219203
154402191
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x52986f49
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion10.0
SizeOfCode0x6a800
SizeOfInitializedData0x26400
SizeOfUninitializedData0
AddressOfEntryPoint0x5eac1
BaseOfCode0x1000
BaseOfData0x6c000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x99000
SizeOfHeaders0x400
CheckSum0xa0a5c
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x6a71a0x6a800R-X CODE
.rdata0x6c0000x1b1e80x1b200R-- IDATA
.data0x880000x67840x1c00RW- IDATA
.rsrc0x8f0000x385c0x3a00R-- IDATA
.reloc0x930000x5b7e0x5c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x8564c0x104
RESOURCE0x8f0000x385c
EXCEPTION00
SECURITY00
BASERELOC0x930000x5220
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x851280x40
Bound_IAT00
IAT0x6c0000x528
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#12961252
ICON#27441252
ICON#316401252
ICON#41761252
ICON#53041252
ICON#68161252
ICON#72961252
ICON#87441252
ICON#916401252
ICON#101761252
ICON#113041252
ICON#128161252
DIALOG#1021181252
DIALOG#1101861252
DIALOG#1114061252
DIALOG#11332721252
GROUP_ICON#200901252
GROUP_ICON#201901252
VERSION#18601252
MANIFEST#13461252
module_namehintordfunction_name
COMCTL32.dll15
COMCTL32.dll14
COMCTL32.dll17
COMCTL32.dll13
IMM32.dll104ImmReleaseContext
IMM32.dll56ImmGetContext
IMM32.dll54ImmGetCompositionStringW
IMM32.dll112ImmSetCompositionFontA
IMM32.dll116ImmSetCompositionWindow
WINMM.dll8PlaySoundA
KERNEL32.dll1110SetEnvironmentVariableA
KERNEL32.dll100CompareStringW
KERNEL32.dll724HeapSize
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll1126SetFilePointer
KERNEL32.dll617GetStringTypeW
KERNEL32.dll1159SetStdHandle
KERNEL32.dll474GetEnvironmentStringsW
KERNEL32.dll353FreeEnvironmentStringsW
KERNEL32.dll831LoadLibraryW
KERNEL32.dll717HeapCreate
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll813LCMapStringW
KERNEL32.dll664GetTimeZoneInformation
KERNEL32.dll1202Sleep
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll1058SetCommBreak
KERNEL32.dll410GetConsoleCP
KERNEL32.dll1139SetLastError
KERNEL32.dll1222TlsFree
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1223TlsGetValue
KERNEL32.dll1221TlsAlloc
KERNEL32.dll778IsValidCodePage
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll1048RtlUnwind
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll499GetFileType
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll612GetStdHandle
KERNEL32.dll1135SetHandleCount
KERNEL32.dll1216TerminateProcess
KERNEL32.dll234EncodePointer
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll723HeapSetInformation
KERNEL32.dll390GetCommandLineA
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll202DecodePointer
KERNEL32.dll281ExitProcess
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll719HeapFree
KERNEL32.dll722HeapReAlloc
KERNEL32.dll715HeapAlloc
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll454GetDateFormatA
KERNEL32.dll446GetCurrentDirectoryA
KERNEL32.dll136CreateFileA
KERNEL32.dll388GetCommState
KERNEL32.dll1061SetCommState
KERNEL32.dll1062SetCommTimeouts
KERNEL32.dll79ClearCommBreak
KERNEL32.dll161CreatePipe
KERNEL32.dll1136SetHandleInformation
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll896OpenProcess
KERNEL32.dll836LocalAlloc
KERNEL32.dll840LocalFree
KERNEL32.dll686GetWindowsDirectoryA
KERNEL32.dll306FindFirstFileA
KERNEL32.dll323FindNextFileA
KERNEL32.dll302FindClose
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll703GlobalMemoryStatus
KERNEL32.dll452GetCurrentThread
KERNEL32.dll657GetThreadTimes
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll594GetProcessTimes
KERNEL32.dll631GetSystemTime
KERNEL32.dll632GetSystemTimeAdjustment
KERNEL32.dll349FormatMessageA
KERNEL32.dll623GetSystemDirectoryA
KERNEL32.dll1317WriteFile
KERNEL32.dll130CreateEventA
KERNEL32.dll960ReadFile
KERNEL32.dll514GetLastError
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll568GetOverlappedResult
KERNEL32.dll143CreateFileW
KERNEL32.dll1113SetEvent
KERNEL32.dll828LoadLibraryA
KERNEL32.dll354FreeLibrary
KERNEL32.dll137CreateFileMappingA
KERNEL32.dll855MapViewOfFile
KERNEL32.dll1238UnmapViewOfFile
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll164CreateProcessA
KERNEL32.dll82CloseHandle
KERNEL32.dll54Beep
KERNEL32.dll181CreateThread
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll691GlobalAlloc
KERNEL32.dll702GlobalLock
KERNEL32.dll709GlobalUnlock
KERNEL32.dll698GlobalFree
KERNEL32.dll767IsDBCSLeadByteEx
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll516GetLocaleInfoA
KERNEL32.dll567GetOEMCP
KERNEL32.dll370GetCPInfo
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll581GetProcAddress
KERNEL32.dll675GetVersionExA
KERNEL32.dll870MulDiv
KERNEL32.dll659GetTickCount
KERNEL32.dll1107SetEndOfFile
KERNEL32.dll586GetProcessHeap
KERNEL32.dll1100SetCurrentDirectoryA
KERNEL32.dll360GetACP
KERNEL32.dll515GetLocalTime
KERNEL32.dll475GetEnvironmentVariableA
KERNEL32.dll661GetTimeFormatA
KERNEL32.dll211DeleteFileA
KERNEL32.dll428GetConsoleMode
USER32.dll247FindWindowA
USER32.dll281GetClipboardOwner
USER32.dll364GetQueueStatus
USER32.dll808WinHelpA
USER32.dll299GetDoubleClickTime
USER32.dll381GetSystemMenu
USER32.dll106CreateMenu
USER32.dll659SetForegroundWindow
USER32.dll301GetForegroundWindow
USER32.dll785UpdateWindow
USER32.dll562PeekMessageA
USER32.dll540MsgWaitForMultipleObjects
USER32.dll475IsWindow
USER32.dll425HideCaret
USER32.dll729ShowCaret
USER32.dll89CreateCaret
USER32.dll764TranslateMessage
USER32.dll214EnableMenuItem
USER32.dll373GetScrollInfo
USER32.dll288GetCursorPos
USER32.dll758TrackPopupMenu
USER32.dll621ScreenToClient
USER32.dll318GetKeyboardLayout
USER32.dll662SetKeyboardState
USER32.dll756ToUnicodeEx
USER32.dll754ToAsciiEx
USER32.dll688SetScrollInfo
USER32.dll348GetMessageTime
USER32.dll529MessageBoxIndirectA
USER32.dll63CheckMenuItem
USER32.dll265GetCaretBlinkTime
USER32.dll155DefWindowProcA
USER32.dll446InvalidateRect
USER32.dll710SetWindowPos
USER32.dll220EndPaint
USER32.dll416GetWindowTextA
USER32.dll417GetWindowTextLengthA
USER32.dll276GetClientRect
USER32.dll14BeginPaint
USER32.dll482IsZoomed
USER32.dll251FlashWindow
USER32.dll278GetClipboardData
USER32.dll591RegisterClipboardFormatA
USER32.dll550OpenClipboard
USER32.dll213EmptyClipboard
USER32.dll646SetClipboardData
USER32.dll73CloseClipboard
USER32.dll642SetCaretPos
USER32.dll483KillTimer
USER32.dll699SetTimer
USER32.dll322GetKeyboardState
USER32.dll643SetClassLongA
USER32.dll648SetCursor
USER32.dll730ShowCursor
USER32.dll107CreatePopupMenu
USER32.dll439InsertMenuA
USER32.dll158DeleteMenu
USER32.dll565PostMessageA
USER32.dll714SetWindowTextA
USER32.dll735ShowWindow
USER32.dll109CreateWindowExA
USER32.dll412GetWindowRect
USER32.dll747SystemParametersInfoA
USER32.dll379GetSysColor
USER32.dll161DestroyCaret
USER32.dll587RegisterClassA
USER32.dll166DestroyWindow
USER32.dll516MapDialogRect
USER32.dll631SendMessageA
USER32.dll9AppendMenuA
USER32.dll465IsIconic
USER32.dll382GetSystemMetrics
USER32.dll264GetCapture
USER32.dll612ReleaseCapture
USER32.dll492LoadIconA
USER32.dll291GetDesktopWindow
USER32.dll539MoveWindow
USER32.dll148DefDlgProcA
USER32.dll488LoadCursorA
USER32.dll98CreateDialogParamA
USER32.dll345GetMessageA
USER32.dll405GetWindowLongA
USER32.dll460IsDialogMessageA
USER32.dll174DispatchMessageA
USER32.dll567PostQuitMessage
USER32.dll216EnableWindow
USER32.dll171DialogBoxParamA
USER32.dll218EndDialog
USER32.dll356GetParent
USER32.dll639SetActiveWindow
USER32.dll411GetWindowPlacement
USER32.dll709SetWindowPlacement
USER32.dll610RegisterWindowMessageA
USER32.dll195DrawEdge
USER32.dll640SetCapture
USER32.dll297GetDlgItemTextA
USER32.dll526MessageBoxA
USER32.dll658SetFocus
USER32.dll295GetDlgItem
USER32.dll655SetDlgItemTextA
USER32.dll62CheckDlgButton
USER32.dll462IsDlgButtonChecked
USER32.dll65CheckRadioButton
USER32.dll707SetWindowLongA
USER32.dll525MessageBeep
USER32.dll626SendDlgItemMessageA
USER32.dll289GetDC
USER32.dll613ReleaseDC
GDI32.dll604RealizePalette
GDI32.dll632SelectPalette
GDI32.dll73CreatePalette
GDI32.dll311ExtTextOutA
GDI32.dll447GetCharacterPlacementW
GDI32.dll639SetBkMode
GDI32.dll426GetBkMode
GDI32.dll312ExtTextOutW
GDI32.dll434GetCharABCWidthsFloatA
GDI32.dll516GetPixel
GDI32.dll676SetTextAlign
GDI32.dll47CreateCompatibleBitmap
GDI32.dll230DeleteObject
GDI32.dll507GetObjectA
GDI32.dll570MoveToEx
GDI32.dll75CreatePen
GDI32.dll667SetPixel
GDI32.dll599Polyline
GDI32.dll445GetCharWidthW
GDI32.dll439GetCharWidth32W
GDI32.dll440GetCharWidthA
GDI32.dll438GetCharWidth32A
GDI32.dll666SetPaletteEntries
GDI32.dll700UnrealizeObject
GDI32.dll701UpdateColors
GDI32.dll305ExcludeClipRect
GDI32.dll560IntersectClipRect
GDI32.dll41CreateBitmap
GDI32.dll227DeleteDC
GDI32.dll541GetTextExtentPoint32A
GDI32.dll566LineTo
GDI32.dll48CreateCompatibleDC
GDI32.dll696TextOutA
GDI32.dll638SetBkColor
GDI32.dll678SetTextColor
GDI32.dll607Rectangle
GDI32.dll84CreateSolidBrush
GDI32.dll525GetStockObject
GDI32.dll631SelectObject
GDI32.dll61CreateFontIndirectA
GDI32.dll537GetTextExtentExPointA
GDI32.dll660SetMapMode
GDI32.dll459GetDeviceCaps
GDI32.dll549GetTextMetricsA
GDI32.dll698TranslateCharsetInfo
GDI32.dll60CreateFontA
WINSPOOL.DRV143OpenPrinterA
WINSPOOL.DRV188WritePrinter
WINSPOOL.DRV181StartDocPrinterA
WINSPOOL.DRV183StartPagePrinter
WINSPOOL.DRV82EndPagePrinter
WINSPOOL.DRV103EnumPrintersA
WINSPOOL.DRV29ClosePrinter
WINSPOOL.DRV81EndDocPrinter
COMDLG32.dll11GetOpenFileNameA
COMDLG32.dll2ChooseFontA
COMDLG32.dllChooseColorA
COMDLG32.dll13GetSaveFileNameA
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll607RegOpenKeyA
ADVAPI32.dll356GetUserNameA
ADVAPI32.dll118CopySid
ADVAPI32.dll568RegCreateKeyExA
ADVAPI32.dll583RegDeleteValueA
ADVAPI32.dll589RegEnumKeyA
ADVAPI32.dll573RegDeleteKeyA
ADVAPI32.dll637RegSetValueExA
ADVAPI32.dll567RegCreateKeyA
ADVAPI32.dll310GetLengthSid
ADVAPI32.dll560RegCloseKey
SHELL32.dll286ShellExecuteA
ole32.dll16CoCreateInstance
ole32.dll62CoInitialize
ole32.dll108CoUninitialize
WS2_32.dll19
WS2_32.dll52
WS2_32.dll9
WS2_32.dll23
WS2_32.dll3
WS2_32.dll4

StringTable 080904B0

CompanyNameSimon Tatham
ProductNamePuTTY suite
FileDescriptionSSH, Telnet and Rlogin client
InternalNamePuTTY
OriginalFilenamePuTTY
FileVersionUnidentified build
ProductVersionUnidentified build
LegalCopyrightCopyright © 1997-2013 Simon Tatham.
PrivateBuildUnidentified build

VS_FIXEDFILEINFO

FileVersion0.0.0.0
ProductVersion0.0.0.0
StrucVersion0x10000
FileFlagsMask0xb
FileFlags8
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0593920EXE11/29/2013 10:41:13#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK