| 文件名 | putty.exe |
| 文件类型 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.165.174 |
| 数据库版本 | 2024-02-21 16:00:24 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
8713948f6a5d69c47b9d9e3d4f97514e
|
|
| SHA1 |
96daedbbfa5a2f61ee09209f4b2570110f6ca0bd
|
|
| SHA256 |
82879e3dd0c0958f2450d166e58164d6ca1dccfc25af755bd41773197f9aa152
|
|
| SHA512 |
26e62653248dd1edecf70bcb323c9663d6073484d40c2edc9fa6815cba7d37a7683d4df055e1154fa2b3f03c6949735369c696b88c17e07ca6341c798365e5eb
|
|
| ImpHash |
69573714e11441683ea863c40a1c0d54
|
| 图标 |
哈希: bcac48e087f1dc6c5a808a84205bfc75
模糊: 8f9d5ea21bf06396dd364157254ed6fb dHash: c49081903c52b2b6 |
| 映像基址 | 0x140000000 |
| 入口点 | 0x1400b8814 |
| 编译时间 | 2022-10-28 17:25:37 |
| 校验和 | 0x0019a844 (实际: 0x0019aa46) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 数字签名 | The expected hash does not match the digest in SpcInfo |
| 导入 |
8 库
GDI32, IMM32, ole32, USER32, KERNEL32, SHELL32, COMDLG32, ADVAPI32 |
| 导出 | 0 函数 |
| 资源 | 24 资源 |
| 节 | 10 节 |
| CompanyName | Simon Tatham |
| ProductName | PuTTY suite |
| FileDescription | SSH, Telnet, Rlogin, and SUPDUP client |
| InternalName | PuTTY |
| OriginalFilename | PuTTY |
| FileVersion | Release 0.78 (with embedded help) |
| ProductVersion | Release 0.78 |
| LegalCopyright | Copyright © 1997-2022 Simon Tatham. |
| Translation | 0x0809 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
940,390 bytes | 940,544 bytes | 6.45 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
860F1DFCF6CD1B8B4554C720E9DABC33 |
.rdata |
0x000e7000 |
262,076 bytes | 262,144 bytes | 5.49 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
228A69366BB3B0CA24B9BB33E23F209D |
.data |
0x00127000 |
21,916 bytes | 4,096 bytes | 2.10 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
4552ECC4335E4E6C837F618D7665B75C |
.pdata |
0x0012d000 |
27,768 bytes | 28,160 bytes | 5.81 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
C26D83979F377EF59900BFE49426A79B |
.00cfg |
0x00134000 |
56 bytes | 512 bytes | 0.51 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
40F36A6B3AF5D5530C69BFDECF864B10 |
.gxfg |
0x00135000 |
10,848 bytes | 11,264 bytes | 5.10 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
BA6AA0A7BDC8ED78DB6DEE460F93C19C |
.tls |
0x00138000 |
17 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BF619EAC0CDF3F68D496EA9344137E8B |
_RDATA |
0x00139000 |
348 bytes | 512 bytes | 3.32 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
753E5628BF2DCB4275789C2FC7E2E79E |
.rsrc |
0x0013a000 |
368,472 bytes | 368,640 bytes | 7.82 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
DFBD22FCA67F9611B87DDDDD71534DF4 |
.reloc |
0x00194000 |
7,848 bytes | 8,192 bytes | 5.39 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
88EAC11A0A4C1E5B663C8D97C226E5B9 |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 12 | 7,952 字节 | |
| RT_DIALOG | 7 | 1,512 字节 | |
| RT_GROUP_ICON | 2 | 180 字节 | |
| RT_VERSION | 1 | 824 字节 | |
| RT_MANIFEST | 1 | 1,369 字节 | |
| None | 1 | 355,279 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The expected hash does not match the digest in SpcInfo
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
