File scan report
Verdict Safe
Is tftp.
TFTP utility with 18-year prevalence, zero major detections, and legitimate protocol-specific network behaviour.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 18y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This is a TFTP (Trivial File Transfer Protocol) utility that has been widely distributed for 18 years without malicious reports from major antivirus engines. One of our behaviour rules matched because the sample contacts external IPs without DNS — a normal characteristic of TFTP, which operates directly over IP. No malicious sandbox verdicts or files it created detected.
The file shows no malicious detections from any of the 17 major antivirus engines (Kaspersky, BitDefender, ESET-NOD32, Avast, Fortinet, and others), despite 18 years of prevalence and 212 submissions from 180 unique sources. The triggered one of our behaviour rules is a false positive: TFTP is a protocol that legitimately uses direct IP communication for file transfer operations and does not require DNS resolution. The CIRCL reference to malshare.com is a less reliable (score 30) research archive hit, not a malware confirmation. All detected MITRE techniques are routine/benign. No malicious sandbox verdicts, files it created, or contacted malicious hosts were observed. The file is unsigned but its long history and lack of major detections indicate legitimate legacy software.
What We Detected
A 45 KB Windows executable named tftp.EXE with an import-table fingerprint of bc122750e862ddf28b7587d4792432e4. The file is unsigned and has been in circulation since 2008 (18 years). It is tagged as containing 'armadillo' (a legitimate software packer) and 'overlay' (common in older utilities). PE entropy is normal (5.36); no high-entropy code or packing indicators present.
Engine & Signer Analysis
All 17 major antivirus engines (Kaspersky, BitDefender, ESET-NOD32, Avast, Fortinet, Emsisoft, F-Secure, Ikarus, GData, DrWeb, Avira, AVG, and others) report the file as undetected. Zero malicious detections across 70 reporting engines. No major family consensus. The file is unsigned, but its 18-year prevalence (212 submissions from 180 unique sources) and complete absence of major detections strongly indicate legitimate software.
Threat Behavior
The sample contacted 9 external IP addresses (including Microsoft Azure ranges 52.185.73.156, 20.99.133.109, 20.69.140.28) with zero domain contacts. This triggered one of our behaviour rules (medium severity). However, TFTP (Trivial File Transfer Protocol) is a file-transfer protocol that operates directly over IP and does not use DNS — this is expected and legitimate behaviour, not a a control server beacon. Detected MITRE techniques are T1016 (System Network Configuration Discovery), T1071 (Application Layer Protocol), T1071.001 (DNS), and T1082 (System Information Discovery) — all routine/benign. No offensive techniques, no malicious sandbox verdicts, no dropped malicious files it created, no contacted hosts in our malicious cache.
External Intelligence
CIRCL database returned a hit with trust score 30 (low) and knownMalicious='malshare.com'. Malshare is a community malware research archive; presence there does not confirm active malware. No YARA rules matched. No MalwareBazaar family hit.
What To Do Now
This file is a legitimate TFTP utility. No action is required. One of our behaviour rules is a false positive triggered by the protocol's normal direct-IP communication pattern. If you are running this file, it is safe to continue. If you wish to verify, check the file's origin against official TFTP utility distributions or your organization's software inventory.
Where this verdict could be wrong3 caveats
- One of our behaviour rules matched (medium severity) — direct-IP a control server without DNS is flagged as suspicious. However, TFTP is a protocol that legitimately operates over direct IP addresses for file transfer and does not require DNS resolution. The rule does not distinguish between malware a control server and legitimate protocol-specific behaviour.
- CIRCL indexed the sample with knownMalicious='malshare.com'. Malshare is a community malware repository used by researchers; presence there does not confirm the file is active malware — it may be archived for historical or research purposes.
- File age (6673 days / 18 years) and high prevalence (212 submissions) could indicate either a widely-used legitimate utility or a very old malware sample. However, the complete absence of major detections across 18 years strongly favours the legitimate interpretation.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero major antivirus engine detections across 17 major antivirus engines
- 18-year prevalence (212 submissions, 180 unique sources) without mass malicious reports
- All MITRE techniques are routine/benign; no offensive techniques detected
- No malicious sandbox verdicts, files it created, or malicious host contacts
- Normal PE entropy and no packing indicators; legitimate file structure
- One of our behaviour rules matched — but TFTP legitimately uses direct IP communication without DNS
- Unsigned executable — however, 18-year prevalence and zero major detections mitigate this
- CIRCL research archive reference — less reliable indicator, not a malware confirmation
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 4sandbox rule tags
- 2spawned processes
- 3network contacts
- 11filesystem & mutex artifacts
Includes 4 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jul 8, 2026, 4:20 AM UTC
- SHA-256
acdff00ece50f2eb8ad15c5c531121acc5fa932c742e1ef31ff7c98b9d05a84f- SHA-1
3ce7f797dc3d4505a513fb42d2580c765a5011bc- MD5
ee665224ee8b19ba66b8578dd471e0a8
About this file
tftp.EXE is a Win32 EXE file of 45.5 kB.
- Type and size
- Win32 EXE · 45.5 kB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 31, 2008On VirusTotal.
- Submitted by
- 180 distinct sources
- Packer
- None detected
- Entropy
- 5.36 of 8
First scanned Updated
Verdict history
- Suspicious
- Safeafter a new scan
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (74), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is tftp.EXE safe?
What is tftp.EXE?
How many antivirus engines detected tftp.EXE?
What is the SHA-256 hash of tftp.EXE?
Is it safe to run tftp.EXE?
How up to date is this analysis of tftp.EXE?
Community
Member reviews and reports for this exact file hash.