File scan report
Verdict Safe
Is tftp.
TFTP utility with 18-year prevalence, zero major detections, and legitimate protocol-specific network behaviour.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 18y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This is a TFTP (Trivial File Transfer Protocol) utility that has been widely distributed for 18 years without malicious reports from major antivirus engines. One of our behaviour rules matched because the sample contacts external IPs without DNS — a normal characteristic of TFTP, which operates directly over IP. No malicious sandbox verdicts or files it created detected.
The file shows no malicious detections from any of the 17 major antivirus engines (Kaspersky, BitDefender, ESET-NOD32, Avast, Fortinet, and others), despite 18 years of prevalence and 212 submissions from 180 unique sources. The triggered one of our behaviour rules is a false positive: TFTP is a protocol that legitimately uses direct IP communication for file transfer operations and does not require DNS resolution. The CIRCL reference to malshare.com is a less reliable (score 30) research archive hit, not a malware confirmation. All detected MITRE techniques are routine/benign. No malicious sandbox verdicts, files it created, or contacted malicious hosts were observed. The file is unsigned but its long history and lack of major detections indicate legitimate legacy software.
What We Detected
A 45 KB Windows executable named tftp.EXE with an import-table fingerprint of bc122750e862ddf28b7587d4792432e4. The file is unsigned and has been in circulation since 2008 (18 years). It is tagged as containing 'armadillo' (a legitimate software packer) and 'overlay' (common in older utilities). PE entropy is normal (5.36); no high-entropy code or packing indicators present.
Engine & Signer Analysis
All 17 major antivirus engines (Kaspersky, BitDefender, ESET-NOD32, Avast, Fortinet, Emsisoft, F-Secure, Ikarus, GData, DrWeb, Avira, AVG, and others) report the file as undetected. Zero malicious detections across 70 reporting engines. No major family consensus. The file is unsigned, but its 18-year prevalence (212 submissions from 180 unique sources) and complete absence of major detections strongly indicate legitimate software.
Threat Behavior
The sample contacted 9 external IP addresses (including Microsoft Azure ranges 52.185.73.156, 20.99.133.109, 20.69.140.28) with zero domain contacts. This triggered one of our behaviour rules (medium severity). However, TFTP (Trivial File Transfer Protocol) is a file-transfer protocol that operates directly over IP and does not use DNS — this is expected and legitimate behaviour, not a a control server beacon. Detected MITRE techniques are T1016 (System Network Configuration Discovery), T1071 (Application Layer Protocol), T1071.001 (DNS), and T1082 (System Information Discovery) — all routine/benign. No offensive techniques, no malicious sandbox verdicts, no dropped malicious files it created, no contacted hosts in our malicious cache.
External Intelligence
CIRCL database returned a hit with trust score 30 (low) and knownMalicious='malshare.com'. Malshare is a community malware research archive; presence there does not confirm active malware. No YARA rules matched. No MalwareBazaar family hit.
What To Do Now
This file is a legitimate TFTP utility. No action is required. One of our behaviour rules is a false positive triggered by the protocol's normal direct-IP communication pattern. If you are running this file, it is safe to continue. If you wish to verify, check the file's origin against official TFTP utility distributions or your organization's software inventory.
Where this verdict could be wrong3 caveats
- One of our behaviour rules matched (medium severity) — direct-IP a control server without DNS is flagged as suspicious. However, TFTP is a protocol that legitimately operates over direct IP addresses for file transfer and does not require DNS resolution. The rule does not distinguish between malware a control server and legitimate protocol-specific behaviour.
- CIRCL indexed the sample with knownMalicious='malshare.com'. Malshare is a community malware repository used by researchers; presence there does not confirm the file is active malware — it may be archived for historical or research purposes.
- File age (6673 days / 18 years) and high prevalence (212 submissions) could indicate either a widely-used legitimate utility or a very old malware sample. However, the complete absence of major detections across 18 years strongly favours the legitimate interpretation.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero major antivirus engine detections across 17 major antivirus engines
- 18-year prevalence (212 submissions, 180 unique sources) without mass malicious reports
- All MITRE techniques are routine/benign; no offensive techniques detected
- No malicious sandbox verdicts, files it created, or malicious host contacts
- Normal PE entropy and no packing indicators; legitimate file structure
- One of our behaviour rules matched — but TFTP legitimately uses direct IP communication without DNS
- Unsigned executable — however, 18-year prevalence and zero major detections mitigate this
- CIRCL research archive reference — less reliable indicator, not a malware confirmation
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 4sandbox rule tags
- 2spawned processes
- 3network contacts
- 11filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
4MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1016· Network recon
- T1071· Application protocol
- T1071.001· Application protocol
- T1082· System recon
Observed activity
Processes started
2Programs the file ran, with their command lines.
tftp.EXE%SAMPLEPATH%\tftp.EXEacdff00ece50f2eb8ad15c5c531121acc5fa932c742e1ef31ff7c98b9d05a84f.exe%SAMPLEPATH%\acdff00ece50f2eb8ad15c5c531121acc5fa932c742e1ef31ff7c98b9d05a84f.exe
Network contacts
33 hosts, listed as 3 addresses. Links show the host and path only.
- IP address
8.59.4.126 - IP address
23.40.197.184 - IP address
23.46.228.41
Files
4Files the file created, changed or deleted.
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2064.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2075.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2086.tmp.txt - Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Deleted
\REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Software\996E\Recent File List\
Mutexes
7Named locks a program uses so only one copy runs; malware families often reuse them.
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 7 entries for mutexes
MSCTF.Shared.MUTEX.EBH
Sandbox background — not the file
9The analysis machine's own processes and connections, recorded in every run.
- VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google3092_887717611\bin\updater.exe - VM host
a83f:8110:0:0:1b00:100:2800:0 - VM host
192.168.0.5 - VM host
52.185.73.156 - VM host
20.99.133.109
Show all 9 entries for sandbox background — not the file
- VM host
a83f:8110:4646:4646:4646:4646:4646:4646 - VM host
23.196.145.221 - VM host
20.69.140.28
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jul 8, 2026, 4:20 AM UTC
- SHA-256
acdff00ece50f2eb8ad15c5c531121acc5fa932c742e1ef31ff7c98b9d05a84f- SHA-1
3ce7f797dc3d4505a513fb42d2580c765a5011bc- MD5
ee665224ee8b19ba66b8578dd471e0a8
About this file
tftp.EXE is a Win32 EXE file of 45.5 kB.
- Type and size
- Win32 EXE · 45.5 kB
- Signer
- UnsignedNo code signature.
- First seen
- Mar 31, 2008On VirusTotal.
- Submitted by
- 180 distinct sources
- Packer
- None detected
- Entropy
- 5.36 of 8
First scanned Updated
Verdict history
- Suspicious
- Safeafter a new scan
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 70 engines flagged this file
4 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is tftp.EXE safe?
What is tftp.EXE?
How many antivirus engines detected tftp.EXE?
What is the SHA-256 hash of tftp.EXE?
Is it safe to run tftp.EXE?
How up to date is this analysis of tftp.EXE?
Community
Member reviews and reports for this exact file hash.