mergecap[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

mergecap.exe
Size

320KB
MD5

2365cf1fc296dc929d265e2b94f74678
SHA1

4e4adbebbea25268722a1ab99650daf86f189858
SHA256

77fe77e2a324bade4f26c7aad5f8356b0328d595e14de500f843ac1eb5405288
SHA512

2667d0737d57686b96c3a9dbb9772556d1e72f99b609ed78df68060539c27a48147877b7ab3fb5ffa4a6ff5191d0a2b1db9670dcc1a4e2b05a14746bc0e40fd9
SSDEEP

1536:qlrKMg6wdff/L+0mXbpy7T7ODuYUg48o0VBgWHncnFPXavErjnCj2We2Vk4AUFeB:Ndff/L+0mXbAyr2rFP0oBjeor

Score

1^/10

Malware Config

Signatures

Files

mergecap.exe
.exe windows:6 windows x64 arch:x64

bda1a3ed7ad600ac6e39f8dd4b2095df

Code Sign

02:cc:d9:9f:7d:55:6c:13:ce:87:10:c6:9d:09:b3:1a
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/04/2019, 00:00

Not After

14/04/2022, 23:59

Subject

CN=Wireshark Foundation\, Inc.,O=Wireshark Foundation\, Inc.,POSTALCODE=95616,STREET=711 4th street,L=Davis,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c3:4e:3c:7b:6f:ae:e5:6c:c7:36:f2:15:83:cf:1b:59:e7:4e:cb:ed:ca:c0:25:e7:c3:62:2e:10:35:fd:36:83
Signer

Actual PE Digest

c3:4e:3c:7b:6f:ae:e5:6c:c7:36:f2:15:83:cf:1b:59:e7:4e:cb:ed:ca:c0:25:e7:c3:62:2e:10:35:fd:36:83

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\buildbot\builders\wireshark-3.4-64\windows-2019-x64\build\cmbuild\run\RelWithDebInfo\mergecap.pdb

Imports

libwiretap

wtap_encap_description
wtap_file_type_subtype_short_string
wtap_dump_can_open
wtap_file_encap
merge_files
wtap_get_num_file_types_subtypes
merge_idb_merge_mode_to_string
wtap_file_type_subtype_string
wtap_strerror
wtap_file_type_subtype
wtap_init
wtap_short_string_to_file_type_subtype
wtap_cleanup
wtap_encap_name
merge_files_to_stdout
merge_string_to_idb_merge_mode

libwsutil

optarg
free_progdirs
init_progfile_dir
init_process_policies
create_app_running_mutex
optind
init_report_message
optopt
getopt_long
ws_strtoi32
ws_strtou32
file_open_error_message
plugins_get_count
get_copyright_info
get_cpu_info
get_os_version_info
ws_add_crash_info

gmodule-2

g_module_supported

glib-2

g_slist_insert_sorted
g_malloc_n
g_slist_free
g_assertion_message_expr
g_free
g_slist_foreach
g_strjoinv
g_string_free
g_string_new
g_string_append_printf
g_strsplit
g_ascii_strtod
g_strdup
g_strdup_printf
g_strfreev
g_string_append

kernel32

GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GlobalMemoryStatusEx
WideCharToMultiByte

vcruntime140

__C_specific_handler
strchr
__std_type_info_destroy_list
memset
__current_exception
__current_exception_context

api-ms-win-crt-stdio-l1-1-0

__p__commode
__stdio_common_vfprintf
_set_fmode
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
terminate
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_register_onexit_function
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
exit
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_errno

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bda1a3ed7ad600ac6e39f8dd4b2095df

Code Sign

02:cc:d9:9f:7d:55:6c:13:ce:87:10:c6:9d:09:b3:1aCertificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

c3:4e:3c:7b:6f:ae:e5:6c:c7:36:f2:15:83:cf:1b:59:e7:4e:cb:ed:ca:c0:25:e7:c3:62:2e:10:35:fd:36:83Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libwiretap

libwsutil

gmodule-2

glib-2

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 283KB - Virtual size: 282KB

.reloc Size: 512B - Virtual size: 56B

02:cc:d9:9f:7d:55:6c:13:ce:87:10:c6:9d:09:b3:1a
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

c3:4e:3c:7b:6f:ae:e5:6c:c7:36:f2:15:83:cf:1b:59:e7:4e:cb:ed:ca:c0:25:e7:c3:62:2e:10:35:fd:36:83
Signer

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 283KB - Virtual size: 282KB

.reloc
Size: 512B - Virtual size: 56B