text2pcap[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

text2pcap.exe
Size

336KB
MD5

d5e357a94970cb59f60a99020b1fb8e6
SHA1

2bdf1cf33b39d713c31eee2a93eccc29060493ac
SHA256

5becf66a90666d8b9074f417b764d94365cd0f11d4f2e164d5ec56385b0eeffb
SHA512

e85d2c49c1718c6e82e51b358875e8e40421a66e393668fded674865dda9b95df72759f18202214a446569ed86628ebcbaf1236091447914e68e7b8ca6c4a2e6
SSDEEP

1536:xj7JqYyHxTYdOFmmWedH5OZGZLy7T7ODuYUg48o0VBgWHncnFPXavErjnCj2We2q:qHxTYdOFmZedH5OZGkyr2rFP0oBjYOp

Score

1^/10

Malware Config

Signatures

Files

text2pcap.exe
.exe windows:6 windows x64 arch:x64

08e1a80bfc7e2c1d68ea8a9c0bfa748c

Code Sign

02:cc:d9:9f:7d:55:6c:13:ce:87:10:c6:9d:09:b3:1a
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/04/2019, 00:00

Not After

14/04/2022, 23:59

Subject

CN=Wireshark Foundation\, Inc.,O=Wireshark Foundation\, Inc.,POSTALCODE=95616,STREET=711 4th street,L=Davis,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:e5:17:56:16:6c:81:56:4e:dd:06:65:7b:f9:83:23:93:67:6a:0c:44:9c:c5:0a:e7:cf:91:c8:47:d7:84:30
Signer

Actual PE Digest

24:e5:17:56:16:6c:81:56:4e:dd:06:65:7b:f9:83:23:93:67:6a:0c:44:9c:c5:0a:e7:cf:91:c8:47:d7:84:30

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\buildbot\builders\wireshark-3.4-64\windows-2019-x64\build\cmbuild\run\RelWithDebInfo\text2pcap.pdb

Imports

libwsutil

optarg
plugins_get_count
get_copyright_info
get_cpu_info
get_os_version_info
ws_add_crash_info
getopt_long
ws_inet_pton4
optind
strptime
create_app_running_mutex
ws_stdio_fopen
ws_inet_pton6

gmodule-2

g_module_supported

glib-2

g_string_append_printf
g_strfreev
g_string_new
g_string_free
g_strjoinv
g_strdup_printf
g_malloc
g_strsplit
g_strerror
g_string_append
g_free
g_ascii_table
g_strlcpy

kernel32

UnhandledExceptionFilter
GlobalMemoryStatusEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
WideCharToMultiByte
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemTimeAsFileTime

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
strchr
__current_exception
__current_exception_context
memset
memcpy
memmove

api-ms-win-crt-runtime-l1-1-0

exit
_cexit
__p___wargv
_seh_filter_dll
_crt_at_quick_exit
__p___argc
_exit
terminate
_errno
_crt_atexit
_execute_onexit_table
_initialize_onexit_table
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_register_onexit_function
_configure_wide_argv
_initterm_e
_configure_narrow_argv
_set_app_type
_initialize_narrow_environment
_c_exit
_seh_filter_exe
_register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

getc
clearerr
ferror
__stdio_common_vsscanf
fwrite
_setmode
_set_fmode
__stdio_common_vfprintf
fclose
__acrt_iob_func
__p__commode
fread

api-ms-win-crt-time-l1-1-0

_mktime64
_time64
_localtime64

api-ms-win-crt-convert-l1-1-0

strtoul
strtol

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
malloc
realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 282KB - Virtual size: 282KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

08e1a80bfc7e2c1d68ea8a9c0bfa748c

Code Sign

02:cc:d9:9f:7d:55:6c:13:ce:87:10:c6:9d:09:b3:1aCertificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

24:e5:17:56:16:6c:81:56:4e:dd:06:65:7b:f9:83:23:93:67:6a:0c:44:9c:c5:0a:e7:cf:91:c8:47:d7:84:30Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libwsutil

gmodule-2

glib-2

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 260KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 282KB - Virtual size: 282KB

.reloc Size: 512B - Virtual size: 80B

02:cc:d9:9f:7d:55:6c:13:ce:87:10:c6:9d:09:b3:1a
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

24:e5:17:56:16:6c:81:56:4e:dd:06:65:7b:f9:83:23:93:67:6a:0c:44:9c:c5:0a:e7:cf:91:c8:47:d7:84:30
Signer

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 260KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 282KB - Virtual size: 282KB

.reloc
Size: 512B - Virtual size: 80B