0
rated 0 times
[
0]
[
0]
/ answers: 1 / hits: 709
/ 2 Years ago, sun, june 12, 2022, 10:45:40
Yesterday a file that should not exist appeared in my Downloads folder.
Virustotal knows the file since 2012 and reports it as clean - but it seems other people have had it appear.
Does anyone know more? Anyone else seen this? I assume it's harmless and caused by a bug, but maybe not?
File: a.out 1759 bytes
MD5 f61595bec6cc87903ce1677723c878cb
SHA1 fbe66f197516eed6bb357db1bb19ed0d2c3d8fa8
SHA256 e20c67711743553e16501b65a9921f59643edafd32d46e37f916d43e0023ffc3
ssdeep
12:Bvw/bg0scb46s4czclqJ/dXrI2+1E2X3VE6XVZ6tXcq/+/39WuZ8KVXMnikezGFE:GfE6s+u+NHdX+tMqQMOMW
Disassembly:
a.out: file format elf64-x86-64
Disassembly of section .interp:
0000000000400158 <.interp>:
400158: 2f (bad)
400159: 6c insb (%dx),%es:(%rdi)
40015a: 69 62 2f 6c 64 36 34 imul $0x3436646c,0x2f(%rdx),%esp
400161: 2e 73 6f jae,pn 4001d3 <_GLOBAL_OFFSET_TABLE_+0x4001d3>
400164: 2e 31 00 xor %eax,%cs:(%rax)
Disassembly of section .hash:
0000000000400168 <.hash>:
400168: 01 00 add %eax,(%rax)
...
Disassembly of section .dynstr:
0000000000400178 <.dynstr>:
400178: 00 6c 69 62 add %ch,0x62(%rcx,%rbp,2)
40017c: 72 74 jb 4001f2 <_GLOBAL_OFFSET_TABLE_+0x4001f2>
40017e: 2e 73 6f jae,pn 4001f0 <_GLOBAL_OFFSET_TABLE_+0x4001f0>
400181: 2e 31 00 xor %eax,%cs:(%rax)
Disassembly of section .eh_frame:
0000000000400188 <.eh_frame>:
400188: 14 00 adc $0x0,%al
40018a: 00 00 add %al,(%rax)
40018c: 00 00 add %al,(%rax)
40018e: 00 00 add %al,(%rax)
400190: 01 7a 52 add %edi,0x52(%rdx)
400193: 00 01 add %al,(%rcx)
400195: 78 10 js 4001a7 <_GLOBAL_OFFSET_TABLE_+0x4001a7>
400197: 01 1b add %ebx,(%rbx)
400199: 0c 07 or $0x7,%al
40019b: 08 90 01 00 00 24 or %dl,0x24000001(%rax)
4001a1: 00 00 add %al,(%rax)
4001a3: 00 1c 00 add %bl,(%rax,%rax,1)
...
4001ae: 00 00 add %al,(%rax)
4001b0: 00 0e add %cl,(%rsi)
4001b2: 10 46 0e adc %al,0xe(%rsi)
4001b5: 18 4a 0f sbb %cl,0xf(%rdx)
4001b8: 0b 77 08 or 0x8(%rdi),%esi
4001bb: 80 00 3f addb $0x3f,(%rax)
4001be: 1a 3b sbb (%rbx),%bh
4001c0: 2a 33 sub (%rbx),%dh
4001c2: 24 22 and $0x22,%al
4001c4: 00 00 add %al,(%rax)
...
Disassembly of section .dynamic:
00000000006001c8 <_DYNAMIC>:
6001c8: 01 00 add %eax,(%rax)
6001ca: 00 00 add %al,(%rax)
6001cc: 00 00 add %al,(%rax)
6001ce: 00 00 add %al,(%rax)
6001d0: 01 00 add %eax,(%rax)
6001d2: 00 00 add %al,(%rax)
6001d4: 00 00 add %al,(%rax)
6001d6: 00 00 add %al,(%rax)
6001d8: 04 00 add $0x0,%al
6001da: 00 00 add %al,(%rax)
6001dc: 00 00 add %al,(%rax)
6001de: 00 00 add %al,(%rax)
6001e0: 68 01 40 00 00 pushq $0x4001
6001e5: 00 00 add %al,(%rax)
6001e7: 00 05 00 00 00 00 add %al,0x0(%rip) # 6001ed <_DYNAMIC+0x25>
6001ed: 00 00 add %al,(%rax)
6001ef: 00 78 01 add %bh,0x1(%rax)
6001f2: 40 00 00 add %al,(%rax)
6001f5: 00 00 add %al,(%rax)
6001f7: 00 06 add %al,(%rsi)
6001f9: 00 00 add %al,(%rax)
6001fb: 00 00 add %al,(%rax)
6001fd: 00 00 add %al,(%rax)
6001ff: 00 78 01 add %bh,0x1(%rax)
600202: 40 00 00 add %al,(%rax)
600205: 00 00 add %al,(%rax)
600207: 00 0a add %cl,(%rdx)
600209: 00 00 add %al,(%rax)
60020b: 00 00 add %al,(%rax)
60020d: 00 00 add %al,(%rax)
60020f: 00 0c 00 add %cl,(%rax,%rax,1)
600212: 00 00 add %al,(%rax)
600214: 00 00 add %al,(%rax)
600216: 00 00 add %al,(%rax)
600218: 0b 00 or (%rax),%eax
60021a: 00 00 add %al,(%rax)
60021c: 00 00 add %al,(%rax)
60021e: 00 00 add %al,(%rax)
600220: 18 00 sbb %al,(%rax)
600222: 00 00 add %al,(%rax)
600224: 00 00 add %al,(%rax)
600226: 00 00 add %al,(%rax)
600228: 15 00 00 00 00 adc $0x0,%eax
...
Did not run compile jobs at that time.
Ubuntu 12.04.04 LTS 64bit.
File appeared while downloading packages from sourceforge with Firefox.
Bears same timestamp as one of the downloads.
Computer is connected to internet via router w/ firewall.
- I am certain the file is not of my own creation.
- Browser does not show any downloads apart from the ones I initiated.
- No site likely to infect visited at that point in time - unless Nixnote's sourceforge page got hacked.
- stat reveals nothing of note, no Birth date set.
readelf output:
ELF Header:
Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
Class: ELF64
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: Advanced Micro Devices X86-64
Version: 0x1
Entry point address: 0x0
Start of program headers: 64 (bytes into file)
Start of section headers: 744 (bytes into file)
Flags: 0x0
Size of this header: 64 (bytes)
Size of program headers: 56 (bytes)
Number of program headers: 5
Size of section headers: 64 (bytes)
Number of section headers: 10
Section header string table index: 7
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
[ 0] NULL 0000000000000000 00000000
0000000000000000 0000000000000000 0 0 0
[ 1] .interp PROGBITS 0000000000400158 00000158
000000000000000f 0000000000000000 A 0 0 1
[ 2] .hash HASH 0000000000400168 00000168
000000000000000c 0000000000000004 A 3 0 8
[ 3] .dynsym DYNSYM 0000000000400178 00000178
0000000000000000 0000000000000018 A 4 1 8
[ 4] .dynstr STRTAB 0000000000400178 00000178
000000000000000c 0000000000000000 A 0 0 1
[ 5] .eh_frame PROGBITS 0000000000400188 00000188
0000000000000040 0000000000000000 A 0 0 8
[ 6] .dynamic DYNAMIC 00000000006001c8 000001c8
00000000000000d0 0000000000000010 WA 4 0 8
[ 7] .shstrtab STRTAB 0000000000000000 00000298
000000000000004c 0000000000000000 0 0 1
[ 8] .symtab SYMTAB 0000000000000000 00000568
0000000000000138 0000000000000018 9 9 8
[ 9] .strtab STRTAB 0000000000000000 000006a0
000000000000003f 0000000000000000 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), l (large)
I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)
O (extra OS processing required) o (OS specific), p (processor specific)
There are no section groups in this file.
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
PHDR 0x0000000000000040 0x0000000000400040 0x0000000000400040
0x0000000000000118 0x0000000000000118 R E 8
INTERP 0x0000000000000158 0x0000000000400158 0x0000000000400158
0x000000000000000f 0x000000000000000f R 1
[Requesting program interpreter: /lib/ld64.so.1]
LOAD 0x0000000000000000 0x0000000000400000 0x0000000000400000
0x00000000000001c8 0x00000000000001c8 R 200000
LOAD 0x00000000000001c8 0x00000000006001c8 0x00000000006001c8
0x00000000000000d0 0x00000000000000d0 RW 200000
DYNAMIC 0x00000000000001c8 0x00000000006001c8 0x00000000006001c8
0x00000000000000d0 0x00000000000000d0 RW 8
Section to Segment mapping:
Segment Sections...
00
01 .interp
02 .interp .hash .dynsym .dynstr .eh_frame
03 .dynamic
04 .dynamic
Dynamic section at offset 0x1c8 contains 8 entries:
Tag Type Name/Value
0x0000000000000001 (NEEDED) Shared library: [librt.so.1]
0x0000000000000004 (HASH) 0x400168
0x0000000000000005 (STRTAB) 0x400178
0x0000000000000006 (SYMTAB) 0x400178
0x000000000000000a (STRSZ) 12 (bytes)
0x000000000000000b (SYMENT) 24 (bytes)
0x0000000000000015 (DEBUG) 0x0
0x0000000000000000 (NULL) 0x0
There are no relocations in this file.
There are no unwind sections in this file.
Symbol table '.dynsym' contains 0 entries:
Num: Value Size Type Bind Vis Ndx Name
Symbol table '.symtab' contains 13 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND
1: 0000000000400158 0 SECTION LOCAL DEFAULT 1
2: 0000000000400168 0 SECTION LOCAL DEFAULT 2
3: 0000000000400178 0 SECTION LOCAL DEFAULT 3
4: 0000000000400178 0 SECTION LOCAL DEFAULT 4
5: 0000000000400188 0 SECTION LOCAL DEFAULT 5
6: 00000000006001c8 0 SECTION LOCAL DEFAULT 6
7: 00000000006001c8 0 OBJECT LOCAL DEFAULT 6 _DYNAMIC
8: 0000000000000000 0 OBJECT LOCAL DEFAULT 6 _GLOBAL_OFFSET_TABLE_
9: 0000000000600298 0 NOTYPE GLOBAL DEFAULT ABS _edata
10: 0000000000600298 0 NOTYPE GLOBAL DEFAULT ABS _end
11: 0000000000000000 0 NOTYPE GLOBAL DEFAULT UND _start
12: 0000000000600298 0 NOTYPE GLOBAL DEFAULT ABS __bss_start
Histogram for bucket list length (total of 1 buckets):
Length Number % of total Coverage
0 1 (100.0%)
No version information found in this file.
More From » files
