Suspicious 85% Download

libffi.so.7.1.0

ELF header tampering detected

ELF header tampering (overlap / count mismatch / multi-interp / dup names)Delete files
SHA-25645c224d39c388d0fb3eafb011582eed779338a7397857dc6884f9d9764096230
MaleculeO(As)Md₂(BiHe)

Evidence

ELF header tampering (overlap / count mismatch / multi-interp / dup names) 0x0–0x40
0x07f454c46020101060100000000000000.ELF............
0x1003003e00010000000000000000000000..>.............
0x204000000000000000e8a3000000000000@...............
0x300000000040003800040040001b001a00[email protected]...@.....
0x4001000000050000 .......
Delete files 0x210e–0x213e
0x210e66695f707265705f6369665f76617200fi_prep_cif_var.
0x211e756e6c696e6b006666695f6a6176615funlink.ffi_java_
0x212e7261775f73697a65005f50524f434544raw_size._PROCED
0x213e5552455f4c49 URE_LI
getenv function (read environment variable) 0x230f–0x234f
0x230f695f747970655f75696e743332005f5fi_type_uint32.__
0x231f737461636b5f63686b5f6661696c0067stack_chk_fail.g
0x232f6574656e76006666695f747970655f66etenv.ffi_type_f
0x233f6c6f617400707468726561645f6d7574loat.pthread_mut
0x234f65785f696e ex_in
Write files (write) 0x2422–0x2452
0x24226666695f747970655f73696e74333200ffi_type_sint32.
0x24327772697465006d6b6f7374656d700066write.mkostemp.f
0x244266695f63616c6c006666695f636c6f73fi_call.ffi_clos
0x24527572655f61 ure_a
TMPDIR environment variable 0x8611–0x8651
0x86118d15f9ffffffff25030000000f1f0000.......%........
0x86212f6465762f73686d00544d5044495200/dev/shm.TMPDIR.
0x8631484f4d45002f7661722f746d70000020HOME./var/tmp..
0x864101000000000000000000000000000000................
0x8651000000000000007e2e00000000 .......~.....

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.