Benign Download

Shellcode

Contains Arabic or Urdu scriptContains Hiragana or Katakana script
SHA-256573be9ee24c8c8484216732e1fa0645a4a70888d10422a54491b0d172fbcdf59
MaleculeO(As₂)Md

Evidence

Calls a string replacement method lines 1–12
1<!DOCTYPE html>
2<html class="client-nojs vector-feature-language-in-header-enabled vector-feature-language-in-main-menu-disabled vector-feature-language-in-main-page-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 skin-theme-clientpref-day vector-feature-navigation-update-disabled vector-sticky-header-enabled vector-toc-available skin-thumbsize-clientpref-standard" lang="es" dir="ltr">
3<head>
4<meta charset="UTF-8">
5<title>Shellcode - Wikipedia, la enciclopedia libre</title>
6<script>(function(){var className="client-js vector-feature-language-in-header-enabled vector-feature-language-in-main-menu-disabled vector-feature-language-in-main-page-header-disabled vector-feature-page-tools-pinned-disabled vector-feature-toc-pinned-clientpref-1 vector-feature-main-menu-pinned-disabled vector-feature-limited-width-clientpref-1 vector-feature-limited-width-content-enabled vector-feature-custom-font-size-clientpref-1 vector-feature-appearance-pinned-clientpref-1 skin-theme-clientpref-day vector-feature-navigation-update-disabled vector-sticky-header-enabled vector-toc-available skin-thumbsize-clientpref-standard";var cookie=document.cookie.match(/(?:^|; )eswikimwclientpreferences=([^;]+)/);if(cookie){cookie[1].split('%2C').forEach(function(pref){className=className.replace(new RegExp('(^| )'+pref.replace(/-clientpref-\w+$|[^\w-]+/g,'')+'-clientpref-\\w+( |$)'),'$1'+pref+'$2');});}document.documentElement.className=className;}());RLCONF={"wgBreakFrames":false,"wgSeparatorTransformTable":[",\
7RLSTATE={"ext.gadget.imagenesinfobox":"ready","ext.globalCssJs.user.styles":"ready","site.styles":"ready","user.styles":"ready","ext.globalCssJs.user":"ready","user":"ready","user.options":"loading","mediawiki.skinning.content.parsoid":"ready","ext.wikimediamessages.styles":"ready","skins.vector.search.codex.styles":"ready","skins.vector.styles":"ready","skins.vector.icons":"ready","ext.visualEditor.desktopArticleTarget.noscript":"ready","ext.uls.interlanguage":"ready","wikibase.client.init":"ready"};RLPAGEMODULES=["mediawiki.page.media","site","mediawiki.page.ready","mediawiki.toc","skins.vector.js","ext.centralNotice.geoIP","ext.centralNotice.startUp","ext.gadget.a-commons-directo","ext.gadget.ReferenceTooltips","ext.gadget.refToolbar","ext.gadget.switcher","ext.urlShortener.toolbar","ext.centralauth.centralautologin","ext.testKitchen","mmv.bootstrap","ext.popups","ext.visualEditor.desktopArticleTarget.init","ext.echo.centralauth","ext.eventLogging","ext.wikimediaEvents","ext.navigationTiming","ext.uls.inte
8<script>(RLQ=window.RLQ||[]).push(function(){mw.loader.impl(function(){return["user.options@12s5i",function($,jQuery,require,module){mw.user.tokens.set({"patrolToken":"+\\","watchToken":"+\\","csrfToken":"+\\"});
9}];});});</script>
10<link rel="stylesheet" href="/w/load.php?lang=es&amp;modules=ext.uls.interlanguage%7Cext.visualEditor.desktopArticleTarget.noscript%7Cext.wikimediamessages.styles%7Cmediawiki.skinning.content.parsoid%7Cskins.vector.icons%2Cstyles%7Cskins.vector.search.codex.styles%7Cwikibase.client.init&amp;only=styles&amp;skin=vector-2022">
11<script async="" src="/w/load.php?lang=es&amp;modules=startup&amp;only=scripts&amp;raw=1&amp;skin=vector-2022"></script>
12<meta name="ResourceLoaderDynamicStyles" content="">
Contains an HTTPS URL prefix lines 19–23
19<meta name="robots" content="max-image-preview:standard">
20<meta name="format-detection" content="telephone=no">
21<meta property="og:image" content="https://upload.wikimedia.org/wikipedia/commons/7/7a/PVDasm.jpg">
22<meta property="og:image:width" content="1200">
23<meta property="og:image:height" content="865">
Common UI language-code pair lines 77–81
77 <ul class="vector-menu-content-list">
78
79 <li id="n-mainpage-description" class="mw-list-item"><a href="/wiki/Wikipedia:Portada" title="Visitar la página principal [z]" accesskey="z"><span>Portada</span></a></li><li id="n-portal" class="mw-list-item"><a href="/wiki/Portal:Comunidad" title="Acerca del proyecto, lo que puedes hacer, dónde encontrar información"><span>Portal de la comunidad</span></a></li><li id="n-currentevents" class="mw-list-item"><a href="/wiki/Portal:Actualidad" title="Encuentra información de contexto sobre acontecimientos actuales"><span>Actualidad</span></a></li><li id="n-recentchanges" class="mw-list-item"><a href="/wiki/Especial:CambiosRecientes" title="Lista de cambios recientes en la wiki [r]" accesskey="r"><span>Cambios recientes</span></a></li><li id="n-newpages" class="mw-list-item"><a href="/wiki/Especial:P%C3%A1ginasNuevas"><span>Páginas nuevas</span></a></li><li id="n-randompage" class="mw-list-item"><a href="/wiki/Especial:Aleatoria" title="Cargar una página al azar [x]" accesskey="x"><span>Página aleatoria<
80 </ul>
81
Contains Arabic or Urdu script lines 405–410
405 <ul class="vector-menu-content-list">
406
407 <li class="interlanguage-link interwiki-ar mw-list-item"><a href="https://ar.wikipedia.org/wiki/%D9%86%D8%B5_%D9%88%D8%A7%D8%AC%D9%87%D8%A9_%D8%A7%D9%84%D8%A3%D9%88%D8%A7%D9%85%D8%B1_%D8%A7%D9%84%D8%A8%D8%B1%D9%85%D8%AC%D9%8A" title="نص واجهة الأوامر البرمجي – árabe" lang="ar" hreflang="ar" data-title="نص واجهة الأوامر البرمجي" data-language-autonym="العربية" data-language-local-name="árabe" class="interlanguage-link-target"><span>العربية</span></a></li><li class="interlanguage-link interwiki-az mw-list-item"><a href="https://az.wikipedia.org/wiki/Shellcode" title="Shellcode – azerbaiyano" lang="az" hreflang="az" data-title="Shellcode" data-language-autonym="Azərbaycanca" data-language-local-name="azerbaiyano" class="interlanguage-link-target"><span>Azərbaycanca</span></a></li><li class="interlanguage-link interwiki-de mw-list-item"><a href="https://de.wikipedia.org/wiki/Shellcode" title="Shellcode – alemán" lang="de" hreflang="de" data-ti
408 </ul>
409 <div class="after-portlet after-portlet-lang"><span class="wb-langlinks-edit wb-langlinks-link"><a href="https://www.wikidata.org/wiki/Special:EntityPage/Q1152477#sitelinks-wikipedia" title="Editar enlaces interlingüísticos" class="wbc-editpage">Editar enlaces</a></span></div>
410 </div>
Interspersed hex escape sequences lines 692–694
692<pre typeof="mw:Extension/pre" about="#mwt2" id="mwSw" data-mw='{"name":"pre","attrs":{},"body":{"extsrc":"// shellcode.c \n// compilar con gcc shellcode.c -o shellcode\nvoid main()\n{\n((void(*)(void))\n{\n\"\\xeb\\x19\\x31\\xc0\\x31\\xdb\\x31\\xd2\\x31\\xc9\"\n\"\\xb0\\x04\\xb3\\x01\\x59\\xb2\\x21\\xcd\\x80\\x31\"\n\"\\xc0\\xb0\\x01\\x31\\xdb\\xcd\\x80\\xe8\\xe2\\xff\"\n\"\\xff\\xff\\x76\\x69\\x73\\x69\\x74\\x61\\x20\\x68\"\n\"\\x74\\x74\\x70\\x3a\\x2f\\x2f\\x68\\x65\\x69\\x6e\"\n\"\\x7a\\x2e\\x68\\x65\\x72\\x6c\\x69\\x74\\x7a\\x2e\"\n\"\\x63\\x6c\\x20\\x3d\\x29\"\n}\n)();\n}"}}'>// shellcode.c
693// compilar con gcc shellcode.c -o shellcode
694void main()

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.