Suspicious 85% Download

libform.so.1

ELF header tampering detected

ELF header tampering (overlap / count mismatch / multi-interp / dup names)
SHA-25659b911578052de34d9f3e1674dc405fc838b9238bb0f652d56c879cb86e9ca78
MaleculeO(As)Md₂(BiHe)

Evidence

ELF header tampering (overlap / count mismatch / multi-interp / dup names) 0x0–0x40
0x07f454c46010101060100000000000000.ELF............
0x1003000300010000000000000034000000............4...
0x20f8070100000000003400200004002800........4. ...(.
0x3021001f00010000000000000000000000!...............
0x4000000000c7ba00 .......
Write files (write) 0x2b53–0x2b83
0x2b53696e65005f7363725f62687061676500ine._scr_bhpage.
0x2b637772697465006c696e6b5f6669656c64write.link_field
0x2b73007365745f6669656c645f696e697400.set_field_init.
0x2b836d656d6370 memcp
C++ ABI symbols cluster A 0x2dde–0x2e0e
0x2dde7465005f707265765f63686172005f5fte._prev_char.__
0x2dee6378615f66696e616c697a6500666965cxa_finalize.fie
0x2dfe6c645f6f7074735f6f6e005f7363725fld_opts_on._scr_
0x2e0e666c696e650069735f6c696e fline.is_lin

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.