Benign Download

pam_authtok_store.so.1

ELF header tampering (overlap / count mismatch / multi-interp / dup names)PAM auth-item fetch (e.g. password)
SHA-2567dbb94cdf6507c83a6f7b23428eeed599eac90669ee3d588401529535f72a31c
MaleculeO(As)Md₂(BiHe)

Evidence

ELF header tampering (overlap / count mismatch / multi-interp / dup names) 0x0–0x60
0x07f454c46010101060100000000000000.ELF............
0x1003000300010000000000000034000000............4...
0x20cc350000000000003400200004002800.5......4. ...(.
0x3020001e00010000000000000000000000 ...............
⋯3 more rows
PAM auth-item fetch (e.g. password) 0x77f–0x7bf
0x77f5f6564617461005f6574657874005f5f_edata._etext.__
0x78f6378615f66696e616c697a650063616ccxa_finalize.cal
0x79f6c6f630070616d5f6765745f6974656dloc.pam_get_item
0x7af005f5f70616d5f646973706c61795f6d.__pam_display_m
0x7bf73670070616d5f736d5f636861757468sg.pam_sm_chauth
libpam.so library string 0x89d–0x8cd
0x89d53554e57707269766174655f312e3100SUNWprivate_1.1.
0x8ad6c696270616d2e736f2e31006c696263libpam.so.1.libc
0x8bd2e736f2e3100494c4c554d4f535f302e.so.1.ILLUMOS_0.
0x8cd333700494c4c554d4f 37.ILLUMO

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.