2

Currently, there are lots of pcap files of malware analysis carried by other researchers available on Internet. Such files show the traffic pattern and communication of the malware with it's C&C servers or any malicious locations that are recorded in the pcap File.

The question is, what actually happens when I open a malware pcap file in Wireshark. Does it affect my PC? Do our PCs get infected when we run someone else's pcap Malware traffic File.

The WireShark websites have a section for malware pcap sample, so if I download and open any of those pcap files in my PC's Wireshark, would there be any possibility that my PC gets infected?

3

Wireshark is a complex beast and often bugs in the various protocol specific dissectors can be found which also might lead to remote code execution, see Dissecting Wireshark: I Know What You Captured Last Summer.

But while this might cause code execution when using a pcap from an untrusted source or with malformed protocol data in it, a well formed pcap with sane protocols which only captures transfer of malware binaries is not affected by this and will not lead to the execution of the malware which was captured in the pcap. But of course you can still extract the data from the pcap and thus inadvertently load the malware on your computer and maybe execute it too.

2
  • Great, so could the RCE Possible if i analyze a pcap file using sudo tcpdump -ttttnnr virus.pcap and Moreover are there any good Security measures/Advise you would like to give to Avoid RCE by PCAP Files. Apr 27 '16 at 18:07
  • @GerorgeTimber: yes, RCE is possible. And the usual advice when dealing with any kind of untrusted content is to work inside restricted environments like sandbox, VM or similar. Apr 27 '16 at 18:09
0

The malware content of the files themselves do not get executed, if that's what you are asking, so you will not be affected by the analysis of the malware traffic.

Although, as @steffenullrich points out, it is possible to craft a malicious pcap file that is designed to exploit vulnerabilities in Wireshark or its plugins.

2
  • That was what i was thinking too, I thought that the Content of a PCAP File for examples the Requests to C&C domains, Drop Down of Malware by GET Requests, would happen or not when i run the pcap file. I thought the pcap would just represent the Traffic stream and Won't interact with any domains But i doubted so i asked. So does this kind of Analysis doesn't pose a risk right? Apr 27 '16 at 18:15
  • assuming the pcap file doesn't target vulnerabilities in Wireshark, you are at no risk
    – schroeder
    Apr 27 '16 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.