Edit tour

Linux Analysis Report
talkspirit-latest-linux-x86_64.AppImage

Overview

General Information

Sample name:	talkspirit-latest-linux-x86_64.AppImage
Analysis ID:	1522645
MD5:	fb5201c0dbaf425bbc9d231fa5abb0cb
SHA1:	35b6e08ff372148e31e3ca76ba0e91dd60cd9aee
SHA256:	1cebd47d7c4607b0e308388eb8b34c63fe46c6e9fef0df4fbcf12becb095a2cb
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false

Signatures

Creates hidden files and/or directories

Executes the "rm" command used to delete files or directories

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522645
Start date and time:	2024-09-30 14:18:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	talkspirit-latest-linux-x86_64.AppImage
Detection:	CLEAN
Classification:	clean2.linAPPIMAGE@0/0@0/0

Runtime Messages

Command:	/tmp/talkspirit-latest-linux-x86_64.AppImage
PID:	6245
Exit Code:	133
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	[0930/071915.290466:FATAL:electron_main_delegate.cc(300)] Running as root without --no-sandbox is not supported. See https://crbug.com/638180.

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6218, Parent: 4331)

rm (PID: 6218, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.HGPF9mFmbj /tmp/tmp.fIaRJARqy2 /tmp/tmp.InqUFpWLDG

dash New Fork (PID: 6219, Parent: 4331)

rm (PID: 6219, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.HGPF9mFmbj /tmp/tmp.fIaRJARqy2 /tmp/tmp.InqUFpWLDG

talkspirit-latest-linux-x86_64.AppImage (PID: 6245, Parent: 6147, MD5: 00000000000000000000000000000000) Arguments: /tmp/talkspirit-latest-linux-x86_64.AppImage

talkspirit-latest-linux-x86_64.AppImage New Fork (PID: 6246, Parent: 6245)

talkspirit-latest-linux-x86_64.AppImage New Fork (PID: 6250, Parent: 6246)

AppRun (PID: 6245, Parent: 6147, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /tmp/talkspirit-latest-linux-x86_64.AppImage

talkspirit-desktop (PID: 6245, Parent: 6147, MD5: 00000000000000000000000000000000) Arguments: /tmp/.mount_talkspz1hseq/talkspirit-desktop

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: talkspirit-latest-linux-x86_64.AppImage	String found in binary or memory: http://appimage.org/
Source: talkspirit-latest-linux-x86_64.AppImage	String found in binary or memory: http://appimage.org/.shstrtab.interp.note.ABI-tag.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.
Source: talkspirit-desktop, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp	String found in binary or memory: https://crbug.com/638180.
Source: talkspirit-latest-linux-x86_64.AppImage	String found in binary or memory: https://github.com/AppImage/AppImageKit/wiki/FUSE
Source: talkspirit-latest-linux-x86_64.AppImage, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, AppRun, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, talkspirit-desktop, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0-headers.tar.gz
Source: talkspirit-latest-linux-x86_64.AppImage, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, AppRun, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, talkspirit-desktop, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gz
Source: talkspirit-latest-linux-x86_64.AppImage, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, AppRun, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, talkspirit-desktop, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp	String found in binary or memory: https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gzhttps://nodejs.org/download/release

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: clean2.linAPPIMAGE@0/0@0/0

Source: /tmp/talkspirit-latest-linux-x86_64.AppImage (PID: 6245)	Directory: /tmp/.mount_talkspz1hseq	Jump to behavior
Source: /tmp/talkspirit-latest-linux-x86_64.AppImage (PID: 6245)	Directory: /tmp/.mount_talkspz1hseq	Jump to behavior
Source: /tmp/talkspirit-latest-linux-x86_64.AppImage (PID: 6246)	Directory: /tmp/.mount_talkspz1hseq	Jump to behavior

Source: /usr/bin/dash (PID: 6218)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.HGPF9mFmbj /tmp/tmp.fIaRJARqy2 /tmp/tmp.InqUFpWLDG			Jump to behavior
Source: /usr/bin/dash (PID: 6219)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.HGPF9mFmbj /tmp/tmp.fIaRJARqy2 /tmp/tmp.InqUFpWLDG			Jump to behavior

Source: /tmp/.mount_talkspz1hseq/AppRun (PID: 6245)

Queries kernel information via 'uname':

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Hidden Files and Directories	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://nodejs.org/download/release/v18.14.0/node-v18.14.0-headers.tar.gz	talkspirit-latest-linux-x86_64.AppImage, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, AppRun, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, talkspirit-desktop, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp	false	unknown
https://crbug.com/638180.	talkspirit-desktop, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp	false	unknown
https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gz	talkspirit-latest-linux-x86_64.AppImage, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, AppRun, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, talkspirit-desktop, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp	false	unknown
http://appimage.org/	talkspirit-latest-linux-x86_64.AppImage	false	unknown
http://appimage.org/.shstrtab.interp.note.ABI-tag.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.	talkspirit-latest-linux-x86_64.AppImage	false	unknown
https://github.com/AppImage/AppImageKit/wiki/FUSE	talkspirit-latest-linux-x86_64.AppImage	false	unknown
https://nodejs.org/download/release/v18.14.0/node-v18.14.0.tar.gzhttps://nodejs.org/download/release	talkspirit-latest-linux-x86_64.AppImage, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, AppRun, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp, talkspirit-desktop, 6245.1.00002c4800220000.00002c4800296000.rw-.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	cron.elf	Get hash	malicious	Unknown	Browse
	84.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	cron.elf	Get hash	malicious	Unknown	Browse
	84.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	cayo.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	cron.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	84.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.5706.5318.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	cayo.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.125.190.26
	cron.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	84.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.5706.5318.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	cron.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	84.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.9999.13181.28360.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.9999.30150.23014.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SecuriteInfo.com.ELF.Mirai-BNB.32065.25073.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.Linux.Siggen.9999.14958.943.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.ELF.Ligolo-K.6475.26287.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.ELF.ShellCode-FH.25156.23898.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.18, stripped
Entropy (8bit):	7.997860197220224
TrID:	ELF Executable and Linkable format (generic) (4004/1) 98.45% Lumena CEL bitmap (63/63) 1.55%
File name:	talkspirit-latest-linux-x86_64.AppImage
File size:	99'580'430 bytes
MD5:	fb5201c0dbaf425bbc9d231fa5abb0cb
SHA1:	35b6e08ff372148e31e3ca76ba0e91dd60cd9aee
SHA256:	1cebd47d7c4607b0e308388eb8b34c63fe46c6e9fef0df4fbcf12becb095a2cb
SHA512:	eb2b45ae778cc8f91a28313ece0090f78e60e137db4f9b979c433b1bef10760735ead4724b449859f84b652cfef835608d6763128a1e04c537b6212859076bbb
SSDEEP:	1572864:Q8ng8UwklO+MFJpuO8ZQNzZD8Toelz31kDRHWPuB1GBdYfkanJzvVhZ7isG5yRds:Ql8MQtFvuR6hZDS1kRHWPujWlIzvVhO9
TLSH:	D628332AB1138D8AC1331239F6EEC697A6F0507122736D41B78B02977FBA5CF41D658E
File Content Preview:	.ELF....AI........>......F@.....@...................@.8...@. ...........@.......@.@.....@.@...............................................@.......@...............................................@.......@....................... .......................b....

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	65
Entry Point Address:	0x404690
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	8
Section Header Offset:	186344
Section Header Size:	64
Number of Section Headers:	32
Header String Table Index:	31

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.interp	PROGBITS	0x400200	0x200	0x1c	0x0	0x2	A	0	0	1
.note.ABI-tag	NOTE	0x40021c	0x21c	0x20	0x0	0x2	A	0	0	4
.hash	HASH	0x400240	0x240	0x8ac	0x4	0x2	A	4	0	8
.dynsym	DYNSYM	0x400af0	0xaf0	0x1b30	0x18	0x2	A	5	1	8
.dynstr	STRTAB	0x402620	0x2620	0x1075	0x0	0x2	A	0	0	1
.gnu.version	VERSYM	0x403696	0x3696	0x244	0x2	0x2	A	4	0	2
.gnu.version_r	VERNEED	0x4038e0	0x38e0	0x80	0x0	0x2	A	5	3	8
.rela.dyn	RELA	0x403960	0x3960	0xd8	0x18	0x2	A	4	0	8
.rela.plt	RELA	0x403a38	0x3a38	0x750	0x18	0x2	A	4	11	8
.init	PROGBITS	0x404188	0x4188	0x18	0x0	0x6	AX	0	0	4
.plt	PROGBITS	0x4041a0	0x41a0	0x4f0	0x10	0x6	AX	0	0	4
.text	PROGBITS	0x404690	0x4690	0x1c858	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x420ee8	0x20ee8	0xe	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x420f00	0x20f00	0x5b10	0x0	0x2	A	0	0	32
.eh_frame_hdr	PROGBITS	0x426a10	0x26a10	0xbc4	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x4275d8	0x275d8	0x31ac	0x0	0x2	A	0	0	8
.ctors	PROGBITS	0x62a788	0x2a788	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x62a798	0x2a798	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x62a7a8	0x2a7a8	0x8	0x0	0x3	WA	0	0	8
.data.rel.ro	PROGBITS	0x62a7c0	0x2a7c0	0x1a0	0x0	0x3	WA	0	0	32
.dynamic	DYNAMIC	0x62a960	0x2a960	0x1c0	0x10	0x3	WA	5	0	8
.got	PROGBITS	0x62ab20	0x2ab20	0x58	0x8	0x3	WA	0	0	8
.got.plt	PROGBITS	0x62ab78	0x2ab78	0x288	0x8	0x3	WA	0	0	8
.data	PROGBITS	0x62ae00	0x2ae00	0x58	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x62ae60	0x2ae58	0x140	0x0	0x3	WA	0	0	32
.digest_md5	PROGBITS	0x0	0x2ae58	0x10	0x0	0x0		0	0	1
.upd_info	PROGBITS	0x0	0x2ae68	0x400	0x0	0x0		0	0	1
.sha256_sig	PROGBITS	0x0	0x2b268	0x400	0x0	0x0		0	0	1
.sig_key	PROGBITS	0x0	0x2b668	0x2000	0x0	0x0		0	0	1
.comment	PROGBITS	0x0	0x2d668	0x6c	0x1	0x30	MS	0	0	1
.shstrtab	STRTAB	0x0	0x2d6d4	0x10f	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
PHDR	0x40	0x400040	0x400040	0x1c0	0x1c0	1.8177	0x5	R E	0x8
INTERP	0x200	0x400200	0x400200	0x1c	0x1c	3.9408	0x4	R	0x1	/lib64/ld-linux-x86-64.so.2	.interp
LOAD	0x0	0x400000	0x400000	0x2a784	0x2a784	6.2663	0x5	R E	0x200000		.interp .note.ABI-tag .hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame
LOAD	0x2a788	0x62a788	0x62a788	0x6d0	0x818	2.1295	0x6	RW	0x200000		.ctors .dtors .jcr .data.rel.ro .dynamic .got .got.plt .data .bss
DYNAMIC	0x2a960	0x62a960	0x62a960	0x1c0	0x1c0	1.4863	0x6	RW	0x8		.dynamic
NOTE	0x21c	0x40021c	0x40021c	0x20	0x20	1.7487	0x4	R	0x4		.note.ABI-tag
GNU_EH_FRAME	0x26a10	0x426a10	0x426a10	0xbc4	0xbc4	5.4429	0x4	R	0x4		.eh_frame_hdr
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Dynamic Tags

Type	Meta	Value	Tag
DT_NEEDED	sharedlib	libdl.so.2	0x1
DT_NEEDED	sharedlib	libpthread.so.0	0x1
DT_NEEDED	sharedlib	libz.so.1	0x1
DT_NEEDED	sharedlib	libc.so.6	0x1
DT_INIT	value	0x404188	0xc
DT_FINI	value	0x420ee8	0xd
DT_HASH	value	0x400240	0x4
DT_STRTAB	value	0x402620	0x5
DT_SYMTAB	value	0x400af0	0x6
DT_STRSZ	bytes	4213	0xa
DT_SYMENT	bytes	24	0xb
DT_DEBUG	value	0x0	0x15
DT_PLTGOT	value	0x62ab78	0x3
DT_PLTRELSZ	bytes	1872	0x2
DT_PLTREL	pltrel	DT_RELA	0x14
DT_JMPREL	value	0x403a38	0x17
DT_RELA	value	0x403960	0x7
DT_RELASZ	bytes	216	0x8
DT_RELAENT	bytes	24	0x9
DT_VERNEED	value	0x4038e0	0x6ffffffe
DT_VERNEEDNUM	value	3	0x6fffffff
DT_VERSYM	value	0x403696	0x6ffffff0
DT_NULL	value	0x0	0x0

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
Md5Calculate			.dynsym	0x407350	69	FUNC	<unknown>	DEFAULT	12
Md5Finalise			.dynsym	0x407180	462	FUNC	<unknown>	DEFAULT	12
Md5Initialise			.dynsym	0x406eb0	42	FUNC	<unknown>	DEFAULT	12
Md5Update			.dynsym	0x406ee0	666	FUNC	<unknown>	DEFAULT	12
_IO_stdin_used			.dynsym	0x420f00	4	OBJECT	<unknown>	DEFAULT	14
_ITM_deregisterTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_registerTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_Jv_RegisterClasses			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__bss_start			.dynsym	0x62ae58	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__data_start			.dynsym	0x62ae00	0	NOTYPE	<unknown>	DEFAULT	24
__errno_location	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__gmon_start__			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__libc_csu_fini			.dynsym	0x420e00	2	FUNC	<unknown>	DEFAULT	12
__libc_csu_init			.dynsym	0x420e10	137	FUNC	<unknown>	DEFAULT	12
__libc_start_main	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__xstat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_edata			.dynsym	0x62ae58	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end			.dynsym	0x62afa0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_fini			.dynsym	0x420ee8	0	FUNC	<unknown>	DEFAULT	13
_init			.dynsym	0x404188	0	FUNC	<unknown>	DEFAULT	10
_start			.dynsym	0x404690	0	FUNC	<unknown>	DEFAULT	12
access	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
appimage_get_elf_section_offset_and_length			.dynsym	0x406380	403	FUNC	<unknown>	DEFAULT	12
appimage_get_elf_size			.dynsym	0x405fe0	917	FUNC	<unknown>	DEFAULT	12
appimage_hexlify			.dynsym	0x406640	102	FUNC	<unknown>	DEFAULT	12
appimage_print_binary			.dynsym	0x406610	39	FUNC	<unknown>	DEFAULT	12
appimage_print_hex			.dynsym	0x406590	122	FUNC	<unknown>	DEFAULT	12
basename	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
build_mount_point			.dynsym	0x4053ea	155	FUNC	<unknown>	DEFAULT	12
calloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chmod	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
close	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
data_start			.dynsym	0x62ae00	0	NOTYPE	<unknown>	DEFAULT	24
dlclose	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlerror	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlopen	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlsym	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dup2	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
execv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
exit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
extract_appimage			.dynsym	0x404e1c	1461	FUNC	<unknown>	DEFAULT	12
fclose	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fflush	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fileno	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fnmatch	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fopen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fork	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fputc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fputs	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fread	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fseek	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fseeko	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fuse_mounted			.dynsym	0x4049e4	42	FUNC	<unknown>	DEFAULT	12
fusefs_main			.dynsym	0x40dfcc	2084	FUNC	<unknown>	DEFAULT	12
fwrite	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getArg			.dynsym	0x404ce6	42	FUNC	<unknown>	DEFAULT	12
getcwd	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gnu_dev_makedev	GLIBC_2.3.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
have_libloaded			.dynsym	0x62aee0	4	OBJECT	<unknown>	DEFAULT	25
is_writable_directory			.dynsym	0x404bba	18	FUNC	<unknown>	DEFAULT	12
isatty	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
kill	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
libhandle			.dynsym	0x62af90	8	OBJECT	<unknown>	DEFAULT	25
link	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
load_library_errmsg			.dynsym	0x62ae50	8	OBJECT	<unknown>	DEFAULT	24
lseek	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
lzma_block_compressed_size			.dynsym	0x4144d2	159	FUNC	<unknown>	DEFAULT	12
lzma_block_decoder			.dynsym	0x414dfc	133	FUNC	<unknown>	DEFAULT	12
lzma_block_header_decode			.dynsym	0x414f1e	701	FUNC	<unknown>	DEFAULT	12
lzma_block_total_size			.dynsym	0x414658	57	FUNC	<unknown>	DEFAULT	12
lzma_block_unpadded_size			.dynsym	0x414571	231	FUNC	<unknown>	DEFAULT	12
lzma_check_is_supported			.dynsym	0x410b6c	36	FUNC	<unknown>	DEFAULT	12
lzma_check_size			.dynsym	0x410b90	39	FUNC	<unknown>	DEFAULT	12
lzma_code			.dynsym	0x413db9	1185	FUNC	<unknown>	DEFAULT	12
lzma_crc32			.dynsym	0x410cf4	480	FUNC	<unknown>	DEFAULT	12
lzma_crc64			.dynsym	0x410ed4	387	FUNC	<unknown>	DEFAULT	12
lzma_end			.dynsym	0x41425a	102	FUNC	<unknown>	DEFAULT	12
lzma_filter_decoder_is_supported			.dynsym	0x415234	32	FUNC	<unknown>	DEFAULT	12
lzma_filter_flags_decode			.dynsym	0x4153b8	267	FUNC	<unknown>	DEFAULT	12
lzma_filters_copy			.dynsym	0x41f6a8	678	FUNC	<unknown>	DEFAULT	12
lzma_get_check			.dynsym	0x41432c	66	FUNC	<unknown>	DEFAULT	12
lzma_get_progress			.dynsym	0x4142c0	108	FUNC	<unknown>	DEFAULT	12
lzma_index_hash_append			.dynsym	0x4157ad	238	FUNC	<unknown>	DEFAULT	12
lzma_index_hash_decode			.dynsym	0x41589b	1373	FUNC	<unknown>	DEFAULT	12
lzma_index_hash_end			.dynsym	0x41568c	38	FUNC	<unknown>	DEFAULT	12
lzma_index_hash_init			.dynsym	0x41556c	288	FUNC	<unknown>	DEFAULT	12
lzma_index_hash_size			.dynsym	0x4156b2	41	FUNC	<unknown>	DEFAULT	12
lzma_memlimit_get			.dynsym	0x4143d6	104	FUNC	<unknown>	DEFAULT	12
lzma_memlimit_set			.dynsym	0x41443e	123	FUNC	<unknown>	DEFAULT	12
lzma_memusage			.dynsym	0x41436e	104	FUNC	<unknown>	DEFAULT	12
lzma_properties_decode			.dynsym	0x415331	135	FUNC	<unknown>	DEFAULT	12
lzma_raw_decoder			.dynsym	0x41528b	133	FUNC	<unknown>	DEFAULT	12
lzma_raw_decoder_memusage			.dynsym	0x415310	33	FUNC	<unknown>	DEFAULT	12
lzma_stream_buffer_decode			.dynsym	0x40fcc4	469	FUNC	<unknown>	DEFAULT	12
lzma_stream_decoder			.dynsym	0x4108f5	136	FUNC	<unknown>	DEFAULT	12
lzma_stream_flags_compare			.dynsym	0x4146e2	213	FUNC	<unknown>	DEFAULT	12
lzma_stream_footer_decode			.dynsym	0x410a9a	209	FUNC	<unknown>	DEFAULT	12
lzma_stream_header_decode			.dynsym	0x4109f6	164	FUNC	<unknown>	DEFAULT	12
lzma_version_number			.dynsym	0x413948	11	FUNC	<unknown>	DEFAULT	12
lzma_version_string			.dynsym	0x413953	13	FUNC	<unknown>	DEFAULT	12
lzma_vli_decode			.dynsym	0x415df8	404	FUNC	<unknown>	DEFAULT	12
lzma_vli_size			.dynsym	0x41fec8	52	FUNC	<unknown>	DEFAULT	12
main			.dynsym	0x405485	2871	FUNC	<unknown>	DEFAULT	12
malloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memmove	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mkdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mkdir_p			.dynsym	0x404d10	174	FUNC	<unknown>	DEFAULT	12
mkdtemp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mmap	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
munmap	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
nftw	GLIBC_2.3.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
notify			.dynsym	0x404800	482	FUNC	<unknown>	DEFAULT	12
open	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pause	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
perror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pipe	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
portable_option			.dynsym	0x404dd4	72	FUNC	<unknown>	DEFAULT	12
pread	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
print_help			.dynsym	0x404dbe	22	FUNC	<unknown>	DEFAULT	12
printf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
private_sqfs_stat			.dynsym	0x404c13	211	FUNC	<unknown>	DEFAULT	12
pthread_create	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
putchar	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
puts	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
read	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
read_file_offset_length			.dynsym	0x406520	100	FUNC	<unknown>	DEFAULT	12
readlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realpath	GLIBC_2.3	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
remove	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rm_recursive			.dynsym	0x4053d1	25	FUNC	<unknown>	DEFAULT	12
rm_recursive_callback			.dynsym	0x404a51	171	FUNC	<unknown>	DEFAULT	12
rmdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setenv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sqfs_block_cache_init			.dynsym	0x40b5ba	46	FUNC	<unknown>	DEFAULT	12
sqfs_block_dispose			.dynsym	0x4086a7	43	FUNC	<unknown>	DEFAULT	12
sqfs_block_read			.dynsym	0x40827a	385	FUNC	<unknown>	DEFAULT	12
sqfs_blockidx_add			.dynsym	0x407a8f	474	FUNC	<unknown>	DEFAULT	12
sqfs_blockidx_blocklist			.dynsym	0x407c69	474	FUNC	<unknown>	DEFAULT	12
sqfs_blockidx_init			.dynsym	0x407a64	43	FUNC	<unknown>	DEFAULT	12
sqfs_blocklist_count			.dynsym	0x4074d1	89	FUNC	<unknown>	DEFAULT	12
sqfs_blocklist_init			.dynsym	0x40752a	135	FUNC	<unknown>	DEFAULT	12
sqfs_blocklist_next			.dynsym	0x4075b1	246	FUNC	<unknown>	DEFAULT	12
sqfs_cache_add			.dynsym	0x40b4de	182	FUNC	<unknown>	DEFAULT	12
sqfs_cache_destroy			.dynsym	0x40b3d6	164	FUNC	<unknown>	DEFAULT	12
sqfs_cache_get			.dynsym	0x40b47a	100	FUNC	<unknown>	DEFAULT	12
sqfs_cache_init			.dynsym	0x40b2fc	180	FUNC	<unknown>	DEFAULT	12
sqfs_compression			.dynsym	0x407eba	21	FUNC	<unknown>	DEFAULT	12
sqfs_compression_name			.dynsym	0x409249	52	FUNC	<unknown>	DEFAULT	12
sqfs_compression_supported			.dynsym	0x40927d	111	FUNC	<unknown>	DEFAULT	12
sqfs_data_block_read			.dynsym	0x4084ee	89	FUNC	<unknown>	DEFAULT	12
sqfs_data_cache			.dynsym	0x408616	145	FUNC	<unknown>	DEFAULT	12
sqfs_data_header			.dynsym	0x408245	53	FUNC	<unknown>	DEFAULT	12
sqfs_decompressor_get			.dynsym	0x40921a	47	FUNC	<unknown>	DEFAULT	12
sqfs_dentry_init			.dynsym	0x40b8e3	27	FUNC	<unknown>	DEFAULT	12
sqfs_dentry_inode			.dynsym	0x40b954	17	FUNC	<unknown>	DEFAULT	12
sqfs_dentry_inode_num			.dynsym	0x40b965	17	FUNC	<unknown>	DEFAULT	12
sqfs_dentry_is_dir			.dynsym	0x40b9d2	39	FUNC	<unknown>	DEFAULT	12
sqfs_dentry_mode			.dynsym	0x40b933	33	FUNC	<unknown>	DEFAULT	12
sqfs_dentry_name			.dynsym	0x40b988	74	FUNC	<unknown>	DEFAULT	12
sqfs_dentry_name_size			.dynsym	0x40b976	18	FUNC	<unknown>	DEFAULT	12
sqfs_dentry_next_offset			.dynsym	0x40b910	18	FUNC	<unknown>	DEFAULT	12
sqfs_dentry_offset			.dynsym	0x40b8fe	18	FUNC	<unknown>	DEFAULT	12
sqfs_dentry_type			.dynsym	0x40b922	17	FUNC	<unknown>	DEFAULT	12
sqfs_destroy			.dynsym	0x40815f	153	FUNC	<unknown>	DEFAULT	12
sqfs_dir_lookup			.dynsym	0x40beaf	296	FUNC	<unknown>	DEFAULT	12
sqfs_dir_next			.dynsym	0x40b9f9	446	FUNC	<unknown>	DEFAULT	12
sqfs_dir_open			.dynsym	0x40b80f	212	FUNC	<unknown>	DEFAULT	12
sqfs_divceil			.dynsym	0x408824	61	FUNC	<unknown>	DEFAULT	12
sqfs_enoattr			.dynsym	0x40fcb8	11	FUNC	<unknown>	DEFAULT	12
sqfs_export_inode			.dynsym	0x4089a4	134	FUNC	<unknown>	DEFAULT	12
sqfs_export_ok			.dynsym	0x408988	28	FUNC	<unknown>	DEFAULT	12
sqfs_fd_close			.dynsym	0x40a4ea	24	FUNC	<unknown>	DEFAULT	12
sqfs_fd_open			.dynsym	0x40a48c	94	FUNC	<unknown>	DEFAULT	12
sqfs_frag_block			.dynsym	0x4073f1	224	FUNC	<unknown>	DEFAULT	12
sqfs_frag_entry			.dynsym	0x407398	89	FUNC	<unknown>	DEFAULT	12
sqfs_hash_add			.dynsym	0x40f611	92	FUNC	<unknown>	DEFAULT	12
sqfs_hash_destroy			.dynsym	0x40f527	126	FUNC	<unknown>	DEFAULT	12
sqfs_hash_get			.dynsym	0x40f5a5	108	FUNC	<unknown>	DEFAULT	12
sqfs_hash_init			.dynsym	0x40f48b	156	FUNC	<unknown>	DEFAULT	12
sqfs_hash_remove			.dynsym	0x40f66d	171	FUNC	<unknown>	DEFAULT	12
sqfs_id_get			.dynsym	0x408861	92	FUNC	<unknown>	DEFAULT	12
sqfs_init			.dynsym	0x407ecf	656	FUNC	<unknown>	DEFAULT	12
sqfs_inode_get			.dynsym	0x408a7b	1706	FUNC	<unknown>	DEFAULT	12
sqfs_inode_root			.dynsym	0x408a2a	18	FUNC	<unknown>	DEFAULT	12
sqfs_listxattr			.dynsym	0x40f8fd	304	FUNC	<unknown>	DEFAULT	12
sqfs_ll_daemonize			.dynsym	0x40f24c	140	FUNC	<unknown>	DEFAULT	12
sqfs_ll_destroy			.dynsym	0x40eecf	63	FUNC	<unknown>	DEFAULT	12
sqfs_ll_iget			.dynsym	0x40ef55	345	FUNC	<unknown>	DEFAULT	12
sqfs_ll_init			.dynsym	0x40ee60	111	FUNC	<unknown>	DEFAULT	12
sqfs_ll_inode			.dynsym	0x40ef0e	71	FUNC	<unknown>	DEFAULT	12
sqfs_ll_stat			.dynsym	0x40f0ae	413	FUNC	<unknown>	DEFAULT	12
sqfs_lookup_path			.dynsym	0x40bfd7	362	FUNC	<unknown>	DEFAULT	12
sqfs_makedev			.dynsym	0x40f718	31	FUNC	<unknown>	DEFAULT	12
sqfs_md_block_read			.dynsym	0x4083fb	243	FUNC	<unknown>	DEFAULT	12
sqfs_md_cache			.dynsym	0x408547	207	FUNC	<unknown>	DEFAULT	12
sqfs_md_cursor_inode			.dynsym	0x4086d2	62	FUNC	<unknown>	DEFAULT	12
sqfs_md_header			.dynsym	0x4081f8	77	FUNC	<unknown>	DEFAULT	12
sqfs_md_read			.dynsym	0x408710	276	FUNC	<unknown>	DEFAULT	12
sqfs_mode			.dynsym	0x40a804	105	FUNC	<unknown>	DEFAULT	12
sqfs_open_image			.dynsym	0x40a502	719	FUNC	<unknown>	DEFAULT	12
sqfs_opt_proc			.dynsym	0x40fbf3	197	FUNC	<unknown>	DEFAULT	12
sqfs_pread			.dynsym	0x40a7d4	47	FUNC	<unknown>	DEFAULT	12
sqfs_read_range			.dynsym	0x4076a7	863	FUNC	<unknown>	DEFAULT	12
sqfs_readlink			.dynsym	0x4088bd	203	FUNC	<unknown>	DEFAULT	12
sqfs_stack_at			.dynsym	0x40c3f4	74	FUNC	<unknown>	DEFAULT	12
sqfs_stack_create			.dynsym	0x40c26c	108	FUNC	<unknown>	DEFAULT	12
sqfs_stack_destroy			.dynsym	0x40c2fb	60	FUNC	<unknown>	DEFAULT	12
sqfs_stack_init			.dynsym	0x40c2d8	35	FUNC	<unknown>	DEFAULT	12
sqfs_stack_pop			.dynsym	0x40c376	108	FUNC	<unknown>	DEFAULT	12
sqfs_stack_push			.dynsym	0x40c337	63	FUNC	<unknown>	DEFAULT	12
sqfs_stack_size			.dynsym	0x40c3e2	18	FUNC	<unknown>	DEFAULT	12
sqfs_stack_top			.dynsym	0x40c43e	69	FUNC	<unknown>	DEFAULT	12
sqfs_stat			.dynsym	0x40f738	453	FUNC	<unknown>	DEFAULT	12
sqfs_swap16			.dynsym	0x40a9b9	31	FUNC	<unknown>	DEFAULT	12
sqfs_swapin16			.dynsym	0x40a870	83	FUNC	<unknown>	DEFAULT	12
sqfs_swapin16_internal			.dynsym	0x40a968	27	FUNC	<unknown>	DEFAULT	12
sqfs_swapin32			.dynsym	0x40a8c3	80	FUNC	<unknown>	DEFAULT	12
sqfs_swapin32_internal			.dynsym	0x40a983	27	FUNC	<unknown>	DEFAULT	12
sqfs_swapin64			.dynsym	0x40a913	85	FUNC	<unknown>	DEFAULT	12
sqfs_swapin64_internal			.dynsym	0x40a99e	27	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_base_inode			.dynsym	0x40ab4e	107	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_dev_inode			.dynsym	0x40acbf	139	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_dir_entry			.dynsym	0x40b18c	75	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_dir_header			.dynsym	0x40b1d7	59	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_dir_index			.dynsym	0x40ab13	59	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_dir_inode			.dynsym	0x40aff6	187	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_fragment_entry			.dynsym	0x40b212	43	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_ipc_inode			.dynsym	0x40abb9	123	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_ldev_inode			.dynsym	0x40ad4a	155	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_ldir_inode			.dynsym	0x40b0b1	219	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_lipc_inode			.dynsym	0x40ac34	139	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_lreg_inode			.dynsym	0x40af1b	219	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_reg_inode			.dynsym	0x40ae70	171	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_super_block			.dynsym	0x40a9d8	315	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_symlink_inode			.dynsym	0x40ade5	139	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_xattr_entry			.dynsym	0x40b23d	43	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_xattr_id			.dynsym	0x40b283	59	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_xattr_id_table			.dynsym	0x40b2be	59	FUNC	<unknown>	DEFAULT	12
sqfs_swapin_xattr_val			.dynsym	0x40b268	27	FUNC	<unknown>	DEFAULT	12
sqfs_table_destroy			.dynsym	0x40b6eb	43	FUNC	<unknown>	DEFAULT	12
sqfs_table_get			.dynsym	0x40b716	169	FUNC	<unknown>	DEFAULT	12
sqfs_table_init			.dynsym	0x40b5e8	259	FUNC	<unknown>	DEFAULT	12
sqfs_traverse_close			.dynsym	0x409da3	61	FUNC	<unknown>	DEFAULT	12
sqfs_traverse_next			.dynsym	0x409de0	558	FUNC	<unknown>	DEFAULT	12
sqfs_traverse_open			.dynsym	0x409d51	82	FUNC	<unknown>	DEFAULT	12
sqfs_traverse_open_inode			.dynsym	0x409c8f	194	FUNC	<unknown>	DEFAULT	12
sqfs_traverse_prune			.dynsym	0x40a00e	26	FUNC	<unknown>	DEFAULT	12
sqfs_traverse_state			.dynsym	0x62af98	4	OBJECT	<unknown>	DEFAULT	25
sqfs_usage			.dynsym	0x40fa2d	454	FUNC	<unknown>	DEFAULT	12
sqfs_version			.dynsym	0x407e85	53	FUNC	<unknown>	DEFAULT	12
sqfs_version_supported			.dynsym	0x407e44	65	FUNC	<unknown>	DEFAULT	12
sqfs_xattr_find			.dynsym	0x4099b1	338	FUNC	<unknown>	DEFAULT	12
sqfs_xattr_init			.dynsym	0x4092ec	198	FUNC	<unknown>	DEFAULT	12
sqfs_xattr_lookup			.dynsym	0x409b03	311	FUNC	<unknown>	DEFAULT	12
sqfs_xattr_name			.dynsym	0x4095f6	210	FUNC	<unknown>	DEFAULT	12
sqfs_xattr_name_size			.dynsym	0x4095bb	59	FUNC	<unknown>	DEFAULT	12
sqfs_xattr_open			.dynsym	0x4093b2	236	FUNC	<unknown>	DEFAULT	12
sqfs_xattr_prefixes			.dynsym	0x62ae20	48	OBJECT	<unknown>	DEFAULT	24
sqfs_xattr_read			.dynsym	0x40949e	285	FUNC	<unknown>	DEFAULT	12
sqfs_xattr_value			.dynsym	0x40987e	186	FUNC	<unknown>	DEFAULT	12
sqfs_xattr_value_size			.dynsym	0x4096c8	438	FUNC	<unknown>	DEFAULT	12
st			.dynsym	0x62af00	144	OBJECT	<unknown>	DEFAULT	25
startsWith			.dynsym	0x404bcc	71	FUNC	<unknown>	DEFAULT	12
stderr	GLIBC_2.2.5	libc.so.6	.dynsym	0x62ae60	8	OBJECT	<unknown>	DEFAULT	25
stdin	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
stdout	GLIBC_2.2.5	libc.so.6	.dynsym	0x62ae70	8	OBJECT	<unknown>	DEFAULT	25
strcat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strdup	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strerror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strrchr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
symlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
uncompress			.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
unlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
waitpid	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
write	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 30, 2024 14:18:56.689259052 CEST	43928	443	192.168.2.23	91.189.91.42
Sep 30, 2024 14:19:02.320439100 CEST	42836	443	192.168.2.23	91.189.91.43
Sep 30, 2024 14:19:03.600285053 CEST	42516	80	192.168.2.23	109.202.202.202
Sep 30, 2024 14:19:17.170423985 CEST	43928	443	192.168.2.23	91.189.91.42
Sep 30, 2024 14:19:29.452728987 CEST	42836	443	192.168.2.23	91.189.91.43
Sep 30, 2024 14:19:33.548182964 CEST	42516	80	192.168.2.23	109.202.202.202
Sep 30, 2024 14:19:58.120734930 CEST	43928	443	192.168.2.23	91.189.91.42

System Behavior

Analysis Process: dash PID: 6218, Parent PID: 4331

General

Start time (UTC):	12:18:52
Start date (UTC):	30/09/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6218, Parent PID: 4331

General

Start time (UTC):	12:18:52
Start date (UTC):	30/09/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.HGPF9mFmbj /tmp/tmp.fIaRJARqy2 /tmp/tmp.InqUFpWLDG
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6219, Parent PID: 4331

General

Start time (UTC):	12:18:52
Start date (UTC):	30/09/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6219, Parent PID: 4331

General

Start time (UTC):	12:18:52
Start date (UTC):	30/09/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.HGPF9mFmbj /tmp/tmp.fIaRJARqy2 /tmp/tmp.InqUFpWLDG
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: talkspirit-latest-linux-x86_64.AppImage PID: 6245, Parent PID: 6147

General

Start time (UTC):	12:18:55
Start date (UTC):	30/09/2024
Path:	/tmp/talkspirit-latest-linux-x86_64.AppImage
Arguments:	/tmp/talkspirit-latest-linux-x86_64.AppImage
File size:	99580430 bytes
MD5 hash:	00000000000000000000000000000000

Chronological Activities

Analysis Process: talkspirit-latest-linux-x86_64.AppImage PID: 6246, Parent PID: 6245

General

Start time (UTC):	12:18:55
Start date (UTC):	30/09/2024
Path:	/tmp/talkspirit-latest-linux-x86_64.AppImage
Arguments:	-
File size:	99580430 bytes
MD5 hash:	00000000000000000000000000000000

Chronological Activities

Analysis Process: talkspirit-latest-linux-x86_64.AppImage PID: 6250, Parent PID: 6246

General

Start time (UTC):	12:18:55
Start date (UTC):	30/09/2024
Path:	/tmp/talkspirit-latest-linux-x86_64.AppImage
Arguments:	-
File size:	99580430 bytes
MD5 hash:	00000000000000000000000000000000

Chronological Activities

Analysis Process: AppRun PID: 6245, Parent PID: 6147

General

Start time (UTC):	12:18:55
Start date (UTC):	30/09/2024
Path:	/tmp/.mount_talkspz1hseq/AppRun
Arguments:	/tmp/talkspirit-latest-linux-x86_64.AppImage
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Chronological Activities

Analysis Process: talkspirit-desktop PID: 6245, Parent PID: 6147

General

Start time (UTC):	12:18:55
Start date (UTC):	30/09/2024
Path:	/tmp/.mount_talkspz1hseq/talkspirit-desktop
Arguments:	/tmp/.mount_talkspz1hseq/talkspirit-desktop
File size:	166172552 bytes
MD5 hash:	00000000000000000000000000000000

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report talkspirit-latest-linux-x86_64.AppImage

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Dynamic Tags

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: dash PID: 6218, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6218, Parent PID: 4331

General

Chronological Activities

Analysis Process: dash PID: 6219, Parent PID: 4331

General

Chronological Activities

Analysis Process: rm PID: 6219, Parent PID: 4331

General

Chronological Activities

Analysis Process: talkspirit-latest-linux-x86_64.AppImage PID: 6245, Parent PID: 6147

General

Chronological Activities

Analysis Process: talkspirit-latest-linux-x86_64.AppImage PID: 6246, Parent PID: 6245

General

Chronological Activities

Analysis Process: talkspirit-latest-linux-x86_64.AppImage PID: 6250, Parent PID: 6246

General

Chronological Activities

Analysis Process: AppRun PID: 6245, Parent PID: 6147

General

Chronological Activities

Analysis Process: talkspirit-desktop PID: 6245, Parent PID: 6147

Linux Analysis Report
talkspirit-latest-linux-x86_64.AppImage