hash mismatch

[SeaofThought]

Hello, thank you for the site, it's very useful. I've been trying to extract IOCs from several Excel files infected with the Emotet/Abracadabra Trojan.

I can successfully extract the IOCs but I noticed that the hash of the downloaded file never corresponds to the hash I requested. On closer inspection it is due to the dowloaded file having a few extra bytes at the start.

This happens both with md5 and sha256 hashes.

I can easily fix the hashes by running: tail -c +13 downloaded_file > fixed_file

For example for the file with sha256 56e665d85d3621e561d7848e2175ff184d81d0543ab5f84675b4a7e2ac7dfa86

tail -c +13 56e665d85d3621e561d7848e2175ff184d81d0543ab5f84675b4a7e2ac7dfa86 > 56e665d85d3621e561d7848e2175ff184d81d0543ab5f84675b4a7e2ac7dfa86.fixed

And I then get the proper results:

remnux@remnux:~/Downloads/EmotetXLS$ sha256sum *
385759178a769dafbd56a977bda452d4f95f0547c175692e0088a19650973233  56e665d85d3621e561d7848e2175ff184d81d0543ab5f84675b4a7e2ac7dfa86
56e665d85d3621e561d7848e2175ff184d81d0543ab5f84675b4a7e2ac7dfa86  56e665d85d3621e561d7848e2175ff184d81d0543ab5f84675b4a7e2ac7dfa86.fixed
8f2711d69fd3da52c9b938a93683984194c4626f0f1d123fcae629b58cc68ba6  8f2711d69fd3da52c9b938a93683984194c4626f0f1d123fcae629b58cc68ba6.xls
f4af928969d9b1cd53cc4c340063645fe8c8f043e21eeb52589ca0f2864b1ab4  8f2711d69fd3da52c9b938a93683984194c4626f0f1d123fcae629b58cc68ba6.xls.fixed
14cece267d155f3e54bff879e8daa1d7760f6b94121cd0a46b21bb341045ddb6  c42e2e73b96b837890f4d58423f25b1181aed81eee5d123ea0d0d1295d21509c
c42e2e73b96b837890f4d58423f25b1181aed81eee5d123ea0d0d1295d21509c  c42e2e73b96b837890f4d58423f25b1181aed81eee5d123ea0d0d1295d21509c.fixed
aeef04764e00af40dadcce839709325dcf15ef50fe4bd8bfdfb75190b8219e60  d69450df6cd1f5533347c2578c54c49d858c38348ac107c561c5c09f3d07b400
d69450df6cd1f5533347c2578c54c49d858c38348ac107c561c5c09f3d07b400  d69450df6cd1f5533347c2578c54c49d858c38348ac107c561c5c09f3d07b400.fixed

remnux@remnux:~/Downloads/EmotetXLS$ md5sum *
7e22db169538e3d372c8047a1a67d3b9  94db48e7998540a932a0698c1f9d8325
94db48e7998540a932a0698c1f9d8325  94db48e7998540a932a0698c1f9d8325.fixed

Probably this is by design and it's explained somewhere , but, since I couldn't find this behavior in the documentation, I'm just asking here to make sure it's not a bug.

Thanks again.

[silascutler]

Thanks, I think we fixed this in a previous update. There was an extra dbg print that was ending up prepended to downloads.

[silascutler]

Please reopen if this is still happening