Sec 503.5 Case 2
Solution
Find a string in a packet
Find the string smsses.exe
Frame 208 is the 1st Fragment
Frame 209 gives us the last
fragment frame
Frame 231 is the Last Fragment
and Contains the File Size
Analyze>Follow TCP Stream
shows the PE Header (MZ)
Further into the stream is the end
of the executable
Save the raw file
The extract_file.raw is considerably
larger than SMSSES.EXE
(file size 24576)
Open extract_file.raw in Hex Editor
Locate the Header MZ or
Hex 4D5A90
Remove Packet Data before MZ
Header
File after removing bytes
preceeding MZ Header
24576 is 6000 in Hex
Remove everything after the offset
Find ics.exe
Packet 8092 start of tranfer
Packet 8093 shows last fragment is
8134 (which will have the file size)
File size is 45056
Total size of raw file