Noted Sherlock

Off-topic
1

help
Noted Sherlock

What’s the timestamp in UTC when attacker last modified the program source file?

I don’t know. I’ll try all possible options. tell me where to look

2

Stuck on the same question. Is LootAndPurge not the source file?

3

were you able to figure it out like i have been banging my head now against the wall for this so any clue or direct answer would be helpfull

4

I am also stuck here.

6

here is the code for the answere
import datetime

These are the two parts of the timestamp

timestamp_low = -1354503710
timestamp_high = 31047188

Combine the two parts to get the full timestamp

full_timestamp = (timestamp_high << 32) | (timestamp_low & 0xFFFFFFFF)

The timestamp is in 100-nanosecond intervals since January 1, 1601

Convert it to seconds and then to a datetime object

timestamp_seconds = full_timestamp / 10**7
timestamp = datetime.datetime(1601, 1, 1) + datetime.timedelta(seconds=timestamp_seconds)

print(timestamp)

3 Likes
7

■■■■, I had the right idea at least. I tried converting the high and low into an 18-digit LDAP timestamp, but didn’t get the right answer. The rest of the questions were dead simple in comparison lol. Thanks for sharing Sentinel.

(What I tired unsuccessfully):
high = 31047188 (from originalFileLastModifTimestampHigh)
low = -1354503710 = -X (so X = 1354503710) (from originalFileLastModifTimestamp)
2^32 = 4294967296
full value = high * 2^32 + (2^32 - X) = 31047188 * 4294967296 + (4294967296 - 1354503710).

1 Like
8

pastebin seems down atm and the wayback machine didnt copy the note… any idea where else it could be found?

9

Thanks, I don’t think I would have get it without your help. :+1:

10

need help with this, i do not understand what is << or | or this & 0xFFFFFFFF on the equation can some one explain it, thanks

11

this is used to combine or merge the lower bits and higher bits of the timestamp. The note pad session has divided the timestamp in to two separate variable because of its size and that is the trick here

1 Like
12

thanks Sentinel, i think i m doing something wrong here, i got the value 2018-07-24 14:56:51 but it is not possible that date, its 5 year later,i’ll try to figure out this one

13

good honestly you just have to execute the code on python to get the answer no need to change anything I think

1 Like
14

solved thanks Sentinel