Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Wireshark Tutorial: Exporting Objects From a Pcap

Summary: Unit 42's fourth Wireshark tutorial, first published in July 2019 and updated for 2024, walks analysts through exporting objects from five pcaps, covering HTTP files, SMB objects, SMTP spam, and FTP data. The examples include a June 2019 Trickbot infection spreading over SMB from 10.6.26.110 to a domain controller at 10.6.26.6, a fake PayPal login page, and a spambot sending 50 sextortion emails in five seconds.

Why it matters: The tutorial's own pcaps carry live Windows malware, and it warns that extracted malicious HTML can call out to malicious domains when opened, so the analyst pulling objects out of a capture is handling the same code that infected the host.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026