Export Objects and File Carving
When an attacker downloads malware over HTTP, transfers tools over SMB, or exfiltrates files via FTP — the files traverse the network and can be reconstructed from PCAP. Wireshark's Export Objects feature and command-line tools like NetworkMiner and bulk_extractor let you extract complete files from packet captures, giving you malware samples and exfiltrated data you can analyze statically.
A compromised workstation downloaded three files over HTTP during the initial access phase. One is a .ps1 PowerShell script (the stager), one is a .exe (the payload), and one is a .dll (a side-loaded module). The files were transferred in clear HTTP (port 80), not HTTPS. You have the PCAP. Extracting and analyzing these files reveals the attacker's toolchain, provides hashes for IOC generation, and may reveal additional C2 infrastructure embedded in the code.
Wireshark Export Objects
File → Export Objects → HTTP (or SMB, DICOM, etc.)
═══════════════════════════════════════════════════════════════════
The Export Objects dialog shows all files transferred in the capture:
┌─────────────────────────────────────────────────────────────────┐
│ Packet Hostname Content Type Size File │
│ 47 updates.windowscdn.net text/javascript 2.1KB payload│
│ 234 185.220.101.47 application/octet 47KB svhost │
│ 891 185.220.101.47 application/octet 890KB svc32 │
│ 1203 185.220.101.47 text/plain 1.2KB stage.ps1│
└─────────────────────────────────────────────────────────────────┘
Buttons:
├── Save: save selected file to disk
├── Save All: extract all files to a directory
└── Content-Type filter: show only specific MIME types
Supported protocols:
├── HTTP: all HTTP objects (GET and POST bodies, responses)
├── SMB: files transferred over SMB2 file shares
├── FTP-DATA: files transferred over FTP data channels
├── TFTP: trivial FTP transfers
├── DICOM: medical imaging files (sometimes abused for C2)
└── IMF (Internet Message Format): email attachments
After exporting, check each file:
sha256sum extracted_file → hash for VirusTotal lookup
file extracted_file → determine actual file type (magic bytes)
strings extracted_file | grep -E "http|\.exe|cmd|powershell"
A server can declare any Content-Type regardless of what the file actually is. An attacker serving a PE executable may set Content-Type: text/plain or image/jpeg to evade proxy inspection. Wireshark's Export Objects dialog shows the declared Content-Type. Always verify the actual file type using the file command on the extracted content — it reads the file's magic bytes (the first few bytes that identify the file format), not the HTTP header. A file declared as image/jpeg that starts with 4D5A (MZ) is a Windows PE executable. This is a common technique to bypass naive DLP rules that block "application/octet-stream" but allow "image/jpeg".
Command-Line Object Extraction with tshark
PCAP="/cases/CASE-2026-009/merged.pcap"
OUTPUT_DIR="/cases/CASE-2026-009/extracted-files"
mkdir -p $OUTPUT_DIR
# Export all HTTP objects
tshark -r $PCAP --export-objects "http,$OUTPUT_DIR/http"
# Export all SMB objects
tshark -r $PCAP --export-objects "smb,$OUTPUT_DIR/smb"
# Export all DICOM objects
tshark -r $PCAP --export-objects "dicom,$OUTPUT_DIR/dicom"
# After export, identify file types and compute hashes
echo "=== Extracted file analysis ==="
for f in $OUTPUT_DIR/http/*; do
type=$(file -b "$f")
hash=$(sha256sum "$f" | awk '{print $1}')
size=$(stat -c%s "$f")
echo "File: $(basename $f)"
echo " Type: $type"
echo " Size: $size bytes"
echo " SHA256: $hash"
echo ""
done
# Check for PE executables (MZ header)
echo "=== Executable files ==="
file $OUTPUT_DIR/http/* | grep -i "PE32\|MS-DOS\|ELF\|Mach-O"
# Extract strings from all files (look for C2 infrastructure)
echo "=== IOC strings ==="
for f in $OUTPUT_DIR/http/*; do
echo "--- $(basename $f) ---"
strings "$f" | grep -E "https?://|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" | head -20
doneNetworkMiner — File Extraction + Host Context
NetworkMiner (Windows GUI) — Host-Centric File Extraction
═══════════════════════════════════════════════════════════════════
NetworkMiner organizes extracted evidence by HOST rather than by flow:
Tabs:
├── Hosts: all unique IPs with OS detection (TTL + TCP window fingerprinting)
│ → shows open ports, hostnames, MAC addresses
├── Files: all extracted files, sorted by source host
│ → icons by file type; right-click → Open/VirusTotal/Hash
├── Images: extracted image files displayed as thumbnails
├── Messages: extracted email messages (SMTP, POP3, IMAP)
├── Credentials: usernames/passwords found in cleartext protocols
│ → HTTP Basic Auth, FTP, Telnet, POP3 passwords in plaintext
├── Sessions: conversation list (similar to Wireshark Conversations)
└── DNS: all DNS queries and responses with answer tracking
Key differences from Wireshark:
├── NetworkMiner extracts files even from partial/fragmented TCP streams
├── Credentials tab is unique — no Wireshark equivalent for automated extraction
├── Host-centric view is easier for "what did this specific host do?"
└── Slower and GUI-only; tshark scales better for large captures
Usage:
File → Open → select .pcap file
Files tab → right-click any file → "Open with Notepad/HxD"
Credentials tab → shows passwords in cleartext immediately
bulk_extractor — Deep Payload Carving
# bulk_extractor can carve forensic artifacts directly from pcap files
# It finds patterns in raw bytes: URLs, email addresses, credit cards, etc.
PCAP="/cases/CASE-2026-009/merged.pcap"
OUTPUT="/cases/CASE-2026-009/bulk-extract"
mkdir -p $OUTPUT
# Run bulk_extractor on the pcap
bulk_extractor -R $PCAP -o $OUTPUT
# After completion, the output directory contains:
# url.txt → all URLs found in packet payloads
# domain.txt → all domain names
# email.txt → all email addresses
# telephone.txt → phone numbers
# ip.txt → IP addresses in packet content (not just headers)
# http.txt → HTTP headers reconstructed
# json.txt → JSON objects found in payloads
# Key files for investigation:
echo "=== URLs found in payloads ==="
sort -u $OUTPUT/url.txt | grep -v "^#" | head -50
echo "=== Domains ==="
sort -u $OUTPUT/domain.txt | grep -v "^#" | \
grep -v "\.microsoft\.com\|\.windows\.com\|\.google\.com" | head -30
echo "=== Email addresses ==="
cat $OUTPUT/email.txt | grep -v "^#" | sort -u | head -20
# bulk_extractor also produces histograms:
# url_histogram.txt → most frequently seen URLs (C2 check-in URI)
# domain_histogram.txt → most frequent domains
echo "=== Top 10 domains by frequency ==="
sort -rn $OUTPUT/domain_histogram.txt | head -10Q & A
Q: The file I exported from Wireshark seems corrupted — it opens partially but not completely. Why?
Partial file extraction is usually caused by one of three issues: (1) Capture started mid-transfer: if the PCAP capture started after the TCP session began, the beginning of the file transfer is missing. Wireshark can only reassemble data from packets it has. The partial file starts from the first captured byte of the HTTP response, not the beginning of the file. (2) Packet drops during capture: if the capture had drops (check capinfos for "Packets dropped"), some segments of the file are missing. The reassembly will have gaps. (3) TCP retransmission handling: in some cases, duplicate segments in the PCAP confuse the reassembly. Try using the -d flag with editcap to remove duplicates before extraction. To verify: compare the exported file's size with the HTTP Content-Length header. If they differ, the extraction is incomplete. You can sometimes recover the remainder from a later retransmit in the same PCAP — look for TCP retransmission packets after the truncation point and manually combine the bytes.