Fiddler Ideas

The free web debugging proxy for any browser, system or platform.

SetupHelper is ranked as malicious

I was reading a malware report on the Fiddler Installer "[Sep-15-17] v4.6.20173.38786" and two things grabbed my attention. First SetupHelper is classified as malicious (Eric says that may be because it's missing the .exe extension) and second the mscorsvw process writes to an unknown file the contents MEOW followed by some indecipherable data.

meow.PNG
Capture.PNG
Attachments Open full size
  • Guest
  • Nov 20 2017
  • Under review
Bug
  • Attach files
  • Eric Lawrence commented
    November 20, 2017 20:58

     I suspect the MEOW thing is even more of a red herring.

    In COM and DCOM marshalled interfaces, called OBJREFs, always start with the byte sequence "MEOW" (4D 45 4F 57). 

    Attachments Open full size

Related ideas