[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Caiknoca
2020-09-09 05:06
1fd031 sirius xm viagra commercial



http://viagener2020.com/ lowest cost viagra generic



http://viagraaqwe.com/
Gloriyaknoca
2020-09-08 03:08
comprar is baratas

b4ba term effects of is long

b4ba be is online with paypal

b4ba purchase is from safeway

b4ba
Alainnaknoca
2020-09-08 01:27
is 20 mg sans ordonnanc

f8f0 kanada preiswerter is

f8f0 is neye yarar

f8f0 walgreens prices for is

f8f0
Statesknoca
2020-09-08 00:53
is 50 mg wirkun

519d cheap is 5mg

519d soft tab at is online

519d
AApbrdq
2020-09-04 12:19
http://batmanapollo.ru/
pay for paper
2020-09-01 12:18
custom papers http://writemypaperbuyxvv.com/ write my papers
ikiykinini
2020-09-01 04:08
persuasive essay writer http://customessaywritershb.com/ custom essays online
dissertation paper
2020-08-31 22:51
dissertation help http://dissertationhelpxvf.com/ dissertation writing coach
thesis editing
2020-08-31 20:31
thesis advice http://thesisbyl.com/ thesis writing
ikiykinini
2020-08-31 17:37
best online essay writer http://customessaywritershb.com/ custom college essays
MelviBaf
2020-08-31 15:12
Truly all kinds of beneficial advice.
http://www.quanmama.com/t/goto.aspx?url=https://canadianonlinepharmacyhere.com https://portal.goosevpn.com/aff.php?aff=18&redirect=https://topcialisrxstore.com https://www.google.com.ai/url?q=https://canadianpharmaceuticalsrx.com http://www.seishinka-file.info/rank.php?mode=link&id=3469&url=https://canadianpharmaceuticalsrx.com http://www.oktotech.com/wp-content/themes/Grimag/go.php?https://cadmedbb.com https://xcx.yingyonghao8.com/index.php?r=oauth2/forumAuthOrize&referer=https://topcialisrxstore.com http://www.myhelphub.com/start/trackstart.aspx?int=OT&cn=best-anonymous-OT&ck=proxy+server+software&rd=https://topviagrarxpills.com
MelviBaf
2020-08-31 10:33
You have made the point.
http://www.systemconcept.ru/bitrix/redirect.php?event1=&event2=&event3=&goto=https://topcialisrxpills.com http://nude-virgins.info/cgi-bin/out.cgi?ses=1ZDUgL3GPd&id=1510&url=https://canadianpharmacyed.com http://www.waimao.cn/url.asp?url=https://canadiantoprxstore.com http://www.markprom.ru/go.php?url=https://csvcialis.com http://www.graduateguide.com/weblink.cfm?college_id=3014&urlVal=https://topcialisrxpills.com http://hamas.opoint.com/?url=https://rxpharmacymsn.com http://www.ludonautes.fr/index.php?thememode=full;redirect=https://canadianpharmaciesmsn.com http://dvt-info.cz/WEB_root/DVT_main/Default.aspx?url=https://msncialis.com https://maps.google.com.au/url?q=https://csvcialis.com https://dex.hu/x.php?id=velvet_blogok_cikklink&url=https://canadianpharmacy-us.com http://essobmr.ru/redirect?url=https://csvcialis.com http://miniblacks.fi/guestbook/go.php?url=https://topviagrarxpills.com http://trace.zhiziyun.com/sac.do?zzid=1337190324484706304&siteid=1337190324484706305&turl=https://ntviagrausa.com
MelviBaf
2020-08-31 09:52
Nicely put, Thanks a lot!
http://4vn.eu/forum/vcheckvirus.php?url=https://cadmedbb.com/ https://www.rochester.k12.mi.us/jump?URL=https://topcialisrxpills.com https://weberu.ru/redirect/?url=https://canadianonlinepharmacyhere.com http://www.allnantucket.com/cgi-bin/go.pl?URL=https://topviagrarxstore.com http://www.sex3dtoons.com/crtr/cgi/out.cgi?id=38&l=top_top&u=https://canadianonlinepharmacyhere.com http://www.exploora.com.br/redirect.php?url=https://ntviagrausa.com http://fujishima-bunka.jp/index.php?a=free_page/goto_mobile&referer=https://topviagrarxpills.com
MelviBaf
2020-08-31 09:17
Thank you! I like it!
http://www.expliciteart.net/cgi-bin/at3/out.cgi?id=924&tag=toplist&trade=https://canadianpharmacyed.com http://www.joycemeyer.ru/bitrix/rk.php?id=16&event1=banner&event2=click&event3=1+/+<>6]+<RIGHT>BANNER_2]+Програми+Джойс+Майєр&goto=https://msnviagrarx.com https://www.google.co.ma/url?q=https://ntviagrausa.com http://www.portalramn.ru/bitrix/redirect.php?event1=&event2=&event3=&goto=https://topcialisrxstore.com https://kultameren.fi/pennut/gotourl.php?url=https://cialisrxmsn.com http://www.praxis-siebnen.ch/dnn/LinkClick.aspx?link=https://cialisrxmsn.com https://www.imperialhomesolutions.co.uk/Redirect?type=link&adid=321&slid=219&plid=0&caid=320&roid=3&url=https://canadianpharmacyed.com http://www.spiritualforums.com/vb/redir.php?link=https://topviagrarxpills.com/ http://www.smutcastle.com/tp/out.php?link=NEW&url=https://topcialisrxstore.com http://www.svenskaracefans.com/ex.aspx?t=https://canadianpharmaceuticalsrx.com http://www.ses.4u.kz/go.php?go=https://canadianpharmaciesmsn.com http://images.google.ms/url?q=https://canadianonlinepharmacyhere.com
MelviBaf
2020-08-31 07:18
You reported this fantastically.
http://totallyteenie.com/crtr/cgi/out.cgi?s=52&c=1&l=teenass&u=https://canadianpharmaciesmsn.com/ https://www.google.am/url?q=https://cadmedbb.com http://www.weichertnews.com/t.aspx?s=1&id=389&nl=1271&n=393&si=220953&url=https://topviagrarxpills.com http://www.crocopost.com/movies/go.php?id=1225793_1&url=https://canadianpharmacyfirst.com http://ricordu.fr/index.php?url=https://rxpharmacymsn.com https://images.google.gg/url?q=https://topcialisrxstore.com http://www.minimunchers.com/Redirect/Default?url=https://topviagrarxstore.com http://www.hqglamour.com/crtr/cgi/out.cgi?id=30&l=top_top&u=https://csvcialis.com http://dproxy.library.dc-uoit.ca/login?url=https://canadianpharmacyfirst.com

发表评论:

Powered by emlog