[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎（http://tcasoft.com/）提供了64位系统支持，上传样本时可以选择64位环境了：

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大，只是变量具体偏移、具体长度方面的变化，所以对于API等上层行为的监控来讲比较容易实现，反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大，还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试，没有安装Office等常用软件。展示一个测试样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本，CVE-2017-0199：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出，该样本从 rottastics36w.net/template.doc 下载了恶意代码：

64up.png


不过这个链接目前已经无法访问了。


« WannaCry勒索软件分析 | 分析平台再次升级»

评论：

Stanislavaknoca
约 2 小时前
nea personal loan

bd65 women taking is 2012

bd65 the best site is in india

bd65 only here is 100mg

bd65
回复
Stanislavaknoca
约 18 小时前
top payday loan companies

bd65 is pricing at costco

bd65 precio is tadalafil 20mg

bd65 classic tabs is

bd65
回复
Stanislavaknoca
约 19 小时前
payday loans in sapulpa ok

bd65 is given to women

bd65 is 4cpr riv

bd65 try it order is cheap

bd65
回复
Aarontic
约 22 小时前
http://buspar.icu/ - buspirone price
回复
Stanislavaknoca
2019-02-21 02:03
cash advance servicing wilmington de

bd65 only for you cheap is 50mg

bd65 is nez bouch

bd65 anyone purchase is online

bd65
回复
Aarontic
2019-02-20 17:50
http://furosemide.network/ - furosemide
回复
Aarontic
2019-02-20 17:10
http://vermox.icu/ - vermox
回复
Stanislavaknoca
2019-02-20 12:48
umcu personal loan

bd65 be 4 is pills online

bd65 is en pastilla

bd65 venta is en barcelona

bd65
回复
Stanislavaknoca
2019-02-20 11:28
payday loans lakeland fl

bd65 kobe is online

bd65 is 20 mg lily

bd65 reviews 50mg or 100mg is

bd65
回复
Aarontic
2019-02-19 22:51
http://prozac.icu/ - prozac
回复
Stanislavaknoca
2019-02-18 22:00
payday loans in robertsdale al

bd65 vendo is foro

bd65 is 5mg order online

bd65 be 25 mg is online

bd65
回复
Stanislavaknoca
2019-02-18 20:48
little payday loans payday loan

bd65 non persription is

bd65 is norge

bd65 is bestellen mastercard

bd65
回复
Stanislavaknoca
2019-02-18 19:41
cash loan logos

bd65 cheap 25mg is

bd65 is annual sales 2011 mg

bd65 is bestellen schweiz

bd65
回复
Aarontic
2019-02-18 17:56
http://tricor.icu/ - generic for tricor 145 mg
回复
Rannevknoca
2019-02-18 11:39
viagra sales usa
回复

发表评论：

Powered by emlog