[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

RobertBap
2020-08-30 17:31
You made your point! national pharmacies online https://topswritingservices.com canadian prescription drugs
MelviBaf
2020-08-30 17:06
Wonderful posts. Thank you!
http://www.danviews.com/go/?url=https://canadianpharmacyed.com http://www.neorealty.ru/cgi-bin/redirect.cgi?https://canadiantoprxstore.com https://www.miss-sc.org/redirect.aspx?destination=https://canadianrxpillusa.com http://www.losvillas.ru/redirect?url=https://canadianpharmaceuticalsrx.com https://www.ahspares.co.uk/redirect.aspx?guid=<trackingid>&url=https://csvcialis.com https://images.google.com.kw/url?q=https://canadianpharmacyfirst.com http://www.rurazmer.ru/bitrix/rk.php?goto=https://topcialisrxpills.com http://colorsound.com.ua/clickout/?url=https://ntviagrausa.com http://charitiesbuyinggroup.com/membersearch.aspx?returnurl=https://canadianonlinepharmacyhere.com http://www.olgagouveia.com/link.asp?idc=1&idl=63&url=https://csvcialis.com https://maps.google.com.ng/url?q=https://canadianpharmaceuticalsrx.com http://www.eldiariodecoahuila.com.mx/a/includes/modulos/click.asp?id=329&url=https://canadianrxpillusa.com https://indianaeconomicdigest.com/Redirect.asp?UID=65909966&SubSectionID=-1&AdArrayID=15&AdPosition=1&Linkurl=https://canadianpharmaciesmsn.com http://porno.ar7.biz/out.cgi?id=00305&url=https://rxpharmacymsn.com
ScottGuith
2020-08-30 14:12
You expressed this very well. canadian pharmacy drugs online http://canadianonlinepharmacyhere.com/order-viagra_super_active-online-en.html medication costs
bxswulzjhxij
2020-08-30 13:32
51000 61171 22142 42978
http://bitly.com/1ntFjX
42891 22417 37599 34370
http://bitly.com/1ntFjX - Вратарь Галактики смотреть онлайн 43548 32298 38301 97051
kedozswwsdxr
2020-08-30 12:31
52674 98719 77661 68953
http://bitly.com/1ntFjX
95415 46491 84012 90509
http://bitly.com/1ntFjX - Вратарь Галактики смотреть онлайн 80573 67758 32923 51666
MelviBaf
2020-08-30 12:27
You actually reported this really well!
http://seolife.in.ua/go.php?url=https://canadianonlinepharmacyhere.com http://bestfatclips.com/cgi-bin/atx/out.cgi?id=28&trade=https://msnviagrarx.com http://zjjiajiao.cn/ad/adredir.asp?url=https://canadianpharmaciesmsn.com http://www.acuracatalog.com/redirect.php?link=https://topcialisrxpills.com http://dcfever.com/click.php?id=model_lunaworks&url=https://csvcialis.com http://www.u-u-ah.net/buzz/create/L.php?ID=&CA=game&TXT=1276536653&URL++https://topviagrarxpills.com http://pixel.nascimpact.com/go.php?url=https://msncialis.com http://www.eurogirls17.com/cgi-bin/at3/out.cgi?id=724&tag=toplist&trade=https://topviagrarxstore.com
rrmaygvegjek
2020-08-30 12:02
80258 87736 82066 51112
http://bitly.com/1ntFjX
80124 17039 70036 89468
http://bitly.com/1ntFjX - Вратарь Галактики смотреть онлайн 98375 88133 28759 64206
RobertBap
2020-08-30 11:32
Whoa all kinds of good facts! canadian pharmacies https://topviagrarxpills.com pharmacies near me
ScottGuith
2020-08-30 11:14
Nicely put, With thanks! discount prescription drug http://canadianpharmaciesrxstore.com/order-ceclor-cd-online-en.html walgreens pharmacy online
MelviBaf
2020-08-30 10:27
Whoa plenty of excellent advice!
http://gta-action.ru/go.php?url=https://canadianpharmacyfirst.com http://www.trannypool.com/movies/go.php?id=1131246_1&url=https://ntviagrausa.com http://mgnews.ru/redirect/go?to=https://canadianpharmacyfirst.com http://www.phpkida.com/website-review/redirect.php?url=https://csvcialis.com https://www.asiamh.ru/bitrix/rk.php?id=35&event1=banner&event2=click&event3=1+%2F+%5B35%5D+%5Bright_3b%5D+%C0%F0%E5%ED%E4%E0&goto=https://canadianpharmaceuticalsrx.com http://maps.google.pl/url?q=https://ntviagrausa.com http://natd.gov.kz/bitrix/redirect.php?event1=document&event2=download&goto=https://msnviagrarx.com http://www.motordebusca.pt/busca/redir.asp?idsite=7950&url=https://canadianrxpillusa.com https://www.hoteljob.in.th/preload.php?url=https://canadianpharmacyed.com http://madamandlady.net/m/redirect.php?url=https://msnviagrarx.com https://memorialservices.lv/redirect/url/?url=https://canadianonlinepharmacyhere.com
MelviBaf
2020-08-30 09:50
Fine material. Many thanks!
http://obuvka.net.ua/redirect.php?action=url&goto=https://topcialisrxpills.com http://accessdatabasedevelopers.com/Services/Redirect.aspx?url=https://canadianpharmacy-us.com http://maps.google.lv/url?q=https://canadianpharmaciesrxstore.com http://paidtosin.com/ttt-out.php?pct=90&url=https://msnviagrarx.com http://www.shahter.ru/mz/click.php?url=https://topcialisrxstore.com http://www.zaharonim.org.il/redir.asp?url=https://canadianpharmaciesmsn.com http://www.freeporngirlfriend.com/crtr/cgi/out.cgi?id=40&l=thumbs1&u=https://topcialisrxstore.com http://alothome.com/Go.aspx?rurl=https://canadianonlinepharmacyhere.com https://thecuttingedgenews.com/index.php?ad=11223&url=https://canadianpharmacyed.com http://mikro.andi.lv/bitrix/rk.php?id=59&event1=banner&event2=click&event3=3+/+<>9]+<mikro>top]+SunlighSailing+RU&goto=https://canadianpharmaciesmsn.com
KeitrSax
2020-08-30 09:41
Nicely voiced genuinely! . canadian pharcharmy online https://dissertationwritingtops.com pharmeasy
liquid tadalafil
2020-08-30 07:21
cialis coupon http://loncialis.com/ cialis without prescription
RobertBap
2020-08-30 07:01
Whoa a lot of very good tips. canada meds https://homeworkcourseworkhelps.com order medicine online
cialis soft
2020-08-30 06:19
tadalafil 20 mg http://loncialis.com/ tadalafil liquid

发表评论:

Powered by emlog