[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Edikknoca
2020-08-06 16:25
6e4721 cialis jelly where to get

http://ciaviagogogo.com/ - generic cialis online

cialis tadalafi

http://cilapharm.com/ - generic cialis

custom writing plagiarism

https://edpillsnews20.com/ - viagra buy
Penzknoca
2020-08-06 14:44
0bcc21 whencost of cialis vs viagra

http://viagraaqwe.com/ - online viagra

effet viagra sur jeune

http://viagraeuw.com/ - generic viagra online

buying cheap viagra wholesale

https://viagrahere20.com/ - viagra cheap

25 mg low price viagra

http://viagraoier.com/ - viagra online
Anisknoca
2020-08-06 12:13
411621 we recommend cialis com

http://cilapharm.com/ - generic cialis online
Irinaknoca
2020-08-06 09:49
is und alkohol forum

53e7
Aariniknoca
2020-08-06 03:51
5f7521 viagra super active plus cheap

https://viagraonline20up.com/ - buy viagra
Aariniknoca
2020-08-06 03:00
5f7521 viagra online salud

https://viagraonline20up.com/ - buy viagra
Tolanknoca
2020-08-06 02:30
097821 nfl players viagra

http://viagraaqwe.com/ - buy viagra online
Yuitoknoca
2020-08-06 02:00
3cfd21 canadian generic viagra sales

http://vigraweuy.com/ - buy viagra

prix cialis espagne

https://cialisdoitnow.com/ - cheap cialis online

cialis costa rica

http://cialishhqoeur.com/ - buy cialis

acheter cialis en ligne forum

https://cialishowmuch.com/ - buy generic cialis
Fyodorknoca
2020-08-06 00:58
f4d731 generic reviews online cialis



http://cialisuqpor.com/ potenzpillen cialis



http://cialisuqwc.com/ discount cialis fedex



http://cialisuyew.com/ cialis online amazon



http://cialisyytr.com/
Veraknoca
2020-08-05 23:47
address order is

f371 at is in italia

f371
Teterinknoca
2020-08-05 23:12
is originale online sicuro

3d96
Valyaknoca
2020-08-05 22:13
is dc

bd65 is gold board cb

bd65 is australia to be

bd65
Annaknoca
2020-08-05 20:48
ab5821 side daily once cialis

https://ssupercialisever.com/ - buy generic cialis
Jozeeknoca
2020-08-05 20:31
ab5831 over the counter viagra london



https://viagratodo20.com/
Andzhelaknoca
2020-08-05 20:01
440931 generic viagra for purchase



https://viagratodaybest.com/ i use it online viagra scams



https://viagratodo20.com/ generic viagra 100mg cheap



http://viagrauyr.com/ billige viagra deutschland



http://viagrayqdd.com/

发表评论:

Powered by emlog