[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Aarontic
2019-03-30 18:47
http://albenza.team/ - albenza for pinworms
Aarontic
2019-03-27 23:11
http://tadacip.institute/ - tadacip
Aarontic
2019-03-26 12:54
http://buybactrimonlinenorx.us.com/ - bactrim
Frenines
2019-03-20 03:18
http://cialisnrxch.com/#

http://cialisggnrx.com/#

http://cialisndbrx.com/#

http://cialisgentrx.com/#
Mahprodo
2019-03-19 04:03
http://cialisnrxch.com/#

http://cialisggnrx.com/#

http://cialisndbrx.com/#

http://cialisgentrx.com/#
burgygek
2019-03-19 03:47
http://cialisnrxch.com/#

http://cialisggnrx.com/#

http://cialisndbrx.com/#

http://cialisgentrx.com/#
Brentcap
2019-03-15 10:47
good place very helpful articles. combine bookmarks
AllensEnala
2019-03-10 09:33
buy cialis canada review  https://cialisxgeneric.com - buying cialis in canada
Aarontic
2019-03-03 08:08
http://sildenafil100mg.us.com/ - SILDENAFIL 100MG
Aarontic
2019-03-02 05:20
http://lasix365.us.com/ - lasix 40mg to buy
Aarontic
2019-02-28 18:32
http://zofran.us.com/ - zofran over the counter
Stanislavaknoca
2019-02-28 18:19
cash loans barrie

bd65 ja existe o ato do is

bd65 is 5 mg be

bd65 being is in a chemist

bd65
Stanislavaknoca
2019-02-28 16:15
guaranteed loans ost

bd65 is canada di sconto

bd65 is prescription dr ny

bd65 achat is 150 mg

bd65
Stanislavaknoca
2019-02-28 15:44
find money lender com

bd65 isnde zero assoluto

bd65 cheap is prices canadian

bd65 costco at is prices

bd65
Aarontic
2019-02-28 14:36
http://acyclovir365.us.com/ - acyclovir

发表评论:

Powered by emlog