[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Rannevknoca
2019-02-15 13:53
expiration pfizer viagra date
Aarontic
2019-02-15 07:06
http://lisinopril.guru/ - lisinopril 20mg tablets
AnvarKirillov94knoca
2019-02-12 18:06
is for sale ontario

     9f8c come is senza ricetta
NelidaPestova92knoca
2019-02-11 17:56
be rx is

     eb98 is bph
NelidaPestova92knoca
2019-02-11 17:11
is 20 mg gold

     eb98 is legal deutschland
Rannevknoca
2019-02-11 00:21
efeito do viagra generico
Rannevknoca
2019-02-10 12:33
cipla viagra stores
Rannevknoca
2019-02-10 07:54
viagra piller online
Rannevknoca
2019-02-10 00:43
viagra gnrique inde
cialis
2019-02-08 17:07
Spare the rod and spoil the child.
Blood is thicker than water.
Aarontic
2019-01-28 06:51
http://valtrex.us.com/ - order valtrex
Aarontic
2019-01-27 04:35
http://cialis.us.com/ - Cialis
trantyRurdyspusty
2019-01-17 01:48
farmacie che vendono tadalafil generico http://cialisloq.com http://cialisloq.com/, how long after viagra can i take cialis
Gordianknoca
2019-01-10 03:49
is tadalafil a at is

     be07 is online erfahrungen
Svobodaknoca
2019-01-04 18:10
is dapoxetine online

     9042 cost of 30 is 5 mg

发表评论:

Powered by emlog