[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Rolandknoca
2018-12-20 18:55
is lilly price

     3e73 is diversen en overige
Iolantaknoca
2018-12-20 12:53
is on private prescription

     e670 costo ufficiale is
Iolantaknoca
2018-12-20 11:13
is to women

     e670 is einfach kaufen de
Iolantaknoca
2018-12-20 07:20
i is real can online

     e670 is tablet price in india
Iolantaknoca
2018-12-20 06:42
is is combined

     e670 only here being is online
Iolantaknoca
2018-12-20 06:34
is sale chemists

     e670 is in be boots can
Iolantaknoca
2018-12-19 22:28
is pills discussion

     e670 homemade is
Iolantaknoca
2018-12-19 20:37
coste de pastillas is uk

     e670 is difference and
Iolantaknoca
2018-12-19 18:52
is wiki

     e670 is for sale malaysia
Domnikaknoca
2018-12-19 13:38
is de compra

     553b ato para is
Domnikaknoca
2018-12-19 11:56
just try be is in uk

     553b is vraiment efficace
Domnikaknoca
2018-12-19 09:41
just try is overnite

     553b reliability of at is
Aarontic
2018-12-19 07:38
http://viagraonline.us.com/ - viagra online http://torsemidebest.us.org/ - torsemide generic http://cleocingel.us.com/ - cleocin http://vardenafil.us.com/ - vardenafil http://advair365.us.com/ - advair price http://colchicinebest.us.org/ - colchicine http://torsemide.us.org/ - torsemide
Domnikaknoca
2018-12-19 01:27
costo de is en el peru

     553b is for men in hyderabad
Domnikaknoca
2018-12-18 18:30
is 365

     553b ordering is pills in india

发表评论:

Powered by emlog