[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Muxinaknoca
2020-08-05 00:30
cc0021 viagra super force generic

http://viagrauyr.com/ - viagra
Swanknoca
2020-08-04 23:46
7bfb31 il comprare cialis



http://cialisuqwc.com/ prix cialis 20mg en pharmacie



http://cialisuyew.com/
Xzaviorknoca
2020-08-04 22:12
383131 best results of viagra



https://viagrahere20.com/ my husband took viagra



http://viagraoier.com/
Mahkiknoca
2020-08-04 21:00
1fd031 viagra online italia generico



http://viagrayqdd.com/
Daneaknoca
2020-08-04 20:44
ab5831 cpill order viagra



http://viagraeuw.com/ achat de tablette de viagra



https://viagrahere20.com/ i use it pfizer viagra cheap



http://viagraoier.com/ buy online fast viagra



https://viagraonline20up.com/
Illarionknoca
2020-08-04 20:40
kb is

16b9 is i purchase can

16b9
Widowaknoca
2020-08-04 19:51
forum is 5m

f8d3 is 5mg holland

f8d3 is 10mg indication

f8d3
knoca
2020-08-04 18:08
is the little blue pill

     eba6 only today female is
knoca
2020-08-04 17:18
pfizer is rezeptfrei

     eba6 is dogs
Lyiamknoca
2020-08-04 14:54
canadian at is cheap

5336 trial is

5336 wow look it rx online is

5336 very good site is on line

5336
Lazariyahknoca
2020-08-04 14:42
when does is expire

16b9 compra is in farmacia

16b9
Uliyanaknoca
2020-08-04 13:10
cheap is once day

832b how to make is work better

832b can i take 2 is 20mg

832b
Seckyknoca
2020-08-04 12:47
is atos 10mg

9d11 is precio chil

9d11 is jelly cost in canada

9d11
knoca
2020-08-04 11:27
710521 cheap viagra plus

https://viaonlinebest.com/ - viagra per aut
    

best selling viagra in india
knoca
2020-08-04 10:19
710521 low viagra prices

https://viaonlinebest.com/ - only today female viagra
    

viagra sublingual online price

发表评论:

Powered by emlog