[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Domnikaknoca
2018-12-18 16:48
is value card results

     553b can i get real is online
Domnikaknoca
2018-12-18 15:25
erfahrungsbericht is

     553b kb is online
Domnikaknoca
2018-12-18 14:30
is 8 m

     553b just try be is in uk
Filatknoca
2018-12-18 12:47
is atos

     fa11 where can i get is jelly
Filatknoca
2018-12-18 12:24
is veritable vrai is

     fa11 farmacia de is uk precio
Filatknoca
2018-12-18 08:56
we like it is at 10mg

     fa11 very good site internet is
Filatknoca
2018-12-18 05:12
96b7 zumo de cialis sale buy

http://ph-db957-2-0.com/ - cialis online
    

just try buy cialis australia
Filatknoca
2018-12-18 02:32
ordonnance is 5mg

     fa11 at is e20 canada
Rannevknoca
2018-12-16 23:05
is en los jovene
Rannevknoca
2018-12-16 23:02
can be is in malaysia
Rannevknoca
2018-12-16 22:36
can buy viagra bali
Aarontic
2018-12-16 20:34
http://prednisolonegenericbuy.com/ - prednisolone http://lisinoprilgenericonline.com/ - lisinopril hct http://lasixgenericbuy.com/ - Order Lasix With No Prescription
Rannevknoca
2018-12-16 07:33
viagra in toronto office
Rannevknoca
2018-12-16 00:22
viagra cialis or levitra cost
Dorianaknoca
2018-12-15 12:09
we choice candian is

     1a96 try it cheap is uk

发表评论:

Powered by emlog