[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Stanislavaknoca
2019-02-24 11:10
personal loans in greenwood sc

bd65 look here is superforce

bd65 we use it is free pills

bd65 can you be is in nz

bd65
Rannevknoca
2019-02-24 11:07
wirkstoff viagra beipackzettel
Rannevknoca
2019-02-24 10:39
buy viagra 25mg tablets
Rannevknoca
2019-02-24 09:22
is sales usa
Stanislavaknoca
2019-02-24 07:03
guaranteed loans ost

bd65 is canada di sconto

bd65 cheap is 20mg pills us

bd65 is mode administratio

bd65
Rannevknoca
2019-02-24 06:55
order viagra online dk
Rannevknoca
2019-02-24 04:54
cialis viagra tadalafi
Rannevknoca
2019-02-24 04:11
i recommend rx online viagra
Rannevknoca
2019-02-24 03:30
prescription en ligne viagra
Rannevknoca
2019-02-23 23:53
tomar is hace dano
Stanislavaknoca
2019-02-23 22:58
what is cash advance interest

bd65 comprare is ato

bd65 is cost australia

bd65 is is shop

bd65
Rannevknoca
2019-02-23 20:48
only here viagra pharmacy
Rannevknoca
2019-02-23 20:32
is gnrique inde
Rannevknoca
2019-02-23 19:23
viagra canada online generic
Rannevknoca
2019-02-23 17:33
viagra herbal for men

发表评论:

Powered by emlog