[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

MelvineBaf
2020-08-22 23:30
Really plenty of great info!
http://www.samawi.com/__media__/js/netsoltrademark.php?d=canadianpharmacyfirst.com http://smsinavi.com/__media__/js/netsoltrademark.php?d=topcialisrxpills.com http://mothersarmy.org/__media__/js/netsoltrademark.php?d=canadianpharmacyed.com http://mydomainsecurity.com/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://canyonranchloscabos.com/__media__/js/netsoltrademark.php?d=cadmedbb.com http://boston-common.net/__media__/js/netsoltrademark.php?d=canadianpharmacy-us.com http://warfareboats.com/__media__/js/netsoltrademark.php?d=cadmedbb.com http://digitalcast.tv/__media__/js/netsoltrademark.php?d=msnviagrarx.com
KeitrSax
2020-08-22 22:51
Nicely put. With thanks! canadian drugs online pharmacy https://msnviagrarx.com discount prescription drug
MelvineBaf
2020-08-22 21:53
You made your point very clearly!.
http://scvh20.net/__media__/js/netsoltrademark.php?d=csvcialis.com http://airambulancerankings.com/__media__/js/netsoltrademark.php?d=canadianpharmacyfirst.com http://valoanquestions.org/__media__/js/netsoltrademark.php?d=canadianpharmaciesrxstore.com http://rhinelanderrealty.com/__media__/js/netsoltrademark.php?d=canadianpharmacyfirst.com http://kburton.com/__media__/js/netsoltrademark.php?d=canadianpharmaciesmsn.com http://adameiseman.org/__media__/js/netsoltrademark.php?d=msnviagrarx.com http://frankfurt-tips.com/__media__/js/netsoltrademark.php?d=ntviagrausa.com http://tedxtravel.com/__media__/js/netsoltrademark.php?d=canadianpharmaceuticalsrx.com http://internettutorsolution.com/__media__/js/netsoltrademark.php?d=cadmedbb.com http://oneheartmeditation.com/__media__/js/netsoltrademark.php?d=canadiantoprxstore.com http://www.hartfordclassaction.biz/__media__/js/netsoltrademark.php?d=canadianrxpillusa.com http://robosep.eu/__media__/js/netsoltrademark.php?d=topcialisrxpills.com
MelviBaf
2020-08-22 20:29
Appreciate it, Numerous content!  
http://mega-xxx.net/go.php?url=https://canadianrxpillusa.com http://school.js88.com/redirect?url=https://topcialisrxstore.com https://maps.google.cl/url?q=https://cadmedbb.com http://www.lightstone.co.za/avm/content/login/redir.aspx?u_id=5f71ce45-a620-4fac-a599-ba09abbf8f16&url=https://canadianpharmaciesrxstore.com http://www.immoflash.at/redirect.php?url=https://topviagrarxpills.com http://horses.derbfactory.net/link.php?t=0&u=f1902c80-3bfe-1659-4719-fbf4cb8993e4&link=https://topviagrarxpills.com http://apps.sgia.org/vts/hitcounter.cfm?tbl=vts.company&fld=companysiteaccessed&idfld=mbrno&idvalue=161003&goto=https://msncialis.com http://www.porn4pussy.com/d/out?p=9&id=2388450&c=3&url=https://cadmedbb.com http://momnudist.net/outlink.php?l=MzF4NHgxMDk1&url=https://canadianpharmacy-us.com https://modsking.com/download.php?id=25865&url=https://topcialisrxstore.com
MelvineBaf
2020-08-22 18:36
Really a lot of excellent facts.
http://thepurplebar.com/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://imperial-theater.org/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://dallastriallawyers.com/__media__/js/netsoltrademark.php?d=topcialisrxstore.com http://beachstand.net/__media__/js/netsoltrademark.php?d=topviagrarxpills.com http://nicholasvperricone.com/__media__/js/netsoltrademark.php?d=msncialis.com http://sacramentorvshows.com/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://harrisonsones.com/__media__/js/netsoltrademark.php?d=topcialisrxpills.com http://fortress-systems.net/__media__/js/netsoltrademark.php?d=canadianpharmaciesmsn.com
KeitrSax
2020-08-22 16:12
You revealed this well! canada pharmaceutical online ordering https://topviagrarxstore.com pharmacy drugstore online
MelvineBaf
2020-08-22 15:18
Amazing info. Regards!
http://vacantinsurance.info/__media__/js/netsoltrademark.php?d=topviagrarxstore.com http://schedule-smart.com/__media__/js/netsoltrademark.php?d=canadianpharmacyfirst.com http://wolframpedia.net/__media__/js/netsoltrademark.php?d=canadianpharmacyfirst.com http://nzjobs.com/__media__/js/netsoltrademark.php?d=canadianonlinepharmacyhere.com http://dobbs1.us/__media__/js/netsoltrademark.php?d=topcialisrxstore.com http://rapkin.org/__media__/js/netsoltrademark.php?d=cialisrxmsn.com http://ernesthemingwayrum.com/__media__/js/netsoltrademark.php?d=topcialisrxstore.com
ScottGuith
2020-08-22 14:26
Beneficial facts. Kudos. pharmacy price comparison http://canadiantoprxstore.com/order-vp-gl-online-en.html web medical information
MelvineBaf
2020-08-22 13:40
Nicely put, Thanks!
http://brownandbrown.org/__media__/js/netsoltrademark.php?d=canadiantoprxstore.com http://hoteloleajesereno.com/__media__/js/netsoltrademark.php?d=canadianonlinepharmacyhere.com http://e-girlscouting.net/__media__/js/netsoltrademark.php?d=msnviagrarx.com http://fotothread.com/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://cobaltleaf.org/__media__/js/netsoltrademark.php?d=msnviagrarx.com http://hairfrizz.com/__media__/js/netsoltrademark.php?d=canadianpharmaceuticalsrx.com http://gigweekly.com/__media__/js/netsoltrademark.php?d=topcialisrxpills.com http://www.hamptoninnseattle.net/__media__/js/netsoltrademark.php?d=canadianrxpillusa.com http://nascar-tv.us/__media__/js/netsoltrademark.php?d=topcialisrxpills.com http://karmicpursuits.com/__media__/js/netsoltrademark.php?d=cadmedbb.com http://newcouponsalerts.net/__media__/js/netsoltrademark.php?d=canadianpharmaciesmsn.com http://sbfilmfest.com/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://missuniverselatvia.com/__media__/js/netsoltrademark.php?d=msnviagrarx.com
RobertBap
2020-08-22 10:35
You've made your point! web medical information https://msncialis.com online pharmacy viagra
MelvineBaf
2020-08-22 10:33
Valuable posts. Many thanks!
http://pawsupgeneral.com/__media__/js/netsoltrademark.php?d=topviagrarxstore.com http://bandwidthventures.com/__media__/js/netsoltrademark.php?d=ntviagrausa.com http://youngevitywealth.com/__media__/js/netsoltrademark.php?d=msnviagrarx.com http://stemcellantibody.com/__media__/js/netsoltrademark.php?d=canadianpharmaciesrxstore.com http://hideawaycreekwines.com/__media__/js/netsoltrademark.php?d=msncialis.com http://screw21stcentury.net/__media__/js/netsoltrademark.php?d=canadianpharmacyed.com http://kaustdiscoveryscholarshipprogram.org/__media__/js/netsoltrademark.php?d=canadianrxpillusa.com http://gracemauritius.com/__media__/js/netsoltrademark.php?d=csvcialis.com http://unitedstatesstudwelding.com/__media__/js/netsoltrademark.php?d=canadianpharmacyed.com http://sarah-garnsey.net/__media__/js/netsoltrademark.php?d=cialisrxmsn.com http://www.brownandbunch.net/__media__/js/netsoltrademark.php?d=canadianpharmacyed.com http://zeytinyagiakademisi.com/__media__/js/netsoltrademark.php?d=canadiantoprxstore.com
MelviBaf
2020-08-22 10:19
This is nicely expressed. .
http://www.hfw1970.de/redirect.php?url=https://canadianrxpillusa.com https://www.price-sniper.com/back-office/redirect.php?target=TMHm7K2vi79xs17SIzD9OnEIo0CnEDrRhgyMFQcVLug=&url=https://topcialisrxpills.com http://www.horgster.net/Horgster.Net/Guestbook/go.php?url=https://msncialis.com http://simvol-veri.ru/xp/?goto=https://cadmedbb.com http://www.call-navi.com/linkto/linkto.cgi?url=https://canadianpharmacyfirst.com http://tourismchiangrai.com/goto.php?id=6&goto=https://canadianonlinepharmacyhere.com http://forum.eleanor-cms.ru/go.php?https://canadianpharmacyed.com  
drugstore online
http://americanbiomass.org/__media__/js/netsoltrademark.php?d=ntviagrausa.com http://www.romanresorts.eu/__media__/js/netsoltrademark.php?d=msncialis.com http://homemakersct.com/__media__/js/netsoltrademark.php?d=canadianpharmaceuticalsrx.com http://168openhouse.net/__media__/js/netsoltrademark.php?d=cadmedbb.com http://roberthyde.net/__media__/js/netsoltrademark.php?d=cialisrxmsn.com http://www.silveroutlet.biz/__media__/js/netsoltrademark.php?d=topviagrarxstore.com http://bsacompliance.com/__media__/js/netsoltrademark.php?d=csvcialis.com http://faceseverybody.com/__media__/js/netsoltrademark.php?d=canadianmsnpharmacy.com http://industrialmarketingmaven.com/__media__/js/netsoltrademark.php?d=msncialis.com
MelviBaf
2020-08-22 09:51
With thanks. Terrific stuff!
http://alclips.com/cgi-bin/at3/out.cgi?id=15&tag=toplist&trade=https://canadianonlinepharmacyhere.com https://morgenmitdir.net/index.php?do=mdlInfo_lgateway&eid=20&urlx=https://canadianonlinepharmacyhere.com https://www.coachingathleticsq.com/modules/mod_jw_srfr/redir.php?url=https://topcialisrxstore.com http://www.mammycunts.com/cgi-bin/crtr/out.cgi?id=348&l=topmain&u=https://msnviagrarx.com http://flyd.ru/away.php?to=https://canadianpharmaciesrxstore.com http://www.cubeporntube.com/te3/out.php?s=100&u=https://msncialis.com http://www.gymnasium11.com/links.php?go=https://topcialisrxpills.com http://www.building.gowhidbey.com/redirect.asp?id=11&url=https://msncialis.com http://www.datranny.com/movies/go.php?id=802464_1&url=https://canadianpharmaciesrxstore.com http://www.taskmanagementsoft.com/bitrix/redirect.php?event1=tm_sol&event2=task-tour-flash&goto=https://msnviagrarx.com https://images.google.pl/url?q=https://canadianonlinepharmacyhere.com http://teen.qkyoku.net/out.cgi?id=10636&url=https://canadianmsnpharmacy.com http://www.pelgrimspark.com/7-Gastenboek/go.php?url=https://topcialisrxstore.com http://www.immobilien-magazin.at/redirect.php?url=https://cialisrxmsn.com  
canada drug prices
http://vischer-parc.com/__media__/js/netsoltrademark.php?d=ntviagrausa.com http://neurosurgerytutor.net/__media__/js/netsoltrademark.php?d=topviagrarxpills.com http://testdataone.com/__media__/js/netsoltrademark.php?d=cialisrxmsn.com http://actorbeseen.com/__media__/js/netsoltrademark.php?d=cadmedbb.com http://serv-u-online.com/__media__/js/netsoltrademark.php?d=canadianmsnpharmacy.com http://musicsthebiz.com/__media__/js/netsoltrademark.php?d=canadiantoprxstore.com http://cityoflakeelsinore.com/__media__/js/netsoltrademark.php?d=ntviagrausa.com
KeitrSax
2020-08-22 09:26
With thanks, A lot of data!
rx online https://canadianonlinepharmacyhere.com pharmacy price compare
MelviBaf
2020-08-22 07:57
Whoa a good deal of good facts.
http://www.alphaerotic.com/movies/go.php?id=1068697_1&url=https://cialisrxmsn.com http://www.ehpix.com/cgi-bin/atx/out.cgi?s=60&l=face&u=https://canadianpharmaciesmsn.com http://mb.wendise.com/tools/thumbs.php?tds=3&trs=1&pid=videos&tid=bpgfr&pad=4px&cat=0&ts=156x117&tb=0px&tbc=FFFFFF&fs=12px&ff=Verdana&su=td&sl=ttm&tg=n&url=https://canadianpharmacy-us.com https://images.google.com.ai/url?q=https://msncialis.com https://maps.google.ae/url?q=https://canadiantoprxstore.com http://115.155.203.167/kcms/logout.aspx?url=https://canadianpharmaceuticalsrx.com http://pelenashka.ru/go.php?go=https://canadianpharmacyed.com http://www.black-matures.com/cgi-bin/at3/out.cgi?id=55&tag=top&trade=https://canadianpharmaciesmsn.com http://gs.orenhofen.de/externerlink.php?goto=https://canadianonlinepharmacyhere.com http://www.wpiqw.com/uchome/link.php?url=https://canadianpharmacyfirst.com  
canadian drug
http://georgewbushfreedominstitute.com/__media__/js/netsoltrademark.php?d=cadmedbb.com http://tceverywhere.net/__media__/js/netsoltrademark.php?d=canadianpharmaceuticalsrx.com http://oxylifehealth.com/__media__/js/netsoltrademark.php?d=msncialis.com http://vistapetroleum.biz/__media__/js/netsoltrademark.php?d=topviagrarxstore.com http://goldmelt.net/__media__/js/netsoltrademark.php?d=topviagrarxstore.com http://sitrickandcompany.net/__media__/js/netsoltrademark.php?d=canadianpharmaceuticalsrx.com http://jamesbeardawards.net/__media__/js/netsoltrademark.php?d=csvcialis.com http://hanwamaterials.net/__media__/js/netsoltrademark.php?d=topcialisrxstore.com http://ticketpoints.com/__media__/js/netsoltrademark.php?d=cialisrxmsn.com http://www.erisapedia.org/__media__/js/netsoltrademark.php?d=topviagrarxstore.com http://www.helsenytt.com/__media__/js/netsoltrademark.php?d=canadianpharmaciesmsn.com

发表评论:

Powered by emlog