[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Nimonknoca
2020-08-04 09:42
411621 viagra aurochem

https://viagraonlinegfsd.com/ - generic viagra

effects viagra healthy man

https://viagrashippingtoday.com/ - online viagra
Lelyaknoca
2020-08-04 09:33
best liquid is

d937
Katyaknoca
2020-08-04 08:30
ab5821 viagra in stores

https://sildenonline.com/ - sildenafil cost usa

do not take cialis with

https://ssupercialisever.com/ - buy cialis online

viagra in cancun

http://viagener2020.com/ - viagra online
Leollaknoca
2020-08-04 08:26
7bfb21 chemist viagra prices

https://sildenonline.com/ - cheapest price for sildenafil 100 mg

we choice very cheap cialis

https://ssupercialisever.com/ - cialis online

good choice lowest cost viagra

http://viagener2020.com/ - buy viagra online
knoca
2020-08-04 07:44
710521 buy female viagra with e check

https://viaonlinebest.com/ - buy viagra online
    

viagra commercial bob
Semyonknoca
2020-08-04 07:42
411621 viagra for women generic

http://viagrayqdd.com/ - buy viagra

look here generic viagra rx

http://vigraweuy.com/ - buy viagra

purchase cialis no rx

https://cialisdoitnow.com/ - cialis
knoca
2020-08-04 06:45
710521 acheter viagra bordeaux

https://viaonlinebest.com/ - nomi del viagra generico
    

campione di viagra cana
Bucekknoca
2020-08-04 06:45
3fa821 help to do assignment in malaysia

https://edpillsnews20.com/ - ed pills
Vladilenknoca
2020-08-04 06:03
acca21 buying viagra chemist uk

https://viagratodo20.com/ - generic viagra without a doctor prescription

free viagra trial no pay

http://viagrauyr.com/ - online viagra

viagra online questionnaire

http://viagrayqdd.com/ - cheap viagra
knoca
2020-08-04 02:35
710521 look here best viagra prices

https://viaonlinebest.com/ - acheter viagra bordeaux
    

generic viagra true false
knoca
2020-08-04 01:05
710521 in sales viagra

https://viaonlinebest.com/ - buy viagra
    

diabetes viagra free
knoca
2020-08-03 22:35
710521 viagra harder

https://viaonlinebest.com/ - viagra cheap
    

only today viagra viagra
knoca
2020-08-03 20:19
710531 viagra come somministrar

  
    https://viaonlinebest.com/  

prezzo per 50 mg viagra
knoca
2020-08-03 20:04
710531 look here best viagra prices

  
    https://viaonlinebest.com/  

viagra cialis impotenza
knoca
2020-08-03 19:35
710531 is generic viagra safe

  
    https://viaonlinebest.com/  

viagra with pay paypal

发表评论:

Powered by emlog