[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

MelviBaf
2020-08-31 07:18
You reported this fantastically.
http://totallyteenie.com/crtr/cgi/out.cgi?s=52&c=1&l=teenass&u=https://canadianpharmaciesmsn.com/ https://www.google.am/url?q=https://cadmedbb.com http://www.weichertnews.com/t.aspx?s=1&id=389&nl=1271&n=393&si=220953&url=https://topviagrarxpills.com http://www.crocopost.com/movies/go.php?id=1225793_1&url=https://canadianpharmacyfirst.com http://ricordu.fr/index.php?url=https://rxpharmacymsn.com https://images.google.gg/url?q=https://topcialisrxstore.com http://www.minimunchers.com/Redirect/Default?url=https://topviagrarxstore.com http://www.hqglamour.com/crtr/cgi/out.cgi?id=30&l=top_top&u=https://csvcialis.com http://dproxy.library.dc-uoit.ca/login?url=https://canadianpharmacyfirst.com
MelviBaf
2020-08-31 06:01
Superb postings, Cheers.
http://images.google.ro/url?q=https://topcialisrxpills.com http://www.feetbastinadoboys.com/Home.aspx?returnurl=https://canadianpharmacyed.com http://www.diversephds.com/apply.php?jid=135262&url=https://canadianpharmaciesrxstore.com http://qa.www.liveme.com/share/index.php?url=https://msnviagrarx.com http://images.google.com.bh/url?q=https://canadianpharmacyed.com http://www.boombos.nl/GBook16/go.php?url=https://canadianrxpillusa.com https://images.google.cg/url?q=https://canadianpharmaceuticalsrx.com http://geotimes.ge/links.php?go=https://canadianpharmaciesrxstore.com http://www7.buyerpricer.com/Go.aspx?rurl=https://cialisrxmsn.com http://beautynet.co.za/www/RotBannerStatic/redirect.asp?url=https://canadianpharmaceuticalsrx.com
MelviBaf
2020-08-31 05:20
Incredible lots of valuable material!
http://avto-for.ru/forum/go.php?https://canadiantoprxstore.com http://www.150teengalleries.com/cgi-bin/a2/out.cgi?id=40&u=https://canadianonlinepharmacyhere.com https://kherson.afisha-ua.com/out/?url=https://topviagrarxpills.com http://www.ersro.ru/bitrix/rk.php?id=21&event1=banner&event2=click&event3=8+/+<>1]+<header>1280_110]+banner_header_ing-mt&goto=https://canadianpharmaciesrxstore.com http://www.find-best-pantyhose.com/movies/go.php?id=799263_1&url=https://canadianpharmacyed.com http://fpn55.1upprelaunch.com/redirect.asp?linkurl=https://msncialis.com http://rxsystems.co.uk/redirect.php?u=https://cialisrxmsn.com https://www.google.cd/url?q=https://canadianpharmacyfirst.com http://www.bdsm--sex.com/cgi-bin/atx/out.cgi?id=70&trade=https://canadianpharmacyed.com http://www.gunclub-nowa-sport.de/redirect.php?url=https://canadianmsnpharmacy.com http://severe.worldweather.wmo.int/cgi-bin/goto?where=https://msncialis.com http://scanmail.trustwave.com/?c=6677&d=3eHL2zmR-mSEueRJSdX4UpJhLotL1yEZhefsffMCDw&u=https://topcialisrxstore.com http://old.civillaw.com.cn/explorer/hitting.asp?id=620&url=https://cadmedbb.com
MelviBaf
2020-08-31 04:07
Amazing advice. Appreciate it!
http://celinaumc.org/System/Login.asp?id=45779&Referer=https://canadianpharmacyfirst.com http://ns.barahla.net/redirect.php?url=https://canadianpharmacy-us.com http://www.krovatka.ru/f/rr.cgi?https://topviagrarxpills.com https://images.google.gm/url?q=https://canadianmsnpharmacy.com http://www.bad.org.uk/for-the-public/patient-information-leaflets/androgenetic-alopecia/?showmore=1&returnlink=https://msncialis.com http://anorexiaporn.com/cgi-bin/atc/out.cgi?s=90&l=gallery&u=https://canadianpharmacyfirst.com http://iimorireienkumiai.shijonawate.osaka.jp/mobile.cgi?id=5&mode=redirect&no=20&ref_eid=256&url=https://msncialis.com http://oceanaresidences.com/keybiscayne/wp-content/themes/oceana/floorplans/large/4-12thfloor/01S.php?url=https://canadianmsnpharmacy.com http://www.acuracatalog.com/redirect.php?link=https://canadianpharmacyfirst.com http://yoyaku-top10.jp/redirect?url=https://msncialis.com http://school364.spb.ru/bitrix/rk.php?id=12&event1=banner&event2=click&event3=1+/+<>2]+<>98x98_index]+&goto=https://canadianmsnpharmacy.com http://www.distribucion.itsitiomail.com/click2.aspx?boton=MTgyNDAzNA==&config=MTQ0NTE3&envionro=OTQ3NzQ=&codEmail=OTQ3NzQ=&email=dG9tYXNzZXR0aUB5YWhvby5jb20=&viral=MA==&nombreProv=WWFob28=&link=https://canadianonlinepharmacyhere.com https://www.avtoprozvon.ru/bitrix/redirect.php?event1=click&event2=button-rec&event3=&goto=https://msncialis.com http://charlineberg.com/searchpoint/redir.asp?reg_id=ptypes&sname=/searchpoint/search.asp&lid=1&sponsor=res&url=https://canadianonlinepharmacyhere.com
KeitrSax
2020-08-31 03:07
This is nicely expressed! ! online medicine shopping https://topviagrarxstore.com canadian drugs pharmacies online
MelviBaf
2020-08-30 22:25
Incredible a lot of excellent facts!
http://www.prestigepropre.com/searchpoint/redir.asp?reg_id=ptypes&sname=/searchpoint/search.asp&lid=2&sponsor=lea&url=https://topcialisrxpills.com http://www.it892.com/bbs/url.php?target=https://canadianrxpillusa.com http://szxljy.net/go.php?u=https://topviagrarxstore.com http://investiv.co/clicks/?a=INVESTIV-HOME-RR&p=INV&goto=https://canadianonlinepharmacyhere.com https://images.google.bj/url?q=https://canadianpharmacy-us.com http://watermarket.ru/redirect.php?url=https://canadianrxpillusa.com http://www.blogwasabi.com/jump.php?url=https://topcialisrxpills.com
ScottGuith
2020-08-30 21:28
Position well used!. canada meds http://canadianpharmacyed.com/order-isoptin-online-en.html canada online pharmacy
MelviBaf
2020-08-30 21:07
Terrific content. Kudos.
http://testforsites.ru/redirect.php?url=https://canadianpharmaciesmsn.com http://www.machinesproduction.fr/cgi-bin/clickcount.pl?url=https://canadianpharmaciesmsn.com http://youngertube.com/cgi-bin/atx/out.cgi?id=487&tag=twitter&trade=https://canadianpharmacyed.com http://www.mlhd.org/go.php?url=https://canadianrxpillusa.com https://images.google.se/url?q=https://topcialisrxpills.com http://www.mobiledevice.ru/red.aspx?u=https://canadianonlinepharmacyhere.com/ https://cse.google.mw/url?q=https://csvcialis.com http://www.secretlair.com/index.php?URL=https://canadianpharmacyfirst.com http://www.encyclo.co.uk/go.php?url=https://rxpharmacymsn.com http://wittols.com/out.php?url=https://topcialisrxpills.com http://www.toku-jp.com/Rouge/minibbs.cgi?https://csvcialis.com http://www.texeltv.nl/_a2/vp6.php?vid=musea/ecomare.wmv&link=https://canadianpharmacy-us.com
RobertBap
2020-08-30 20:29
Very well expressed without a doubt! . canadian pharmacy 365 https://ntviagrausa.com viagra online canadian pharmacy
ScottGuith
2020-08-30 18:37
This is nicely put! . discount canadian drugs http://topviagrarxstore.com/order-super_ed_trial_pack-online-en.html pharmacy price compare
RobertBap
2020-08-30 17:31
You made your point! national pharmacies online https://topswritingservices.com canadian prescription drugs
MelviBaf
2020-08-30 17:06
Wonderful posts. Thank you!
http://www.danviews.com/go/?url=https://canadianpharmacyed.com http://www.neorealty.ru/cgi-bin/redirect.cgi?https://canadiantoprxstore.com https://www.miss-sc.org/redirect.aspx?destination=https://canadianrxpillusa.com http://www.losvillas.ru/redirect?url=https://canadianpharmaceuticalsrx.com https://www.ahspares.co.uk/redirect.aspx?guid=<trackingid>&url=https://csvcialis.com https://images.google.com.kw/url?q=https://canadianpharmacyfirst.com http://www.rurazmer.ru/bitrix/rk.php?goto=https://topcialisrxpills.com http://colorsound.com.ua/clickout/?url=https://ntviagrausa.com http://charitiesbuyinggroup.com/membersearch.aspx?returnurl=https://canadianonlinepharmacyhere.com http://www.olgagouveia.com/link.asp?idc=1&idl=63&url=https://csvcialis.com https://maps.google.com.ng/url?q=https://canadianpharmaceuticalsrx.com http://www.eldiariodecoahuila.com.mx/a/includes/modulos/click.asp?id=329&url=https://canadianrxpillusa.com https://indianaeconomicdigest.com/Redirect.asp?UID=65909966&SubSectionID=-1&AdArrayID=15&AdPosition=1&Linkurl=https://canadianpharmaciesmsn.com http://porno.ar7.biz/out.cgi?id=00305&url=https://rxpharmacymsn.com
ScottGuith
2020-08-30 14:12
You expressed this very well. canadian pharmacy drugs online http://canadianonlinepharmacyhere.com/order-viagra_super_active-online-en.html medication costs
bxswulzjhxij
2020-08-30 13:32
51000 61171 22142 42978
http://bitly.com/1ntFjX
42891 22417 37599 34370
http://bitly.com/1ntFjX - Вратарь Галактики смотреть онлайн 43548 32298 38301 97051
kedozswwsdxr
2020-08-30 12:31
52674 98719 77661 68953
http://bitly.com/1ntFjX
95415 46491 84012 90509
http://bitly.com/1ntFjX - Вратарь Галактики смотреть онлайн 80573 67758 32923 51666

发表评论:

Powered by emlog